# Can a crook get your entire credit card # by just knowing the last 3-4 digits? **URL:** \ **Category:** Factual Questions\ **Created:** [October 1, 2008, 11:32pm UTC](https://boards.straightdope.com/t/can-a-crook-get-your-entire-credit-card-by-just-knowing-the-last-3-4-digits/466094 "2008-10-01T23:32:43Z")\ **Posts on this page:** 11\ **Page:** 2
**Author:** ![Jane\_D\_oh](https://avatars.discourse-cdn.com/v4/letter/j/839c29/32.png) [@Jane\_D\_oh](https://boards.straightdope.com/u/Jane_D_oh)\ **Post date:** [October 3, 2008, 8:32pm UTC](https://boards.straightdope.com/t/can-a-crook-get-your-entire-credit-card-by-just-knowing-the-last-3-4-digits/466094/21 "2008-10-03T20:32:21Z")
> [@jharvey963](#): > > I once heard someone say that with the “authorization number” on the credit card slip and the last 4 digits of your card, you could “look up” the transaction or credit card number. > > Does anyone know if this is true? > > J. > > p.s., to slaphead: All visa cards do not start with 45 or 49. Mine starts with 44. You might be able to use some social engineering to get the full number if you have an authorization code, but it would take some work. ---
**Author:** ![Really\_Not\_All\_That\_Bright](https://avatars.discourse-cdn.com/v4/letter/r/e8c25b/32.png) [@Really\_Not\_All\_That\_Bright](https://boards.straightdope.com/u/Really_Not_All_That_Bright)\ **Post date:** [October 3, 2008, 9:07pm UTC](https://boards.straightdope.com/t/can-a-crook-get-your-entire-credit-card-by-just-knowing-the-last-3-4-digits/466094/22 "2008-10-03T21:07:57Z")
> [@slaphead](#): > > The first two identify the network (37 for Amex, 45 and 49 for Visa, 54 and probably at least one more for MC, and so on) My BofA Visa starts with 43XX-. ---
**Author:** ![KneadToKnow](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kneadtoknow/32/3999_2.png) [@KneadToKnow](https://boards.straightdope.com/u/KneadToKnow)\ **Post date:** [October 3, 2008, 9:16pm UTC](https://boards.straightdope.com/t/can-a-crook-get-your-entire-credit-card-by-just-knowing-the-last-3-4-digits/466094/23 "2008-10-03T21:16:36Z")
> [@ftg](#): > > Never underestimate the stupidity of organizations. Take our local library system. They used to print a patron’s whole ID number of the slips put in the books for the on-hold shelves. (A _lot_ of people do this at our branch. Mrs. FtG in particular.) So it made it trivial to walk by the on-hold shelves and pick up hundreds of valid patron IDs. (Which can be used to check out books with no intention of returning them or use the library computers and Do Bad Things on them.) > > So they went to the last several digits on the slip. But the prefix is standardized, there’s a check digit, etc. So all one needs to guess is a single digit. And you can sit at a library computer and run thru those and have the system tell you when you hit a correct one. > > As with several other security issues I have uncovered at the library, the staff is completely uninterested in helping me find someone that would actually care who I could report this to. Our library system requires a PIN number to self-checkout or log on to use a computer. Of course, our self-serve hold slips only show the last four digits of a library card number which has 8 significant digits for most people. As to who you should report the security holes in your system’s … system to, start at the Director’s Office. ---
**Author:** ![DesertDog](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/desertdog/32/11503_2.png) [@DesertDog](https://boards.straightdope.com/u/DesertDog)\ **Post date:** [October 4, 2008, 2:03am UTC](https://boards.straightdope.com/t/can-a-crook-get-your-entire-credit-card-by-just-knowing-the-last-3-4-digits/466094/24 "2008-10-04T02:03:38Z")
> [@Telemark](#): > > [http://insiderguidetocreditrepair.com/blog/2007/11/how-to-decode-your-credit-card-number/](http://insiderguidetocreditrepair.com/blog/2007/11/how-to-decode-your-credit-card-number/) > > Here’s what your CC numbers mean. You can’t