There are at least three types of security devices on credit cards that you aren’t supposed to know about. They are the account number, the signature panel, and the magnetic strip.
A Social Security card has nine digits. So do two-part Zip codes. A domestic phone number, including area code, has ten digits. Yet a complete MasterCard number has twenty digits. Why so many?
It is not mathematically necessary for any credit-card account number to have more than eight digits. Each cardholder must, of course, have a unique number. Visa and MasterCard are estimated to have about sixty-five million cardholders each. Thus their numbering systems must have at least sixty-five million available numbers.
There are one hundred million possible combinations of eight digits—00000000, 00000001, 00000002, 00000003, all the way up to 99999999. So eight digits would be enough. To allow for future growth, an issuer the size of Visa or MasterCard could opt for nine digits—enough for a billion different numbers.
In fact, a Visa card has thirteen digits and sometimes more. An American Express card has fifteen digits. Diners Club cards have fourteen. Carte Blanche has ten. Obviously, the card issuers are not projecting that they will have billions and billions of cardholders and need those digits to ensure a different number for each. The extra digits are actually a security device.
Say your Visa number is 4211 503 417 268. Each purchase must be entered into a computer from a sales slip. The account number tags the purchase to your account. The persons who enter account numbers into computers get bored and sometimes make mistakes. They might enter 4211 503 471 268 or 4211 703 417 268 instead.
The advantage of the thirteen-digit numbering system is that it is unlikely any Visa cardholder has 4211 503 471 268 or 4211 703 417 268 for an account number. There are 10 trillion possible thirteen-digit Visa numbers (0000 000 000 000; 0000 000 000 001; … 9999 999 999 999). Only about sixty-five million of those numbers are numbers of actual, active accounts. The odds that an incorrectly entered number would correspond to a real number are something like sixty-five million in ten trillion, or about one in one hundred fifty thousand.
Those are slim odds. You could fill up a book the size of this one with random thirteen-digit numbers such as these:
| 3901 | 160 | 943 | 791 |
| 1090 | 734 | 231 | 410 |
| 1783 | 205 | 995 | 561 |
| 9542 | 425 | 195 | 969 |
| 2358 | 862 | 307 | 845 |
| 9940 | 880 | 814 | 778 |
| 8421 | 456 | 150 | 662 |
| 9910 | 441 | 036 | 483 |
| 3167 | 186 | 869 | 267 |
| 6081 | 132 | 670 | 781 |
| 1228 | 190 | 300 | 350 |
| 4563 | 351 | 105 | 207 |
Still you would not duplicate a Visa account number. Whenever an account number is entered incorrectly, it will almost certainly fail to match up with any of the other account numbers in the computer’s memory. The computer can then request that the number be entered again.
Other card-numbering systems are even more secure. Of the quadrillion possible fifteen-digit American Express card numbers, only about 11 million are assigned. The chance of a random number happening to correspond to an existing account number is about one in ninety million. Taking into account all twenty digits on a MasterCard, there are one hundred quintillion (100,000,000,000,000,000,000) possible numbers for sixty-five million cardholders. The chance of a random string of digits matching a real MasterCard number is about one in one and a half trillion.
Among other things, this makes possible those television ads inviting holders of credit cards to phone in to order merchandise. The operators who take the calls never see the callers’ cards nor their signatures. How can they be sure the callers even have credit cards?
They base their confidence on the security of the credit-card numbering systems. If someone calls in and makes up a credit-card number—even being careful to get the right number of digits—the number surely will not be an existing real credit-card number. The deception can be spotted instantly by plugging into the credit-card company’s computers. For all practical purposes, the only way to come up with a genuine credit-card number is to read it off a credit card. The number, not the piece of plastic, is enough.
Neiman-Marcus* Garbage Can
The converse of this is the fact that anyone who knows someone else’s card number can charge to that person’s account. Police sources say this is a major problem, but card issuers, by and large, do their best to keep these crimes a secret. The fear is that publicizing the crimes may tempt more people to commit them. Worse yet, there is almost nothing the average person can do to prevent being victimized—short of giving up credit cards entirely.
Lots of strangers know your credit-card numbers. Everyone you hand a card to—waiters, sales clerks, ticket agents, hairdressers, gas station attendants, hotel cashiers—sees the account number. Every time a card is put in an imprinter, three copies are made, and two are left with the clerk. If you charge anything by phone or mail order, someone somewhere sees the number.
Crooks don’t have to be in a job with normal access to credit-card numbers. Occasional operations have discovered that the garbage cans outside prestige department or specialty stores are sources of high-credit-limit account numbers. The crooks look for the discarded carbon paper from sales slips. The account number is usually legible—as are the expiration date, name, and signature. (A 1981 operation used carbons from Koontz Hardware, a West Hollywood, California, store frequented by many celebrities.)
Converting a number into cash is less risky than using a stolen credit card. The crook need only call an airline, posing as the cardholder, and make a reservation on a heavily traveled flight. He usually requests that tickets be issued in someone else’s name for pickup at the airport. The someone else is an accomplice or an identity for which he has bogus ID. Crook or accomplice picks up the tickets at the airport (airlines don’t always ask for ID on ticket pickups, but the crook has it if needed) and is set. The tickets can be sold at a discount on the hot-ticket market operating in every major airport.
There are other methods as well. Anyone with a Visa or MasterCard merchant account can fill out invoices for nonexistent sales and submit them to the bank. As long as the account numbers and names are genuine, the bank will pay the merchant immediately.
