| 
View
 

Credit Cards and PCI

Page history last edited by peterga 10 years, 2 months ago

Card Number Structure

 

An ISO/IEC 7812 number is typically 16 digits in length. It consists of:

  • a six-digit Issuer Identification Number (IIN) [ previously BIN ], the first digit of which is the Major Industry Identifier (MII), e.g. Visa
  • a variable length (up to 12 digits) individual account identifier.
  • Typically BIN+4 will designate a given portfolio, e.g. Visa Gold with customers with a certain risk profile
  • Last 6 are not randomized, may be contiguous (as close as Luhn check allows)
  • a single check digit calculated using the Luhn algorithm.

 

Test Card Numbers

 

Most Common Test CCNs:

 

CREDIT CARD TEST ACCOUNT NUMBER
Visa 4111 1111 1111 1111
MasterCard 5555 5555 5555 4444
American Express 3782 8224 6310 005
Discover 6011 1111 1111 1117
JCB 3566 1111 1111 1113

 

More Detailed:

 

Cardtype

CC number

CV2/CVV

Start date (YYYY/MM)

Expiry date (YYYY/MM)

Currency

Visa

4111 1111 1111 1111

111

 

2011/08

USD

Diners

3041 4393 953 143

888

 

2011/08

USD

Mastercard

5105 7814 5497 5390

132

 

2011/08

USD

Discover

6011 0009 9068 5244

111

 

2011/08

USD

JCB

3528 0001 1234 5670

616

 

2011/08

USD

AMEX

3402 0715 6440 372

0965

 

2011/08

USD

Electron

4844 4412 8367 2242

344

 

2011/08

GBP

Dankort

4571 0011 1365 9873

481

 

2011/08

DKK

China Unionpay

6221 2600 8383 6130

111

 

2011/08

USD

Switch

4903 0300 3486 2499 872

123

2006/07

2011/08

GBP

Delta

4988 2444 3212 3448

766

 

2011/08

GBP

 

 

Luhn Test:

 

Simplistic Regex:

find . -type f -print0 | xargs -0 grep -alE '[^\d]\d{4} ?\d{4} ?\d{4} ?\d{4}[^\d]'

Not allowed in Logs


From: Michael Wyatt

Sent: Friday, July 12, 2013 7:48 AM

That is correct, for PCI, only the PAN and CVV have to be masked in logs.

The others are: Pin block and Full Track data, those can never be stored in logs either but those come from swipe card Points of sale systems.

(Bin, Last-4, Expiration date okay; encrypted version of CVV okay)

Comments (0)

You don't have permission to comment on this page.