1/11/2008

CVV Numbers

CVVs, CVV2s, CVCs, and Indent CVCs are 3-digit Card Verification Values or Card Verification Codes that are all calculated using the same CVV algorithm. These values are required by payment systems such as Visa and MasterCard to authenticate their credit or debit cards. Different names are used to refer to the values depending on the particular payment system, the location of the value on the card, and the parameters passed to the CVV algorithm.

To calculate a 3-digit CVV, the CVV algorithm requires a Primary Account Number (PAN), a 4-digit Expiration Date, a 3-digit Service Code, and a pair of DES keys (CVKs).

Besides the obvious CVV variations provided by different PANs and expiration dates, most card issuers will use different CVKs for different batches of cards. Cards can be grouped by bank, by ATM network, or by other means of identifying a certain group of cards. Cards in the same batch will often use the same service code. This service code to the CVV algorithmis usually non-zero. One CVV variant, now commonly called CVV2 (Visa), or Indent CVC (MasterCard), uses '000' as the service code parameter to the CVV algorithm. Sometimes a card will have both a traditional CVV and a CVV2.

Another variation to the CVV algorithm can be introduced by changing the format of the expiration date. While the date is always the concatenation of the 2-digit month (MM) andlast 2 digits of the year (YY), it can be in either YYMM or MMYY formats. For instance, Visa CVV2s are usually calculated using the YYMM format.

Credit Card Generator

Credit card generator

There was a mistake in the Javascript credit card generator, meaning it would not work on MS Internet Explorer or Opera. This has now been fixed, and I have tested it successfully on:

  • Firefox 1.0.6
  • Konqueror 3.4.1
  • Internet Explorer 6.0
  • Opera 8.5.2

The archive now also includes an example on how to use the Javascript version (which seems the most popular).

Command line Python program, PHP script, and Javascript script to generate valid (MOD 10) credit card numbers. Usefull for testing e-commerce sites. (Note: You can't actually buy anything with these). Should run on any platform.

This generates 13 and 16 digit VISA, Mastercard, Amex, and a whole bunch of others.

If you just need a bunch of numbers use the online credit card number generator. That page is generated by an online version of this script.

Fro the Python script, you will need Phyton . Once you have installed Python and extracted gencc.py from the archive, type 'python gencc.py' on the command line.

To use the PHP or Javascript scripts, you'll need to know a little bit about PHP or Javascript. In each case there is a method you need to call.

The ZIP and TAR.GZ below contain all three versions: The Python, PHP and Javascript files.


save with : namefile.py



"""
gencc: A simple program to generate credit card numbers that pass the MOD 10 check
(Luhn formula).
Usefull for testing e-commerce sites during development.

Copyright 2003 Graham King

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
"""

from random import Random
import sys
import copy

visaPrefixList = [ ['4', '5', '3', '9'],
['4', '5', '5', '6'],
['4', '9', '1', '6'],
['4', '5', '3', '2'],
['4', '9', '2', '9'],
['4', '0', '2', '4', '0', '0', '7', '1'],
['4', '4', '8', '6'],
['4', '7', '1', '6'],
['4'] ]

mastercardPrefixList = [ ['5', '1'],
['5', '2'],
['5', '3'],
['5', '4'],
['5', '5'] ]

amexPrefixList = [ ['3', '4'],
['3', '7'] ]

discoverPrefixList = [ ['6', '0', '1', '1'] ]

dinersPrefixList = [ ['3', '0', '0'],
['3', '0', '1'],
['3', '0', '2'],
['3', '0', '3'],
['3', '6'],
['3', '8'] ]

enRoutePrefixList = [ ['2', '0', '1', '4'],
['2', '1', '4', '9'] ]

jcbPrefixList16 = [ ['3', '0', '8', '8'],
['3', '0', '9', '6'],
['3', '1', '1', '2'],
['3', '1', '5', '8'],
['3', '3', '3', '7'],
['3', '5', '2', '8'] ]

jcbPrefixList15 = [ ['2', '1', '0', '0'],
['1', '8', '0', '0'] ]

voyagerPrefixList = [ ['8', '6', '9', '9'] ]


