I had a series of attempted fraudulent payments on my debit card, my bank was very proactive and alerted me, and I have received a new card. However I had a call on the same day my new card arrived from "Anthony Brown", who had a very strong Indian accent, but he was able to recite the first 4 digits on my new card. How would this scammer know them ?
-
6I'm going to guess you have only had one credit card and have never needed to get it replaced.– DKNguyenCommented Jan 19 at 22:02
-
11Next time, ask the scamming bugger to cite you the last four digits of your card. :)– KazCommented Jan 20 at 8:00
-
9@Kaz I would ask the middle 4 digits. The last 4 digits are less protected then the middle part so it's more likely that they get leaked. When using online payment providers (e.g. Stripe) when an application "saves" a card the user sends the number directly to Stripe which provides an opaque token to the application to use the card, the brand/type information, and the last 4 digits of the card number. This is done to allow the application to show the user which card is going to be charged. If that application has a breach the last 4 digits can be leaked, not so for the middle part.– BakuriuCommented Jan 20 at 8:42
-
12@Bakuriu But whether they recite all the digits and every card your mother had in her maiden name, don't tell them anything. Scammers are in the business of turning a little bit of knowledge (about you) into a lot of (your) money.– TheracCommented Jan 21 at 5:43
Add a comment
|
2 Answers
The first 4 digits of a card number typically just indicate the issuer and are probably the same as your old card and lots of other cards from the same bank.
From Wikipedia:
Payment card numbers are composed of 8 to 19 digits,[1] The leading six or eight digits are the issuer identification number (IIN) sometimes referred to as the bank identification number (BIN)
answered Jan 19 at 9:35
GS - Apologise to Monica♦GS - Apologise to Monica
30.1k8 gold badges94 silver badges119 bronze badges
-
4The first few digits also encode the type of card (e.g. Mastercard or Visa). But that also isn't going to change if you're issued a new card.– Simon BCommented Jan 19 at 9:49
-
3@SimonB yeah, I was simplifying because it amounts to the same thing. Commented Jan 19 at 13:29
-
10If you have to work with credit cards on a regular basis, you'll start to pick up on the patterns. For example, if you've got a Discover credit card, I can tell you without looking that it starts with 6011– maplesCommented Jan 19 at 20:23
-
12Also, when you enter a credit card number on an online form these days, you'll notice the autodetected Visa or Mastercard symbol light up after only a few digits are entered. Commented Jan 19 at 20:43
-
5You probably weren't the only one scammed that day, and the scammers know that the first things people do include cancelling the old card and getting a new one. Anthony Brown sahib probably rang not only you, but all the other people who were scammed, so he could make a shrewd guess at the first 4 digits, using a similar list to the Wikipedia article. No doubt he made some wrong guesses, but he only needs to impress some people to get their trust... Commented Jan 20 at 1:06
The first few digits of a credit card number identify the bank. When the bank gives you a new card it probably begins with the same 4 to 8 digits. So if a scammer knew your old card number, he'll know the first 4 digits or so of you new card number, because it's the same.
Some banks get multiple blocks of numbers so it isn't NECESSARILY the same. But probably. And scammers rely a great deal on "probablies". If they get something wrong and you call them out, at worst they just go on to the next potential victim. Just for example, I once got an email from Bank of America saying my account had been hacked, they had put a security hold on it, and I should log in to this web page to unlock my account. Which all could have been totally plausible except I don't have an account with Bank of America. I presume the web site was run by the scammer, it would ask for my ID and password and then the scammer could access my account and empty it out. I'm guessing the scammer had no reason to think I had an account with BOA. He just picked a big bank and sent out a million emails. If most of those people didn't have BOA accounts, fine, they wouldn't fall for the scam. But if he hit enough people who DID have BOA accounts, some number might fall for it.