figure out the rest of the digits from the last 4. Nifty site, but there is one inaccuracy – or rather, an update needed. Visa no longer has 13 digit account numbers; all are 16. About eighteen months ago all of our terminals’ software was updated to accept only 16 digit Visa card numbers. This was not considered vital enough to call out and make sure everyone got updated, but if someone calls in, and we notice that they have the old version in their terminal, we are to encourage them to update. Master Card and Discover are 16 digits, AmEx is 15. The check digit uses the Luhn algorithm. [Here](http://en.wikipedia.org/wiki/Luhn_algorithm) is Wiki on the subject. It’s quick and easy to calculate, and will catch any single-digit error, and all two-digit transpositions but 09/90. > [@jharvey963](#): > > I once heard someone say that with the “authorization number” on the credit card slip and the last 4 digits of your card, you could “look up” the transaction or credit card number. > > Does anyone know if this is true? I don’t see how. The authorization number is six digits (sometimes a letter or two will get into the mix). With the hundreds of millions of transactions every day, those authorization numbers are going to be repeated many times a day at the same bank, never mind at more than one bank. As people have pointed out, if it was a worry, the authorization number would not be printed on the same receipt as the truncated credit card number. That would be as dumb as writing your PIN on the back of your debit card. ---
**Author:** ![amarone](https://avatars.discourse-cdn.com/v4/letter/a/e0b2c6/32.png) [@amarone](https://boards.straightdope.com/u/amarone)\ **Post date:** [October 4, 2008, 2:26am UTC](https://boards.straightdope.com/t/can-a-crook-get-your-entire-credit-card-by-just-knowing-the-last-3-4-digits/466094/25 "2008-10-04T02:26:14Z")
> [@Jane\_D\_oh](#): > > You might be able to use some social engineering to get the full number if you have an authorization code, but it would take some work. Nope - the authorization number has no relationship to the credit card number. ---
**Author:** ![slaphead](https://avatars.discourse-cdn.com/v4/letter/s/e9bcb4/32.png) [@slaphead](https://boards.straightdope.com/u/slaphead)\ **Post date:** [October 6, 2008, 12:46pm UTC](https://boards.straightdope.com/t/can-a-crook-get-your-entire-credit-card-by-just-knowing-the-last-3-4-digits/466094/26 "2008-10-06T12:46:09Z")
> [@jharvey963](#): > > p.s., to slaphead: All visa cards do not start with 45 or 49. Mine starts with 44. Doh! That’ll teach me to oversimplify - they’ve obviously expanded usage over the last few years, and I had a brain-fart about the debit ranges. At any rate, if you know the acquirer brand and the issuing institution you can have a good go at figuring out the prefix of the cardnumber, and the more digits you can pin down, the easier it is to guess the whole cardnumber. But at the end of the day, the risk of someone going to all this trouble is essentially irrelevant - phishing, skimming, videoing ATMs/POS terminals, dumpster diving and hacking are generally the way people get cardnumbers. Why spend hours cracking one card number when you can get thousands for less effort, and often the PINs/addresses to boot? ---
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [October 6, 2008, 3:30pm UTC](https://boards.straightdope.com/t/can-a-crook-get-your-entire-credit-card-by-just-knowing-the-last-3-4-digits/466094/27 "2008-10-06T15:30:16Z")
Anyone who worries about the last four digits is high-hanging fruit that doesn’t know how much really low-hanging fruit there is in the world. ---
**Author:** ![slaphead](https://avatars.discourse-cdn.com/v4/letter/s/e9bcb4/32.png) [@slaphead](https://boards.straightdope.com/u/slaphead)\ **Post date:** [October 6, 2008, 8:18pm UTC](https://boards.straightdope.com/t/can-a-crook-get-your-entire-credit-card-by-just-knowing-the-last-3-4-digits/466094/28 "2008-10-06T20:18:51Z")
> [@Derleth](#): > > Anyone who worries about the last four digits is high-hanging fruit that doesn’t know how much really low-hanging fruit there is in the world. So the OPs friend is a high-altitude fruit?😃 ---
