2

This question is similar in spirit to Why do some online stores not ask for the 3-digit code on the back of my credit card?.

I don't see how asking for the credit card's expiration date as well as the number can possibly provide any extra security. As far as I know, the number and the expiration date are always given together when making online or telephone purchases by credit card, so I can't imagine any even vaguely realistic scenario in which a thief could get the number without also getting the expiration date. Unlike with the security code, you don't even need to turn the credit card around to get the expiration date, and are no rules against storing the expiration date along with the number.

If the point is just to increase the possible number of data combinations in order to prevent brute-force guessing, then it would be far more efficient to just make the number two digits longer. (Since credit cards usually expire 3-5 years after being issued, the expiration month only multiples the number of combinations by 36-60, whereas two extra digits would multiply by 100). That would also make the data format more consistent, simplify the data entry and storage.

  • My first guess was to ensure that the card isn't already expired. But what's to stop the customer from lying? – RonJohn Jul 5 '17 at 1:00
  • 4
    @RonJohn Well, they check with the credit card issuer at the point of sale before accepting the payment, right? If the card were already expired, then the payment would get rejected. – tparker Jul 5 '17 at 2:40
  • 1
    you can get the number without the date if you have an old bill from my garbage. Or if you have my expired card which I threw out when I got the new one. (Well, not me personally, I shred my bills and cut my credit cards into little pieces, but not everyone does.) – Kate Gregory Jul 5 '17 at 12:09
  • 1
    @KateGregory Do your credit card bills really contain the complete credit card number? That seems like the security risk, not failing to ask for the expiration date. Why would they do that? And as discussed below BobbyScon's answer, when a credit card expires I don't think the company ever issues a new card with the same number. – tparker Jul 5 '17 at 17:58
  • your cc company clearly varies. Yes, paper bills did and presumably still do include the entire number. And yes, my number stays the same when I get a new card with a new expiry date. This is my normal. And the people who make all these rules live in the expanded normal that covers all you experience, all I experience, and a whole lot else besides. They make rules to cover all those normals. Now you know. – Kate Gregory Jul 5 '17 at 18:01
5

tldr; There is a potential security benefit to expiration dates (vs longer numbers), but the main reason they exist is probably just leftover from when they were actually needed.

First, here's a security benefit an expiration date has beyond just making it harder to guess:

Expiration dates make it much easier to detect attemps to guess CC numbers.

Imagine that someone is trying to brute force CC numbers. If they didn't need to provide an expiration date they would keep trying different numbers until they hit one that works. From the bank's (or processor) point of view, they only see successful transactions, or invalid account attempts. For those that are invalid there is nothing they can do.

Now consider that the would-be theif is trying account numbers with an expiration date: once they have an account number, they must loop through all the possible expiration dates for that account. Now when the bank (or processor) detects invalid account attempts due to incorrect expiration dates, they now know this account has potentially been compromised, and can keep an eye on it. This makes the fraud-detection algorithms much more effective.

Security benefits aside, it's likely that expiration dates made a lot more sense back in the days when transactions weren't approved or denied immediately; they were carbon copied with a swipe machine and processed sometime in the future. Back then the cashiers actually had to look at the expiration date and make sure the card was still valid before accepting it as payment. Even if expiration dates aren't actually needed anymore, there are enough minor benefits besides security to keep them around, such as giving banks a reason to send you a new card with an updated look and feel, or additional technology embedded (chip), or even just to force you to notify the bank of your current address so you can receive the new card.

5

It actually is an extra level of security, exactly as you described. It's not a lot, but it is an extra data point that can be checked against. Someone stealing a card number now has to steal the expiration date data as well, which isn't always the case and not all retailers store expiration data, they simply use it as a checksum.

The expiration date itself serves a few purposes, but primarily as a way for CC issuers to ensure your card is physically operational longer. Mag stripes and lamination wear down after a few years, so having the card expire triggers a new card being sent to you. If you don't destroy that card, and someone else finds/steals it, they won't have the new expiration date to use for the validation process.

Adding more digits to the card numbers is not a simple feat. There is, however, a movement from some of the major companies to start using up to 19 digits on a credit card. (Note that 19 digit cards have existed for a while, but are relatively rare). Even still, longer card numbers really aren't any more secure. Thieves steal the whole card number and it's not just a random generator (although that does exist as well). It's just as easy to steal a 19 digit number as it is a 16 digit number. The expiration date is still a point for validation, regardless of card number length.