"""
'prefix' is the start of the CC number as a string, any number of digits.
'length' is the length of the CC number to generate. Typically 13 or 16
"""
def completed_number(prefix, length):

ccnumber = prefix

# generate digits

while len(ccnumber) < (length - 1): digit = generator.choice(['0', '1', '2', '3', '4', '5', '6', '7', '8', '9']) ccnumber.append(digit) # Calculate sum sum = 0 pos = 0 reversedCCnumber = [] reversedCCnumber.extend(ccnumber) reversedCCnumber.reverse() while pos < odd =" int("> 9:
odd -= 9

sum += odd

if pos != (length - 2):

sum += int( reversedCCnumber[pos+1] )

pos += 2

# Calculate check digit

checkdigit = ((sum / 10 + 1) * 10 - sum) % 10

ccnumber.append( str(checkdigit) )

return ''.join(ccnumber)

def credit_card_number(generator, prefixList, length, howMany):

result = []

for i in range(howMany):

ccnumber = copy.copy( generator.choice(prefixList) )

result.append( completed_number(ccnumber, length) )

return result

def output(title, numbers):

result = []
result.append(title)
result.append( '-' * len(title) )
result.append( '\n'.join(numbers) )
result.append( '' )

return '\n'.join(result)

#
# Main
#

generator = Random()
generator.seed() # Seed from current time

print "darkcoding credit card generator "
print

mastercard = credit_card_number(generator, mastercardPrefixList, 16, 10)
print output("Mastercard", mastercard)

visa16 = credit_card_number(generator, visaPrefixList, 16, 10)
print output("VISA 16 digit", visa16)

visa13 = credit_card_number(generator, visaPrefixList, 13, 5)
print output("VISA 13 digit", visa13)

amex = credit_card_number(generator, amexPrefixList, 15, 5)
print output("American Express", amex)

# Minor cards

discover = credit_card_number(generator, discoverPrefixList, 16, 3)
print output("Discover", discover)

diners = credit_card_number(generator, dinersPrefixList, 14, 3)
print output("Diners Club / Carte Blanche", diners)

enRoute = credit_card_number(generator, enRoutePrefixList, 15, 3)
print output("enRoute", enRoute)

jcb15 = credit_card_number(generator, jcbPrefixList15, 15, 3)
print output("JCB 15 digit", jcb15)

jcb16 = credit_card_number(generator, jcbPrefixList16, 16, 3)
print output("JCB 16 digit", jcb16)

voyager = credit_card_number(generator, voyagerPrefixList, 15, 3)
print output("Voyager", voyager)

save with: filename.php

9 ) {
$odd -= 9;
}

$sum += $odd;

if ( $pos != ($length - 2) ) {

$sum += $reversedCCnumber[ $pos +1 ];
}
$pos += 2;
}

# Calculate check digit

$checkdigit = (( floor($sum/10) + 1) * 10 - $sum) % 10;
$ccnumber .= $checkdigit;

return $ccnumber;
}

function credit_card_number($prefixList, $length, $howMany) {

for ($i = 0; $i < $howMany; $i++) { $ccnumber = $prefixList[ array_rand($prefixList) ]; $result[] = completed_number($ccnumber, $length); } return $result; } function output($title, $numbers) { $result[] = "
";
$result[] = "

$title

";
$result[] = implode('
', $numbers);
$result[]= '
';

return implode('
', $result);
}

#
# Main
#

echo "
";
$mastercard = credit_card_number($mastercardPrefixList, 16, 10);
echo output("Mastercard", $mastercard);

$visa16 = credit_card_number($visaPrefixList, 16, 10);
echo output("VISA 16 digit", $visa16);
echo "
";

echo "
";
$visa13 = credit_card_number($visaPrefixList, 13, 5);
echo output("VISA 13 digit", $visa13);

$amex = credit_card_number($amexPrefixList, 15, 5);
echo output("American Express", $amex);
echo "
";

# Minor cards

echo "
";
$discover = credit_card_number($discoverPrefixList, 16, 3);
echo output("Discover", $discover);

$diners = credit_card_number($dinersPrefixList, 14, 3);
echo output("Diners Club", $diners);
echo "
";

echo "
";
$enRoute = credit_card_number($enRoutePrefixList, 15, 3);
echo output("enRoute", $enRoute);

$jcb15 = credit_card_number($jcbPrefixList15, 15, 3);
echo output("JCB 15 digit", $jcb15);
echo "
";

echo "
";
$jcb16 = credit_card_number($jcbPrefixList16, 16, 3);
echo output("JCB 16 digit", $jcb16);

