Hacker News Reader

Comment by dakrisht | Hacker News Reader

I like this randomized credit card numbers idea but I don't understand how it would work?

How would the terminal know it's debiting your account?

Where would the authentication take place?

Where would the randomization take place? And what would this be based on?

Credit cards are actually very simple in nature (and why there are billions of dollars of fraud occurring every year). It's simply an account number printed on a piece of plastic. But this account numbers is solely responsible for the transaction behind the scenes.

Who does this random number now? I've been studying payments for years and have never heard of this.

View on HN

Presumably the idea is that the account number (i.e. credit card number) is randomised for each transaction - but still valid. So authentication etc. would happen exactly as it does right now. But that number would become invalid immediately after it is debited. That way even if someone intercepted the number they would not be able to use it in the future.

Obviously this only really works for online transactions that don't require a physical card - and even then introduces a ton of complexity to things like refunds. But the idea is interesting.

I understand what randomizing a number means.

But this doesn't answer the question of how the terminal/processing system knows it's your account being debited?

The whole concept of randomization with payments (or anything for that matter with respect to authentication) is impossible. There will ALWAYS have to be some sort of static identifier in order for this to work. Common sense I think.

The idea is interesting but I'm not sure exactly what the idea is!! :)

If you have an AMEX and you randomize the account number on each transaction, AMEX still has to IDENTIFY your account with something? A name? A PIN? A unique ID? AKA an account number.

But this doesn't answer the question of how the terminal/processing system knows it's your account being debited?

It doesn't. It debits an account that is signified by the randomly generated account number. The connection between that number and your actual account would be done by AMEX/in the backend somewhere. In fact, the whole point of such a system would be that the terminal would be blind to it.

There would always be a static identifier, but the key is taking that identifier away from the end user. That's where the card details get duplicated.

If you're an issuing bank, then it's technically not that hard for online purchases - have a button on your netbank that will generate a new creditcard number (virtual card), show it to user and add it to your auth system - and block the number after it's used.

But IIRC the rules allow such virtual cards to be used only in online transactions, not for normal 'card present' sales.

Reply on news.ycombinator.com