Depending on the agreement between the vendor (the store you're purchasing from) and the payment processor, they may be required to gather expiration, CVV, and zip code. For card not present, they may even require mailing address. All of these combine to add even more layers of security, or really, risk reduction. The vendors will pay different per transaction fees based on how much, or little, information they collect.

At the end of the day, there are tons of things the industry could do to decrease risk, but the factors that come into play are largely, if not entirely, logistical.

  • 1
    Do I understand the last sentence of the first answer in your second link correctly when I interpret it to mean that starting later this year, credit cards will have a minimum of 19 digits? Since that change already provides dozens of times more additional protection than the expiration date, why don't they stop requiring it since they're going through a massive logistical overhaul anyway? – tparker Jul 5 '17 at 2:34
  • 2
    I would be interested to see if anyone at any point actually ran a cost-benefit analysis of whether the tiny extra security provided by requiring the expiration date is worth the extra cost and inconvenience. Or whether that requirement has ever prevented a single case of credit card theft. I strongly suspect the answer to both questions is no. – tparker Jul 5 '17 at 2:37
  • 2
    @tparker - Technically, every piece of current software should support up to 19 digits. There are some debit cards that long, and that's the current maximum defined in the standard. Not everything actually does, but it's supposed to. – Bobson Jul 5 '17 at 2:47
  • @BobbyScon - You may want to add that in the case of a lost card, it's easier to issue a new one with the same PAN but different expiration date, than to issue one with a totally new card number. The old one will still stop working, but anything that saved the card number won't have to replace it. – Bobson Jul 5 '17 at 2:50
  • @Bobson I strongly doubt that any serious credit card issuers would issue a new card with the same number but a new expiration date to someone who lost their old card. It would be trivial for someone with the old card to guess the new combination. Besides, what's the advantage of not needing to update the number if you need to update the expiration date anyway in order for the new card to work? Issuing a new card with the same number but a new expiration date wouldn't give you any convenience gain relative to changing the number, but it would open up a huge security risk. – tparker Jul 5 '17 at 6:12
3

I don't see how asking for the credit card's expiration date as well as the number can possibly provide any extra security.

Expiration dates were never intended at all to provide any extra security. You're working with a flawed premise. A lot of infrastructure was put in place before the advent of instant account verification. At this point (Visa cleared $8,200,000,000,000 of transactions in 2016) changing the data collection practices of the entire system is no small task, no matter how redundant or unnecessary you feel it is.

Expiration dates are about limiting the issuing bank's risk. Collecting and/or recording the expiration date is about limiting or removing the liability on the transaction at the verious steps between charge and payment to the vendor in the case of a chargeback. Vendors are under contract not to accept payment from or even attempt to charge a card that has expired and, in the case of stored card data, should not charge account information that has expired. Even if expired account information should fail if an authorization is attempted. And even though present day credit account renewals involve little more than reissuing a card with a new expiration date.

Not every piece of credit card data is as about fraud prevention, though there are tangential anti-fraud uses like reaffirming the expiration date or last 4 of the card number to help ensure the mag strip data matches the physical card info. To reiterate, expiration dates have absolutely nothing to do with security and everything to do with liability.

  • 2
    Are you explaining the motivation for having expiration dates, or for giving the expiration dates to the seller at the point of sale? I understand the justification for the former - it's the latter I'm confused about, and I don't see why the seller can't just check whether your card's expired when they run it. – tparker Jul 5 '17 at 6:16
  • 1
    My question is about sales made online or over the phone - there's no mag strip reader. – tparker Jul 5 '17 at 6:50
  • 1
    When you buy things online, the web site checks with the credit issuer whether the card is valid and unexpired before accepting the payment. Similarly, when you buy things in person, the cashier doesn't just swipe the card - they always wait a moment to see whether the payment went through correctly. I assume the same is true for payments made over the phone. – tparker Jul 5 '17 at 17:29
  • 1
    I'm not sure that it's a fraud prevention tool. But I don't see the point of the system having been designed to need the expiration date in the first place - the vendor always checks with the bank whether the card has sufficient credit before accepting the payment, and that check would also reveal if the card is expired. Providing the expiration date seems redundant. – tparker Jul 5 '17 at 17:53
  • 2
    It's definitely not intended to be a fraud prevention tool. The vendor wants a record that it believed it was attempting payment from an account presumed to be valid at the time. The vendor, the processing agent, the network and the bank, etc all have some sort of liability on the transaction and each step along the way wants to have it's ducks in a row if something goes sideways. Just because there is some sort of precharge verification performed by doesn't mean you can skip the record keeping. And more than account number and amount is submitted for verification anyway. – quid Jul 5 '17 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.