33

I have the following visa card from comdirect.de:

Front of the card. Number A: 4 groups of 4 digits, in the center of the card. Number B: 4 digits, smaller and underneath Number A to the left.

Back of the card. Number C: 3 digits in the center of the card. Number D: 7 digits / 2 digits at the top right of the card.

I guess:

  • Number A is my credit card number. The 4 groups don't have a meaning.
  • Number B: I have no idea. Might be my security code?
  • Number C is my security code.
  • Number D is eventually a card code (GD is Giesecke & Devrient)

So my question is mainly about number B and C.

Improve this question
0

3 Answers 3

Reset to default
49

Number A is my credit card number. The 4 groups don't have a meaning.

They do, actually. First digit is 4 for VISA, 5 for Mastercard, 6 for Discover/Diners Club, 3 for American Express/Diners Club (those are shorter than 16).

Also, first 6 digits for Visa and Mastercard are code numbers for the issuing institution. By these 6 digits anyone can know which institution issued the card, and what type of card it is (debit/credit, premiere or not, etc).

Number B: I have no idea. Might me my security code?

This is a security measure. These 4 digits must match the first 4 digits of your card number (the first 4 digits of the issuer code. The last 2 are card types for the issuer, though some different issuers may share the first 4 as well and only differ by the last 2). Amex cards don't have this (I'm not sure about Discover).

Number C is my security code.

Yes, this is called CVC or CVV2. It is used for card-not-present transactions. The purpose of the code is to verify that a payment card is actually in the hands of the cardholder/merchant, for example when using the card over the internet or phone.

On American Express cards this is 4 digits, and they appear on the front of the card.

Number D is eventually a card code (GD is Giesecke & Devrient)

This is bank-specific, so I guess whatever you said...:-)

Improve this answer
2
  • 1
    On Discover, number B (the duplicated digits) appears on the back in the signature field. And it's the last four that are duplicated. In addition there's a number indicating which iteration of physical card this is, in case of reissuing a card (for loss or expiration of the old one).
    – Ben Voigt
    Apr 7, 2014 at 17:00
  • 8
    A little more information, the first 6 numbers are called the BIN number. The remaining 10 numbers are generated by an algorithm by the financial institution. A type of credit card fraud can result if a fraudster learns the algorithm allowing them to generate all the card numbers in a batch. To combat this most companies limit the number of cards generated with a certain algorithm.
    – AxGryndr
    Apr 8, 2014 at 5:58
25

Number A is my credit card number. The 4 groups don't have a meaning.

The structure of card numbers is standardized in the payment card industry by part 1 of the ISO 7812 standard (paywall, see also Wikipedia's view). A card number is between 8 and 19 digits which are structured to convey the following information:

  • Major industry identifier (MII): the leading digit of the card number indicates the industry of the issuing authority, e.g. airline (2), travel (3), financial institution (4 and 5), and others. (Full table)
  • Issuer identification number (IIN), sometimes bank identifier number (BIN): a globally-unique identifier for the specific organization which issued the card. IINs are 8 digits in length (as of the 2017 standard, formerly 6 digits) including the MII number as their first digit. The American Banker's Association is the registration authority which allocates IINs to card issuers.
  • Account number: a number which identifies your account uniquely to the issuing institution so your transactions can be allocated correctly. These are allocated by the issuing authority and may comprise your account number or other digits which can be mapped to your account number. As issuing authorities often support multiple cards for a single account, there may be a sequence number (see the comments).

  • Check digit: all cards adhering to the standard include a final check digit generated using the Luhn algorithm. This provides a local error-detection mechanism for identification of common errors when manually-keying card numbers. It can identify single-digit errors and some instances of two-digit permutation (e.g. entering "25" rather than "52").

    It does not validate the authenticity of the card number as it is easy to invent a number which passes the check. However, it provides a mechanism to reject obviously incorrect card numbers early, without performing an online check with a merchant network to verify the card's authenticity.

Number B: I have no idea. Might be my security code?

This is the pre-printed BIN (bank identifier number). It generally repeats the first four digits of the embossed card number and acts as an additional security feature for cross-checking the issuing authority against the card number.

Number C is my security code.

This is a verification code which is typically used as additional authentication for card-not-present transactions. It has a variety of names depending on the card issuer:

  • card verification value (CVV2, Visa)
  • card verification code (CVC, Mastercard)
  • card identification number (CID, Amex, 4 digits)

Payment card industry regulations do not require a merchant to collect this value when processing a card-not-present transaction, but if they do collect it, it must not be persisted to any means of storage by the merchant after the transaction is authorised.

The existence of this code is intended to mitigate several types of attack:

  • Straight online theft/fraud of the card details - for example, by stealing the card details from a compromised merchant database. As PCI-DSS forbids the value being stored, this provides some modicum of protection against card re-use via other online/telephone means.

  • Card forgery - the value is not encoded on the magnetic strip or in the card's chip, so attempts to clone cards during in-person transactions and later use the details for mail-order are mitigated. In these circumstances, the attacker would need more time to visually inspect the card to clone the verification value; not impossible, but nevertheless non-trivial without arousing suspicion.

Number D is eventually a card code

If you say so!

Improve this answer
3
  • For Barclays, the last four digits on the card is the card issue number for the bank (not your personal issue number). When getting a new card, you can expect to have the same card number but however the last four digits will change (usually the last two, depends when you last got a new card). It can change from 5034 to 5042 for example.
    – AStopher
    Nov 12, 2014 at 10:32
  • 1
    @cybermonkey good points, I've updated the answer to make it clearer it isn't the account number per se, but could be a separate, unique identifier which links your card to your account in the issuer's database. (Having multiple cards on a single account is a prime example of where such a facility is needed).
    – Cosmic Ossifrage
    Nov 12, 2014 at 18:54
  • I've downvoted because you only talk about the 16 digit number, when the OP asked about three other numbers you don't mention at all.
    – Andy
    Jun 9, 2015 at 14:05
-1

The first digit tells you what type of business issued your card. The first six numbers identity your bank/issuer specifically. The seventh and following digits identify YOU. The final number checks you typed everything in correctly. You can also check whether any credit card number is valid using the Luhn algorithm. The Luhn algorithm is only in place to check for mistakes when typing your number in online or reading it out over the phone.

More here: http://redshed.co.uk/blog/how-do-credit-card-numbers-work/

Improve this answer
1
  • 1
    The first digit alone is not enough to tell the card scheme. Yes, every AmEx starts with a 3, but 3 can also correspond to JCB, Diners, or Maestro. 5 can be UnionPay, Interac, Mastercard, Maestro, etc. The Luhn10 check is not necessarily just for catching mistakes, but it's an easy way to determine if a number could be valid or not. If it doesn't pass, then there's no point in proceeding (could be a fraud attempt).
    – Noah
    Oct 29, 2014 at 14:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .