What do the numbers on my credit/debit card mean?

Question

I have the following visa card from comdirect.de:

I guess:

• Number A is my credit card number. The 4 groups don't have a meaning.
• Number B: I have no idea. Might be my security code?
• Number C is my security code.
• Number D is eventually a card code (GD is Giesecke & Devrient)

So my question is mainly about number B and C.

Answer 1

Number A is my credit card number. The 4 groups don't have a meaning.

They do, actually. First digit is 4 for VISA, 5 for Mastercard, 6 for Discover/Diners Club, 3 for American Express/Diners Club (those are shorter than 16).

Also, first 6 digits for Visa and Mastercard are code numbers for the issuing institution. By these 6 digits anyone can know which institution issued the card, and what type of card it is (debit/credit, premiere or not, etc).

Number B: I have no idea. Might me my security code?

This is a security measure. These 4 digits must match the first 4 digits of your card number (the first 4 digits of the issuer code. The last 2 are card types for the issuer, though some different issuers may share the first 4 as well and only differ by the last 2). Amex cards don't have this (I'm not sure about Discover).

Number C is my security code.

Yes, this is called CVC or CVV2. It is used for card-not-present transactions. The purpose of the code is to verify that a payment card is actually in the hands of the cardholder/merchant, for example when using the card over the internet or phone.

On American Express cards this is 4 digits, and they appear on the front of the card.

Number D is eventually a card code (GD is Giesecke & Devrient)

This is bank-specific, so I guess whatever you said...:-)

Answer 2

Number A is my credit card number. The 4 groups don't have a meaning.

The structure of card numbers is standardized in the payment card industry by part 1 of the ISO 7812 standard (paywall, see also Wikipedia's view). A card number is between 8 and 19 digits which are structured to convey the following information:

• Major industry identifier (MII): the leading digit of the card number indicates the industry of the issuing authority, e.g. airline (2), travel (3), financial institution (4 and 5), and others. (Full table)
• Issuer identification number (IIN), sometimes bank identifier number (BIN): a globally-unique identifier for the specific organization which issued the card. IINs are 8 digits in length (as of the 2017 standard, formerly 6 digits) including the MII number as their first digit. The American Banker's Association is the registration authority which allocates IINs to card issuers.
• Account number: a number which identifies your account uniquely to the issuing institution so your transactions can be allocated correctly. These are allocated by the issuing authority and may comprise your account number or other digits which can be mapped to your account number. As issuing authorities often support multiple cards for a single account, there may be a sequence number (see the comments).

• Check digit: all cards adhering to the standard include a final check digit generated using the Luhn algorithm. This provides a local error-detection mechanism for identification of common errors when manually-keying card numbers. It can identify single-digit errors and some instances of two-digit permutation (e.g. entering "25" rather than "52").

  It does not validate the authenticity of the card number as it is easy to invent a number which passes the check. However, it provides a mechanism to reject obviously incorrect card numbers early, without performing an online check with a merchant network to verify the card's authenticity.

Number B: I have no idea. Might be my security code?

This is the pre-printed BIN (bank identifier number). It generally repeats the first four digits of the embossed card number and acts as an additional security feature for cross-checking the issuing authority against the card number.

Number C is my security code.

This is a verification code which is typically used as additional authentication for card-not-present transactions. It has a variety of names depending on the card issuer:

• card verification value (CVV2, Visa)
• card verification code (CVC, Mastercard)
• card identification number (CID, Amex, 4 digits)

Payment card industry regulations do not require a merchant to collect this value when processing a card-not-present transaction, but if they do collect it, it must not be persisted to any means of storage by the merchant after the transaction is authorised.

The existence of this code is intended to mitigate several types of attack:

• Straight online theft/fraud of the card details - for example, by stealing the card details from a compromised merchant database. As PCI-DSS forbids the value being stored, this provides some modicum of protection against card re-use via other online/telephone means.

• Card forgery - the value is not encoded on the magnetic strip or in the card's chip, so attempts to clone cards during in-person transactions and later use the details for mail-order are mitigated. In these circumstances, the attacker would need more time to visually inspect the card to clone the verification value; not impossible, but nevertheless non-trivial without arousing suspicion.

Number D is eventually a card code

If you say so!

Answer 3

The first digit tells you what type of business issued your card. The first six numbers identity your bank/issuer specifically. The seventh and following digits identify YOU. The final number checks you typed everything in correctly. You can also check whether any credit card number is valid using the Luhn algorithm. The Luhn algorithm is only in place to check for mistakes when typing your number in online or reading it out over the phone.

More here: http://redshed.co.uk/blog/how-do-credit-card-numbers-work/