11

A company asked me to provide the first six digits of my credit card, along with the last four, to identify a credit charge to my account.

I'm wondering - that's ten of sixteen digits. How secure is it to give away this information? Given that the formula to generate a credit card number is well-known, am I opening myself to any potential issues by disclosing this information?

This is for a Dropbox charge. I have an account with them that I can't access through conventional means (as it was a contractor account for an old workplace) and so they've required me to send this information so that they can verify my identity along with the charge. While it makes sense, I don't remember any companies asking for the first six before (which identifies the carrier and the type of card you have).

Improve this question
6
  • 1
    If you wouldn't trust them with your full credit card number, don't give them ANY digits. Period.
    – keshlam
    Commented Apr 28, 2015 at 3:29
  • 1
    Can you explain further why the company needs these digits? I don't quite understand what it is that you are looking for this company to do that they won't do without the digits.
    – Ben Miller
    Commented Apr 28, 2015 at 3:57
  • @BenMiller Disclosure - this is for a Dropbox charge. I have an account with them that I can't access through conventional means (as it was a contractor account for an old workplace) and so they've required me to send this information so that they can verify my identity along with the charge. While it makes sense, I don't remember any companies asking for the first six before (which identifies the carrier and the type of card you have).
    – user12337
    Commented Apr 28, 2015 at 4:09
  • 2
    @lunchmeat317 If you are already doing business with Dropbox, they presumably already have your credit card number. I guess I don't see the security problem with giving your credit card number to a company that you have already given your number to.
    – Ben Miller
    Commented Apr 28, 2015 at 4:16
  • It has happened to me once in the past, but only the first six and not the first six and last four...
    – yu_ominae
    Commented Apr 28, 2015 at 4:17

3 Answers 3

Reset to default
17

That's a compromise. The last 4 digits are very easy to learn from the person's trash. The first 6 are the BIN number, but each bank has many, so they're not as easy to guess. On the other hand, the missing 6 digits leave a million of options to brute force. Even if someone does guess your full credit card number - you'll just cancel it and get a new one. They, on the other hand, obviously have the full number. So with you providing information which is not as easy to find and them being able to match it to what they have without you disclosing your full account number allows you to establish your identity in a relatively secure manner with a low chance of you being an imposter.

Sounds OK to me, especially if you're talking about a reputable company who you know has already got your credit card information.

Improve this answer
4
  • Point taken. I may opt to change the card anyway, as Dropbox doesn't provide phone support - as such, I was forced to disclose this information via email, which I really don't trust at all.
    – user12337
    Commented Apr 28, 2015 at 4:20
  • 2
    @lunchmeat317 that would be a sensible precaution.
    – littleadv
    Commented Apr 28, 2015 at 4:24
  • 2
    The number of combinations possible from the 6 digits will be limited due to the Luhn test.
    – Kami
    Commented Apr 29, 2015 at 13:42
  • Luhn also means low value digits can be swapped for the same check digit, this actually makes it harder to guess as it is a very coarse hash.
    – mckenzm
    Commented Jan 29, 2016 at 2:35
4

There is this thing called the luhn-10 test

If you don't know 6 digits then there are 1 million combinations. With the luhn-10 test that is reduced to somewhere in the neighborhood of 70,000

Improve this answer
1
  • If you use the luhn-10 test on the card number that you do know the length of, it is possible to work out what the remaining digits should sum to. Out of the total 1,000,000 different combinations of digits, each remainder of 0-9 has exactly 100,000 combinations.
    – Shaun Cockerill
    Commented Nov 22, 2021 at 8:21
2

I believe the key is that they are trying to connect you with an old account. it was a contractor account for an old workplace

Their records have the full credit card number, expiration date, and security code. If the charge was from several years ago you would be unlikely to remember previous security codes and expiration dates. Of course with the number of changes made to react to some of the recent breaches I have had one card with three different last fours in the last 5 years.

Because it was originally provided to Dropbox several years ago, the number you are providing will not be useable by them without the newest expiration date and security code.

Improve this answer
1
  • 1
    Expiration dates are highly guessable, and "security code" (properly called CVV2) is not required in order to charge the card. In fact, storing the CVV2 code in their records is not permitted.
    – Ben Voigt
    Commented Dec 2, 2019 at 22:35

You must log in to answer this question.