Hacker News Reader

Comment by viraptor | Hacker News Reader

> 12,700 non-US credit or debit card numbers and expiration dates [...] apparently from "an outdated database from 2007"

Fortunately that means ~100% of those numbers are expired by now. Can expired numbers be used for anything evil?

View on HN

Credit cards expire, but frequently the number remains the same. It's quite possible to just add four years to the expiration date and have a valid card. You still wouldn't have CCV, of course.

I was recently looking up some guidelines on storing credit card information, and according to section 3.2 of the official PCI guidelines (https://www.pcisecuritystandards.org/documents/PCI%20SSC%20Q...), CCV is not allowed to be stored, along with PIN or Full Magnetic Stripe data. Hopefully, Sony didn't do that or they will also face hefty fines in addition to bad PR and lawsuits.

Disposaboy posted a mistakenly [dead] comment one hour before this:

> I don't personally know whether this is valid or not but there are comments on http://news.ycombinator.com/item?id=2502477 [URL repeated, may have triggered spam filter?] that suggest that in at least some cases it's possible to charge a credit card without the CVV.

Lows and rules don't apply to mega-corps like Sony, Amazon, Ebay/PayPal, Google, Apple, etc. They all have no problem storing all this together with address, SSN and everything else.

You can't make allegations like that with zero supporting evidence. I mean you can... but you'll look silly.

I suddenly begin thinking that there's a reason that my credit cards are worn down and have to be replaced once in a while.

Thanks for that info. So far I got a new number every time - but I'll have to pay attention in the future. Never knew it's allowed to recycle the number.

This may be most common with debit cards— as we've noticed before that debit card numbers frequently include your account number (http://news.ycombinator.com/item?id=1939699)

Often the numbers don't change on expired cards if the account is still active, and only the CCV and expire date are updated. Some purchases don't require CCV to be entered, and the new expiration date can be guessed (probably an interval of 2 years or whatever for different cards). I know this from experience when I had the expired card in my wallet, and had forgotten to switch out for the new one when making an online purchase.

Edit: cushman beat me to it

When I was testing someone else's payment system, I entered my card information with the incorrect expiration date. To my surprise, it happily accepted and I was charged. Not sure how common this is though.

It's up to your bank to decide whether expiration matters, and they can vary their opinion by payment channel - expired card is more likely to be ok for paying a bill than it is for ordering from a web store. The merchant has no reliable way to learn whether the card expiration is wrong - the protocol has a card expired message but in practice banks use it for other errors too, and accept charges that should have expiration errors.

I had an expired card tied to a monthly service plan -- it continued to function for the automatic charges until 1 full year after the expiration date.

Since some companies issue cards that are good for 4 years, I'd say many of those people have good reasons to worry.

Reply on news.ycombinator.com