$voyager = credit_card_number($voyagerPrefixList, 15, 3);
echo output("Voyager", $voyager);
echo "
";
?>

save with : namefile.js


var visaPrefixList = new Array(
"4539",
"4556",
"4916",
"4532",
"4929",
"40240071",
"4485",
"4716",
"4"
);

var mastercardPrefixList = new Array(
"51",
"52",
"53",
"54",
"55"
);

var amexPrefixList = new Array(
"34",
"37"
);

var discoverPrefixList = new Array("6011");

var dinersPrefixList = new Array(
"300",
"301",
"302",
"303",
"36",
"38"
);

var enRoutePrefixList = new Array(
"2014",
"2149"
);

var jcbPrefixList16 = new Array(
"3088",
"3096",
"3112",
"3158",
"3337",
"3528"
);

var jcbPrefixList15 = new Array(
"2100",
"1800"
);

var voyagerPrefixList = new Array("8699");


function strrev(str) {
if (!str) return '';
var revstr='';
for (i = str.length-1; i>=0; i--)
revstr+=str.charAt(i)
return revstr;
}

/*
'prefix' is the start of the CC number as a string, any number of digits.
'length' is the length of the CC number to generate. Typically 13 or 16
*/
function completed_number(prefix, length) {

var ccnumber = prefix;

// generate digits

while ( ccnumber.length < (length - 1) ) { ccnumber += Math.floor(Math.random()*10); } // reverse number and convert to int var reversedCCnumberString = strrev( ccnumber ); var reversedCCnumber = new Array(); for ( var i=0; i < sum =" 0;" pos =" 0;" odd =" reversedCCnumber["> 9 ) {
odd -= 9;
}

sum += odd;

if ( pos != (length - 2)

1/10/2008

Anatomy of Credit Card Numbers

by Michael Gilleland


Introduction

This is not an essay on credit cards per se. If that's what you're looking for, I recommend Joe Ziegler's excellent series. This essay has a narrower focus -- to explore the anatomy of your credit card number, and to provide Java source code which determines if a given credit card number might be valid.

Specifications for credit card numbering have been drawn up by the International Standards Organization (ISO/IEC 7812-1:1993) and the American National Standards Institute (ANSI X4.13). These eminent organizations refuse to make their publications freely available on-line, and so the following information on the format of credit card numbers comes largely from an Internet Engineering Task Force (IETF) draft by Donald E. Eastlake 3rd, "ISO 7812/7816 Numbers and the Domain Name System (DNS)" (draft-eastlake-card-map-08, expires August 2001), available at the time of this writing at http://www.globecom.net/ietf/draft/draft-eastlake-card-map-08.html. I have not linked to this URL, because individual versions of IETF drafts are notoriously ephemeral.

Digit numbering in this essay is left to right. The "first" digit, therefore, means the leftmost digit.

Major Industry Identifier

The first digit of your credit card number is the Major Industry Identifier (MII), which represents the category of entity which issued your credit card. Different MII digits represent the following issuer categories:

MII Digit ValueIssuer Category
0ISO/TC 68 and other industry assignments
1Airlines
2Airlines and other industry assignments
3Travel and entertainment
4Banking and financial
5Banking and financial
6Merchandizing and banking
7Petroleum
8Telecommunications and other industry assignments
9National assignment

For example, American Express, Diner's Club, and Carte Blanche are in the travel and entertainment category, VISA, MasterCard, and Discover are in the banking and financial category, and SUN Oil and Exxon are in the petroleum category.

Issuer Identifier

The first 6 digits of your credit card number (including the initial MII digit) form the issuer identifier. This means that the total number of possible issuers is a million (10 raised to the sixth power, or 1,000,000).

Some of the better known issuer identifiers are listed in the following table:

IssuerIdentifierCard Number Length
Diner's Club/Carte Blanche 300xxx-305xxx,
36xxxx, 38xxxx
14
American Express 34xxxx, 37xxxx 15
VISA 4xxxxx 13, 16
MasterCard 51xxxx-55xxxx 16
Discover 6011xx 16

If the MII digit is 9, then the next three digits of the issuer identifier are the 3-digit country codes defined in ISO 3166, and the remaining final two digits of the issuer identifier can be defined by the national standards body of the specified country in whatever way it wishes.

Account Number

Digits 7 to (n - 1) of your credit card number are your individual account identifier. The maximum length of a credit card number is 19 digits. Since the initial 6 digits of a credit card number are the issuer identifier, and the final digit is the check digit, this means that the maximum length of the account number field is 19 - 7, or 12 digits. Each issuer therefore has a trillion (10 raised to the 12th power, or 1,000,000,000,000) possible account numbers.

