How Credit Card Numbers are Generated Elaina Liu

Basics 12-19 numeric digits Composed of: Major Industry Identifier (MII) Issuer Identification Number(IIN)/Bank Identification Number(BIN) User ID Check number/checksum

MII The first digit that indicates what kind of institution issued the card 1 and 2: airlines 3: travel and entertainment 4 and 5: banking and financial institutions 6: merchandising and banking 7: petroleum companies 8: telecommunication companies 9: national assignment

IIN Digits 2-6, together with the first digit, that tell who issued the card Popular ones: Visa: 4- Mastercard: 51- to 55- Diners Club: 36-, 38- Discover: 6011-, 65- JCB: 35- American Express: 34-, 37- See https://en.wikipedia.org/wiki/List_of_Issuer_Identification_Numbers for a complete list of IINs

User ID The 7th digit to the second-to-last digit that indicate customer account number Not necessarily the same as one’s actual bank account number Most companies use 9 digits, but can be up to 12 digits

Check Number The very last digit that is used to validate the entire card number Computed and verified using the Luhn algorithm Can quickly identify if the card has a valid number or not Does not catch all errors

5 4 5 7 6 2 3 8 9 8 2 3 4 1 1 x Example IIN User ID MII Check Number Arbitrary example taken from http://datagenetics.com/blog/july42013/index.html

Luhn Algorithm Named after IBM scientist Hans Peter Luhn Also known as the “mod 10” algorithm Designed to protect against accidental errors, not malicious attacks Based on principle of modulo arithmetic and digital roots

How to Calculate Check Digit 5 4 5 7 6 2 3 8 9 8 2 3 4 1 1 x 2× 2× 2× 2× 2× 2× 2× 2× 10 10 12 6 18 4 8 2 Every second digit from right to left, starting from the check digit

How to Calculate Check Digit 5 4 5 7 6 2 3 8 9 8 2 3 4 1 1 x 10 10 12 6 18 4 8 2 Get Digital Root 1+0=1 1+0=1 1+2=3 1+8=9 1 1 3 6 9 4 8 2

How to Calculate Check Digit 5 4 5 7 6 2 3 8 9 8 2 3 4 1 1 x 1 1 3 6 9 4 8 2 4 7 2 8 8 3 1 1 + 4 + 1 + 7 + 3 + 2 + 6 + 8 + 9 + 8 + 4 + 3 + 8 + 1 + 2 = 67

How to Calculate Check Digit 5 4 5 7 6 2 3 8 9 8 2 3 4 1 1 x Sum = 67 x = 10 - (67 mod 10) = 10 - 7 = 3 5 4 5 7 6 2 3 8 9 8 2 3 4 1 1 3

Come up with a credit card number and test its validity http://www.validcreditcardnumber.com/

Strengths and Weaknesses Can quickly detect any single-digit error and almost all transpositions of adjacent digits with the exception of 09 to 90 or vice versa Can also detect 7 of the 10 possible twin errors with the exception of the following pairs: 22 and 55 33 and 66 44 and 77 Can still perform under zero-padding systems

Other Uses of Luhn Algorithm IMEI numbers International Mobile Equipment Identity 15 digits National Provider Identifier numbers in the U.S. Issued to health care providers in the U.S. by the Centers of Medicare and Medicaid Services 10 digits Canadian Social Insurance Numbers Israel ID numbers Greek SSN

More Complex Algorithms Verhoeff algorithm Developed by Dutch mathematician Jacobus Verhoeff and published in 1969 First decimal check digit algorithm that detects all single-digit errors and all transposition errors involving two adjacent digits Uses the properties of the dihedral group of order 10 combined with a permutation Damm algorithm Presented by H. Michael Damm in 2004 Detects all single-digit errors and all adjacent transposition errors Similar to Verhoeff algorithm but simpler and more time-efficient

Damm Algorithm Prerequisite: Main diagonal entries of the table are 0 Steps: Set up an interim digit and initialize it to 0 Process the number digit by digit: Use the number's digit as column index and the interim digit as row index, take the table entry and replace the interim digit with it The resulting interim digit gives the check digit and will be appended as trailing digit to the number

Damm Algorithm First digit Find check number of 572 Initial interim digit Second interim digit Obtained from Damm’s paper

Damm Algorithm Second digit Find check number of 572 Third interim digit

Damm Algorithm Third digit Find check number of 572 Check Number

Damm Algorithm Last digit Check validity of 5724 Valid

Other Methods Against Fraud Card Verification Value (CVV) codes Calculated with the Primary Account Number (PAN) which is consisted of a 4-digit expiration date, a pair of DES keys and a 3-digit Service Code The calculation can only be done by the card issuer due to the use of secret DES keys

Other Forms of Check Digits Parity in RAM A byte is made up of 8 regular bits and a parity bit The value of the parity bit was set based on the count of set bits and selected so that the sum of the numbers was even (Even Parity)

Questions?

Reference https://null-byte.wonderhowto.com/how-to/credit-card-algorithms-work-anatomy-credit-card-numbers-0132295/ https://wallethub.com/edu/what-is-a-credit-card-number/44066/ http://datagenetics.com/blog/july42013/index.html https://www.makeuseof.com/tag/credit-card-numbers-random-read-understand/ https://en.wikipedia.org/wiki/Luhn_algorithm https://medium.com/@ma.juber/mathematics-behind-credit-debit-card-numbering-340bf68d27d2 https://www.makeuseof.com/tag/phones-imei-makeuseof-explains/ https://en.wikipedia.org/wiki/National_Provider_Identifier https://en.wikipedia.org/wiki/Verhoeff_algorithm https://www.creditcards.com/credit-card-news/luhn-formula-credit-card-number-system-1273.php https://www.getnewidentity.com/cvv-number.php https://en.wikipedia.org/wiki/Digital_root https://en.wikipedia.org/wiki/Damm_algorithm