**Author:** ![ming\_the\_merciless](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@ming\_the\_merciless](https://boards.straightdope.com/u/ming_the_merciless)\ **Post date:** [October 6, 2008, 8:54pm UTC](https://boards.straightdope.com/t/can-a-crook-get-your-entire-credit-card-by-just-knowing-the-last-3-4-digits/466094/29 "2008-10-06T20:54:00Z")
I cannot throw much light on the op but as a recent victim of credit card fraud I would like to add a couple of things, I’m one of those people who uses their card infrequently and always pay the balance at the end of the month so I tend not to keep a close eye on what’s happening with the card. To cut a long story short I was defrauded for quite a bit of cash, panic ensued it all got sorted but here’s the thing the fraudsters had been in touch with my bank pretending to be me and changed my address to another city. When I asked the fraud investigator how they had managed this as surely they would have to answer some security questions this is what he said , if your card has had its details stolen then they know your name and address from that they can look at the electoral register and find out your age etc. the most common security question is ….what is your mothers maiden name. given that they have your name address and age its then quite easy to pay a small fee to get a replacement birth certificate and then they have your mothers maiden name. The advice I was given was to have the security question as what is your mothers maiden name but then to use something completely different a favourite pets name or so, that way they will never be able to alter your details to commit fraud. ---
**Author:** ![fritzzz25](https://avatars.discourse-cdn.com/v4/letter/f/a587f6/32.png) [@fritzzz25](https://boards.straightdope.com/u/fritzzz25)\ **Post date:** [October 7, 2008, 3:35am UTC](https://boards.straightdope.com/t/can-a-crook-get-your-entire-credit-card-by-just-knowing-the-last-3-4-digits/466094/30 "2008-10-07T03:35:30Z")
As a law enforcement member, and a person trained in credit card fraud detection, there are a number of ways people can get your numbers. The biggest way is dumpster divers retrieving discarded receipts. Make sure that when you sign your receipt, that you totally scratch out the credit card number on it. Don’t worry, the merchant already has it in their electronic log, and they have been paid. Destroy any part of the number, expiry date, and your name. This is some of the easiest way to prevent being a victim of fraud. See below for more info. [http://en.wikipedia.org/wiki/List\_of\_Bank\_Identification\_Numbers](http://en.wikipedia.org/wiki/List_of_Bank_Identification_Numbers) The above shows the first digits of the credit card numbers, and what bank they belong to. There are credit card number generators, as well as CVV generators available (do a search). It basically would come down to nailing the expiry date then. It isn’t very hard. Now you know why the interest rates are so high, so that they can “make up” for the losses they write off to fraud. ---
**Author:** ![amarone](https://avatars.discourse-cdn.com/v4/letter/a/e0b2c6/32.png) [@amarone](https://boards.straightdope.com/u/amarone)\ **Post date:** [October 7, 2008, 11:24am UTC](https://boards.straightdope.com/t/can-a-crook-get-your-entire-credit-card-by-just-knowing-the-last-3-4-digits/466094/31 "2008-10-07T11:24:24Z")
> [@fritzzz25](#): > > Make sure that when you sign your receipt, that you totally scratch out the credit card number on it. Which shouldn’t be on there in the first place or it is a violation of the [PCI Data Security Standard.](https://www.pcisecuritystandards.org/) [Previous page](https://boards.straightdope.com/t/can-a-crook-get-your-entire-credit-card-by-just-knowing-the-last-3-4-digits/466094.md?page=1)