If we consider the large number of potential customers and usurious interest rates charged by issuers, there is obviously a lot of money to be made in the credit card industry. In more civilized ages, people believed that usury was a grievous offense contrary to nature or a mortal sin, not an acceptable business practice (Aristotle, Politics 1.10; St. Thomas Aquinas, De Malo 13.4; Dante, Inferno 11.94-111; etc.).

Check Digit

The final digit of your credit card number is a check digit, akin to a checksum. The algorithm used to arrive at the proper check digit is called the Luhn algorithm, after IBM scientist Hans Peter Luhn (1896-1964), who was awarded US Patent 2950048 ("Computer for Verifying Numbers") for the technique in 1960. For details about Luhn's life, see

  • Biography on the American Society for Information Science and Technology's Web site
  • Notes compiled by Susan K. Soy on "H.P. Luhn and Automatic Indexing"

Thanks to Aleksandar Janicijevic for directing me to information about H.P. Luhn.

The most succint description of the Luhn algorithm I have found comes from the hacker publication Phrack 47-8 : "For a card with an even number of digits, double every odd numbered digit and subtract 9 if the product is greater than 9. Add up all the even digits as well as the doubled-odd digits, and the result must be a multiple of 10 or it's not a valid card. If the card has an odd number of digits, perform the same addition doubling the even numbered digits instead."

The bit about even and odd is a little confusing. The main point is that you don't want to double the check digit, and this can easily be done by starting with the check digit, going backwards, and doubling every other digit. See the source code below for details.

Examples

These examples are drawn from junk mail I received from credit card issuers in August 2001. Some of this junk mail contained glossy pictures of credit cards, and the sample numbers come directly from two of these pictures.

4408 0412 3456 7890

The first credit card offer showed a picture of a card with the number 4408 0412 3456 7890.

The Major Industry Identifier (MII) is 4 (banking and financial), the issuer identifier is 440804 (a VISA partner), the account number is 123456789, and the check digit is 0.

Let's apply the Luhn check to 4408 0412 3456 7890. In the following table,

  • The top row is the original number.
  • In the second row, we multiply alternate digits by 2. Don't multiply the check digit by 2.
  • In the third row, we force all digits to be less than 10, by subtracting 9 where necessary.
  • The bottom row contains the digits to be added together.
4 4 0 8 0 4 1 2 3 4 5 6 7 8 9 0
4 x 2 = 8 4 0 x 2 = 0 8 0 x 2 = 0 4 1 x 2 = 2 2 3 x 2 = 6 4 5 x 2 = 10 6 7 x 2 = 14 8 9 x 2 = 18 0
8 4 0 8 0 4 2 2 6 4 10 - 9 = 1 6 14 - 9 = 5 8 18 - 9 = 9 0
8 4 0 8 0 4 2 2 6 4 1 6 5 8 9 0

If we add all of the digits in the bottom row together, we get 67, which is not a multiple of 10, and therefore we conclude that the number 4408 0412 3456 7890 is an invalid credit card number.

By changing the check digit from 0 to 3, we arrive at the number 4408 0412 3456 7893, which does pass the Luhn check, since the sum of the digits in the bottom row would be 70, which is divisible by 10. 4408 0412 3456 7893 is, on the face of it, a valid credit card number.

4417 1234 5678 9112

The second credit card offer showed a picture of a card with the number 4417 1234 5678 9112.

The Major Industry Identifier (MII) is 4 (banking and financial), the issuer identifier is 441712 (a VISA partner), the account number is 345678911, and the check digit is 2.

Let's apply the Luhn check to 4417 1234 5678 9112, as we did in the previous example.

4 4 1 7 1 2 3 4 5 6 7 8 9 1 1 2
4 x 2 = 8 4 1 x 2 = 2 7 1 x 2 = 2 2 3 x 2 = 6 4 5 x 2 = 10 6 7 x 2 = 14 8 9 x 2 = 18 1 1 x 2 = 2 2
8 4 2 7 2 2 6 4 10 - 9 = 1 6 14 - 9 = 5 8 18 - 9 = 9 1 2 2
8 4 2 7 2 2 6 4 1 6 5 8 9 1 2 2

If we add all of the digits in the bottom row together, we get 69, which is not a multiple of 10, and therefore we conclude that the number 4417 1234 5678 9112 is an invalid credit card number.

