How to detect credit card types by the number

[Rob Holmes]

Hi,

I'm just implementing a new credit card processing script on my website and the company that handles my transactions (Protx) ask for the card type (Visa credit, Visa debit, mastercard etc) - I'm not entirely sure why they do that because if I tell them the wrong card type to be associated with the number they tell me it's wrong and give me the right card type.

However - I've been looking around for a list of the UK credit and debit cards 'starting numbers' so I can use a script to detect the card type rather than ask the customer (1 less field for them to get wrong).

Has anyone had any experience with this (success or failure)?

Also if anyone has a list of card types with their starting numbers (I have seen some online but they are not UK specific e.g. visa debit, maestro etc) - I would be extreemly grateful for this!

Cheers,

Rob

 

[Mattonella Tile Studio]

They ask for the card type because believe it or not when some people cloan a card number they 'make' the wrong card. For example, they find out the number for someones Visa card but manufacture a fake MasterCard.

On the HSBC internet banking website when you set up a new bill payment you have to input a card type, and on the list it tells you what the starting numbers should be for the card. That could be one way of starting a list if your internet banking provider gives you the info.

 

[MartCactus]

There is a good list of the prefixes for cards and what bank owns them here...
http://en.wikipedia.org/wiki/Credit_card_numbers

or a fuller one here

http://en.wikipedia.org/wiki/List_of_Bank_Identification_Numbers

From a security point of view this can be useful... if you can see which bank issued the card it can point at fraud... eg if IP address is in USA but issuing bank is German... not necessarily fraud, but worthy of an extra look

 

[Rob Holmes]

Top stuff thank you!

Much appreciated !

Rob

 

[glencooley.com]

You might also want to do a mod 10 check before passing the number to protx.

Its simple enough I have a javascript and c# function to do it. I can pm it to you if you want its easy enough to redo in PHP or similar.

Thanks

Glen

 

[Rob Holmes]

Cheers Glen - the Luhn check script is already in place for us - but it's a good one to highlight.

We're also doing a couple of other small things like only showing the issue number if it's a solo and Maestro.

Cheers,

Rob

 

[glencooley.com]

Ah ace, Rob. Alot of people dont realise that you can test the validity of a card number before trying to process it.

The Solo/Maestro check is also nice

 

[Optegris]

Save yourself a lot of bother Rob and take a look at MaxMind Mini Fraud.

We use their service on all our sites and it has stopped fraud dead in it's tracks with a combination of IP checks, distance from actual location to invoice location, card details etc...

Very detailed stuff and dead simple to either flag a transaction or just simply not take it.

 

[nickjonesuk]

Out of interest there is plenty of freeware tools available on the internet that just check a CC number is actually a CC number. Known as BIN numbers. Wikipedia article very useful. I always did wonder why sometimes when I pay in a shop, the receipt would say Connect Debit and not just Visa.(Barclays Visa Debit card)

 

[John_Mac]

detect the card type rather than ask the customer (1 less field for them to get wrong).

Don't forget user expectation though. Some users like to see the same familiar, reassuring things when they are providing their CC details online. If most other checkouts ask for a card type (regardless of whether, behind the scenes, it is actually necessary), will users be disconcerted to not see this on your checkout?

(I have no evidence on this, it's just a thought. Would love to see some research on whether presence / absence of a CC field has any affect on conversions).

 

[TotallySport]

If you detecting the card type and displaying it dynamically, I would expect that to show a level of validation to the customer which would increase trust in the procss, but thats not tested just my opinion if I was buying.

(But I would be impressed)