8

A company asked me to provide the first six digits of my credit card, along with the last four, to identify a credit charge to my account.

I'm wondering - that's ten of sixteen digits. How secure is it to give away this information? Given that the formula to generate a credit card number is well-known, am I opening myself to any potential issues by disclosing this information?

This is for a Dropbox charge. I have an account with them that I can't access through conventional means (as it was a contractor account for an old workplace) and so they've required me to send this information so that they can verify my identity along with the charge. While it makes sense, I don't remember any companies asking for the first six before (which identifies the carrier and the type of card you have).

  • If you wouldn't trust them with your full credit card number, don't give them ANY digits. Period. – keshlam Apr 28 '15 at 3:29
  • 1
    Can you explain further why the company needs these digits? I don't quite understand what it is that you are looking for this company to do that they won't do without the digits. – Ben Miller Apr 28 '15 at 3:57
  • @BenMiller Disclosure - this is for a Dropbox charge. I have an account with them that I can't access through conventional means (as it was a contractor account for an old workplace) and so they've required me to send this information so that they can verify my identity along with the charge. While it makes sense, I don't remember any companies asking for the first six before (which identifies the carrier and the type of card you have). – lunchmeat317 Apr 28 '15 at 4:09
  • 1
    @lunchmeat317 If you are already doing business with Dropbox, they presumably already have your credit card number. I guess I don't see the security problem with giving your credit card number to a company that you have already given your number to. – Ben Miller Apr 28 '15 at 4:16
  • It has happened to me once in the past, but only the first six and not the first six and last four... – yu_ominae Apr 28 '15 at 4:17
11

That's a compromise. The last 4 digits are very easy to learn from the person's trash. The first 6 are the BIN number, but each bank has many, so they're not as easy to guess. On the other hand, the missing 6 digits leave a million of options to brute force. Even if someone does guess your full credit card number - you'll just cancel it and get a new one. They, on the other hand, obviously have the full number. So with you providing information which is not as easy to find and them being able to match it to what they have without you disclosing your full account number allows you to establish your identity in a relatively secure manner with a low chance of you being an imposter.

Sounds OK to me, especially if you're talking about a reputable company who you know has already got your credit card information.

  • Point taken. I may opt to change the card anyway, as Dropbox doesn't provide phone support - as such, I was forced to disclose this information via email, which I really don't trust at all. – lunchmeat317 Apr 28 '15 at 4:20
  • 1
    @lunchmeat317 that would be a sensible precaution. – littleadv Apr 28 '15 at 4:24
  • 2
    The number of combinations possible from the 6 digits will be limited due to the Luhn test. – Kami Apr 29 '15 at 13:42
  • Luhn also means low value digits can be swapped for the same check digit, this actually makes it harder to guess as it is a very coarse hash. – mckenzm Jan 29 '16 at 2:35
4

There is this thing called the luhn-10 test

If you don't know 6 digits then there are 1 million combinations. With the luhn-10 test that is reduced to somewhere in the neighborhood of 70,000

1

I believe the key is that they are trying to connect you with an old account. it was a contractor account for an old workplace

Their records have the full credit card number, expiration date, and security code. If the charge was from several years ago you would be unlikely to remember previous security codes and expiration dates. Of course with the number of changes made to react to some of the recent breaches I have had one card with three different last fours in the last 5 years.

Because it was originally provided to Dropbox several years ago, the number you are providing will not be useable by them without the newest expiration date and security code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.