By changing the check digit from 2 to 3, we arrive at the number 4417 1234 5678 9113, which does pass the Luhn check, since the sum of the digits in the bottom row would be 70, which is divisible by 10. 4417 1234 5678 9113 is, on the face of it, a valid credit card number.

CCV number

CVVs, CVV2s, CVCs, and Indent CVCs are 3-digit Card Verification Values or Card Verification Codes that are all calculated using the same CVV algorithm. These values are required by payment systems such as Visa and MasterCard to authenticate their credit or debit cards. Different names are used to refer to the values depending on the particular payment system, the location of the value on the card, and the parameters passed to the CVV algorithm.

To calculate a 3-digit CVV, the CVV algorithm requires a Primary Account Number (PAN), a 4-digit Expiration Date, a 3-digit Service Code, and a pair of DES keys (CVKs).

Besides the obvious CVV variations provided by different PANs and expiration dates, most card issuers will use different CVKs for different batches of cards. Cards can be grouped by bank, by ATM network, or by other means of identifying a certain group of cards. Cards in the same batch will often use the same service code. This service code to the CVV algorithmis usually non-zero. One CVV variant, now commonly called CVV2 (Visa), or Indent CVC (MasterCard), uses '000' as the service code parameter to the CVV algorithm. Sometimes a card will have both a traditional CVV and a CVV2.

Another variation to the CVV algorithm can be introduced by changing the format of the expiration date. While the date is always the concatenation of the 2-digit month (MM) andlast 2 digits of the year (YY), it can be in either YYMM or MMYY formats. For instance, Visa CVV2s are usually calculated using the YYMM format.

MOD 10 algorithm

A credit card number must be from 13 to 16 digits long. The last digit of the number is the check digit. That number is calculated from an algorithm (called the Lunh formula or MOD 10) on the other numbers. This is to spot typos when a user enters a number, and I assume was to allow detecting an error reading the magnetic stripe when a card is swiped.

The MOD 10 check does not offer security, it offers error detection. Think of it as fullfilling the same role as a CRC in software.

To calculate the check digit:

  1. First drop the last digit from the card number (because that’s what we are trying to calculate)
  2. Reverse the number
  3. Multiply all the digits in odd positions (The first digit, the third digit, etc) by 2.
  4. If any one is greater than 9 subtract 9 from it.
  5. Sum those numbers up
  6. Add the even numbered digits (the second, fourth, etc) to the number you got in the previous step
  7. The check digit is the amount you need to add to that number to make a multiple of 10. So if you got 68 in the previous step the check digit would be 2. You can calculate the digit in code using checkdigit = ((sum / 10 + 1) * 10 – sum) % 10

For an example of this in practice download the code to the Credit Card number Generator.

Credit card numbers are a special type of ISO 7812 numbers.

Credit card numbers

Credit card numbers that conform to the Luhn formula (MOD 10 check). Usefull for testing e-commerce sites (because they should get past any pre-validation you do, and be declined at the card processor or bank stage).

In testing situations any expiry date within the next 3 years should work

Feedback forces me to clarify this: These are NOT valid credit card numbers. You can't buy anything with these. They are random numbers that happen to conform to the MOD 10 algorithm. They are a technical resource for programmers - that's all.
Information about CVV2 / CVC / etc numbers can be found here: .CVV number As you can see these would be very hard to calculate without the bank's keys.

A very good article about the credit card number format can be found here:Anatomy of Credit Card numbers

Mastercard

5332392027153724
5597534859525434
5581696079442175
551137392788 5675
5444039560389646
5594872729566995
5140436149936458
5211069886171742
51 76680042431706
5568156028735259

VISA 16 digit

4916191615033000
4929636339112741
4556282208458780
4716126518645023
4 916960706685575
4539938560835913
4381447293003392
4556073575712077
4532031 579873880
4011242019510822

VISA 13 digit

4485313175910
4870979235472
4539993135980
4556083348018
4716096706640

American Express

379784892236037
373692334330035
377477151054280
343298568891234
373 991738454551

Discover

6011977010095670
6011696948338404
6011256701709513

Di ners Club

30051008844703
38169416127834
38894748442649

enRoute

214920914175451
20 1473811670625
214902539922228

JCB 15 digit

210036312777402
180012429609628
180025247460198

JCB 16 digit

3337196719138830
3158588735196386
3528754946234613

Voyager

8699344232 58342
869973348225986
869983716187122

As you can see below I get a lot of feedback about this page. Thanks to everyone who stops by to write a note, it is appreciated. Before you ask no I haven't got anyone's credit card details.