For an investment of about a thousand dollars, an organized criminal operation can get the pressing machines needed to make counterfeit credit cards. Counterfeiting credit cards is relatively simple. There are no fancy scrolls and filigree work, just blocky logos in primary colors. From the criminal’s standpoint, the main advantage of a counterfeit card is that it allows him to get cash advances. For maximum plundering of a line of credit, the crook must know the credit limit as well as the account number. To learn both, he often calls an intended victim, posing as the victim’s bank:
crook: This is Bank of America. We’re calling to tell you that the credit limit on your Visa card has been raised to twelve hundred dollars.
victim: But my limit has always been ten thousand dollars. crook: There must be some problem with the computers. Do you have your card handy? Could you read off the embossed number?
On a smaller scale, many struggling rock groups have discovered the knack of using someone else’s telephone company credit card. When a cardholder wants to make a long-distance call from a hotel or pay phone, he or she reads the card number to the operator. The call is then billed to the cardholder’s home phone. Musicians on tour sometimes wait by the special credit-card-and-collect-calls-only booths at airports and jot down a few credit-card numbers. In this way unsuspecting businesspeople finance a touring act’s calls to friends at home. If the musicians call from public phones, use a given card number only once, and don’t stay in one city long, the phone company seems helpless to stop them.
What makes all of these scams so hard to combat is the lead time afforded the criminal. Theft of a credit card—a crime that card issuers will talk about—is generally reported immediately. Within twenty-four hours, a stolen card’s number is on the issuer’s “hot list” and can no longer be used. But when only a card number is being used illicitly, the crime is not discovered until the cardholder receives his first inflated bill. That’s at least two weeks later; it could be as much as six weeks later. As long as the illicit user isn’t too greedy, he has at least two weeks to tap into a credit line with little risk.
You’re not supposed to erase the signature panel, of course. Card issuers fear that crooks might erase the signature on a stolen credit card and replace it with their own. To make alteration more difficult, many card signature panels have a background design that rubs off if anyone tries to erase. There’s the “fingerprint” design on the American Express panel, repeated Visa or MasterCard logos on some bank cards, and the “Safesig” design on others. The principle is the same as with the security paper used for checks. If you try to erase a check on security paper, the wavy-line pattern erases, leaving a white area—and it is obvious that the check has been altered.
Rumors hint of a more elaborate gimmick in credit-card panels. It is said that if you erase the panel, a secret word—VOID—appears to prevent use of the card. To test this rumor, fifteen common credit cards were sacrificed.
An ordinary pen eraser will erase credit-card signature panels, if slowly. The panels are more easily removed with a cloth and a dry-cleaning fluid such as Energine. This method dissolves the panels cleanly. Of the fifteen cards tested, six had nothing under the panel (other than a continuation of the card back design, where there was one). Nine cards had the word “VOID” under the panel. In all cases, the VOIDs were printed small and repeated many times under the panel. The breakdown:
When held to a strong light, the VOIDs were visible through the Bloomingdale’s card even without removing the panel.
The VOID device isn’t foolproof. Any criminal who learns the secret will simply refrain from trying to erase the signature. Most salesclerks don’t bother to check signatures anyway.
Moreover, it is possible to paint the signature panel back in, over the VOIDs—at least on those cards that do not have a design on the panel. (Saks’ panel is a greenishtan khaki color that would be difficult to match with paint.) The panel is first removed with dry-cleaning fluid. The back of the card is covered with masking tape, leaving a window where the replacement panel is to go. A thin coat of flat white spray paint simulates the original panel.
The other security device on the back of the card, the brown magnetic strip, is more difficult to analyze. Some people think there are sundry personal details about the cardholder stored in the strip. But the strip has no more information capacity than a similar snippet of recording tape. For their part, banks are reticent about the strip.
The strip need not contain any information other than the account number or similar indentification. Any further information needed to complete an automatic-teller transaction—such as current account balances—can be called up from bank computers and need not be encoded in the strip.
Evidently, the card expiration date is in the strip. Expired cards are “eaten” by automatic-teller machines even when the expired card has the same account number and name as its valid replacement card. Credit limit, address, phone number, employer, etc.,must not be indicated in the strip, for banks do not issue new cards just because this information changes.
It is not clear if the personal identification number is in the strip or called up from the bank computer. Many automatic-teller machines have a secret limit of three attempts for providing the correct personal identification number. After three wrong attempts, the “customer” is assumed to be a crook with a stolen card, going through all the possible permutations—and the card is eaten.
It is possible to scramble the information in the strip by rubbing a pocket magnet over it. Workers in hospitals or research facilities with large electromagnets sometimes find that their cards no longer work in automatic-teller machines. (If you try to use a magnetically doctored card, you usually get a message to the effect, “Your card may be inserted incorrectly. Please remove and insert according to diagram.”)
Only in a few cases does the color of a credit card mean anything. There are, of course, the American Express, Visa, and MasterCard gold cards for preferred customers. The Air Travel Card comes in red and green, of which green is better. (With red, you can charge tickets for travel within North America only.) The most elaborate color scheme, and a source of some confusion to status-conscious queues, is that of Bloomingdale’s credit cards. The five colors of Bloomingdale’s cards do not signify credit limits per se, but they do tip off the sales staff as to what type of customer you are. According to Bloomingdale’s credit department, here is how it works: Low color in the pecking order is blue, issued to Bloomingdale’s employees as a perk in their compensation packages. The basic Bloomie’s card is yellow. Like most department store cards, it can be used to spread payments over several months with the payment of a finance charge. The red card gives holders three months’ free interest and is issued to customers who regularly make large purchases. The silver card is good for unlimited spending, but as with a travel and entertainment card, all charges must be paid in thirty days. The gold card offers the same payment options as the yellow card but is reserved for the store’s biggest spenders.