Is it possible to brute-force or accidentally use someone else's credit card?

Question

Reviewing my bank statements, I noticed that I several months earlier had been charged about 13 GBP by Netflix on my credit card, but only for one single payment (not recurring). I knew that the payment could not have been made by me, so I contacted Netflix who suspended the account it was connected to, as well as reimbursed me the money. What keeps bugging me though is how this actually happened.

First of all, if someone had stolen my credit card information, why would they only use it for one single Netflix payment and not e.g. purchasing things online?

Secondly, this particular credit card I only use for purchases in offline stores and I have never used it in any dodgy places or countries. I therefore do not see how my information could even have been stolen in the first place.

What I am wondering is if it is practically possible that someone could have used my credit card by accident, due to similar numbers? Given that the first part of the credit card number is not random, the number of different card numbers are significantly less than one could assume, given the full 16 digits. There are still hundreds of millions of combination, and on top of this there are different validity dates as well, but, on the other hand, there's a vast amount of credit card purchases being done all the time, making it probable that an improbable event actually happens every now and then...

Or could there be a simpler explanation?

Answer 1

Not even close.

Let's start with the check digit, the last digit in your credit card number. It is calculated on a public formula, and many web pages have simple Javascripts to check (locally, no need for network) whether the card number checksums. It would be easy enough to increment the rest of the number and come up with any number of valid 16-digit credit card numbers, many associated with real accounts.

That's why the website also wants:

• expiry
• CVV2 or whatever they call the 3-digit number on the back, usually
• Post code, usually
• name on the account

And the charge will be refused unless all of these reasonably match up. CVV2 is used for exactly what it says on the tin, proof you do have the card in your hand. But so are the other figures.

• Expiry is used like CVV2, effectively adding 5 bits of entropy to it.
• Post code is a "mini 2-factor authentication", it's something you know that's not on the card. That's why if you lose a credit card and a bad guy finds it, it will be used at places the perp can swipe, and not online. This is of limited value if you are in a small town.
• Name is physically on the card, but it helps merchants correllate the person they are interacting with, with the name on the card. That is part of why TSA wants to see that your photo ID corresponds to the name on the ticket. It means if Frank Abagnale tries to fly on Tyrone Justice's stolen credit card, he is forced to blatantly book with Frank's name as the passenger and Tyrone's name as the credit card. And that gives the airline's security department some signal to work with.

Could they accidentally exchange two digits 2 spaces apart on the card, giving the same check digit? Sure. Could they accidentally have the same expiry? Maybe. Could they also fatfinger their CVV instead of yours? No. Could they also fatfinger their ZIP code? No. Could they also fatfinger their last name? Not without a Ouija board.

Now, Netflix may have a deal where they don't need to ask for ZIP. In which case, a $9/hr clerk who handled your card physically could sign up with info they cribbed off the card. Or, you could be in a small town where the ZIP is pretty guessable. That is most likely how this happened, a simple, F2F petty crime.

Answer 2

Credit Card numbers are not used consecutively, but have check-sum style protection built in.
What that means is that a random number has a very small chance to constitute a valid number, and a simple digit-switching will result in an invalid number.

This avoids most accidental use of someone else’s number, but of course someone that knows the checking algorithm - or is patient and diligent enough to try many numbers - would be able to sooner or later produce a valid number, with matching validity month and year.

Chances are it was an intentional abuse, but yes, it’s strange he used it only once. Maybe he produces many numbers this way, and avoids detection by limiting usage to once - most people would overlook a single small charge, or not bother (if they even look at their charge list at all).

Answer 3

Could it be a valid transaction by someone you know?

It's not really enough grounds to accuse anyone, but such transactions (completely valid, small but unexplainable) sometimes are made with the legitimate card by someone other than the cardowner, often someone the cardowner knows - for example, a child, or a buddy during consumption of drinking/pot/whatever. It may be "oh, I really want this, I need to borrow a bit from Bjorn - he's busy but he probably won't mind", or it may be more sinister, e.g. I've seen people disputing chip-present ATM withdrawals (so very unlikely to have a cloned card), claiming that the card was always with them, but recognizing a family member when shown the ATM video.

A Netflix purchase certainly is within the range that I can imagine (in certain scenarios, for certain mindsets) someone doing without thinking much just because your wallet was available.

Answer 4

Offline use doesn't necessarily add to safety, there's always a chance for your numbers to be lifted by anyone handling your card. This seems more likely than someone generating card numbers or an accidental typo, but either of those are also possible.

A typo would be quite rare because they'd have to typo at least two of the numbers and have them still pass the checksum (Luhn algorithm or other) and the security code (CVV) would still have to match (pretty sure Netflix uses CVV code).

Generating numbers is also possible, the rules aren't too complex, but there are many possibilities as you mention. It could be that they used Netflix as their validity check for generated numbers before trying them on profitable purchases, but I'd imagine there are easier options as you can only try so many numbers before websites will get fussy, especially major websites like Netflix. From my brief research it sounds like it's much easier to obtain actual card numbers than to generate them, so I'd likely put this one in the plausible but not probable category.

To me, the single usage to Netflix feels amateurish or accidental. The typical fraudulent charge would be for something easily converted to cash, like gift cards or something tangible. So my money is on an inexperienced, dim-witted fraudster that had access to your card at some point, but we're all just left to guess/wonder.

Answer 5

someone could have used my credit card by accident, due to similar numbers?

No.

this particular credit card I only use for purchases in offline stores and I have never used it in any dodgy places or countries. I therefore do not see how my information could even have been stolen in the first place.

Data can be stolen from stores where you pay offline, too. From the simple use of skimmers, to vendor compromises. See for instance the famous Target breach four years ago, the recently disclosed compromise at Marriott hotels, or the recent issue at NEXTEP clients.

if someone had stolen my credit card information, why would they only use it for one single Netflix payment and not e.g. purchasing things online?

With card breaches, the thieves often have much more card numbers than those they can abuse (either directly or by those that buy them chunks of cards). Also note that stolen credit card details lose value from day to day, and too many cards make the breach easier to be found.

In this case, the NetFlix charge may have been simply a transaction to verify that the stolen credit card data was valid. Other ways crooks use for this are making small donations to well-known non-profits.

Since there was an unauthorized use of your card, you should contact your bank to let them know and get it replaced.

The fact that you only found an unauthorized transaction doesn't mean there wouldn't be more in the future. Plus, your credit card contract probably obligates you to promptly notify them of any misuse of your card.