Slashdot Mirror
AmEx To Offer "Disposable" Credit Card Numbers
A reader writes "American Express is going to allow card holders to access one-time use card numbers for purchases online. Not only could this cut down online credit card fraud but it might lead to anonymous purchases. " I'm not sure this gets us closer to totally anonymous purchasing, but it does mean that you can take more steps to protect yourself in online purchasing - now only one megacorp (Amex) could have your records!
The combination of date, temp-ccnumber, and amount makes for more digits. These are checked against your original ccnumber when the transaction is sent to the card-issuer, which is more digits.
Simple version:
store submits charge.
if (temp-ccnumber-digit16) XOR (original-ccnumber-digit3) XOR (day-of-week) == 6, you pass the test.
Pass a suite of such tests, charge is authorized.
Don't expect AMEX to tell you the actual checks performed. Only a small portion of possible checks need be "in force" during a given week or hour, too.
[
(you know, the one where the governemnt has monitoring tools like Echelon and Carnivore)
Anyhow, in hypothetical bigbrotherland, when you get cash from an ATM, it's trivial to include a reader into the ATM that will grab the unique, prominent serial numbers on the bills it gives you (in nice, clear, easy-to-OCR type donchaknow), and correltaes that money to you, a specific individual.
Now you spend this twenty (yuppiebuck) at the market/gun club/peepmall and, being a twenty, it will most likely not be given as change to another customer, but will go straight into the deposit pouch that the store gives to their bank at the end of the day/week.
The bank scans the money, correlates the serial numbers again, sees the path of the bill, and generates reasonable probabilities of the path it took through the system.
Do this for a while and you get statistical certainties on cashflows, who spends what where, telling more about a person's cash habits than an FBI interview would.
I've no idea if the system exists currently, but it's preposterous to think that cash is really anonymous, because cash literally isn't anonymous as long as it has a serial number. It may be anonymous enough for a given purchase, but in the aggregate it tells a great deal about you.
Kevin Fox
Kevin Fox
The first 6 are the BIN number. These are assinged to the banks or creditcard companies in major lots (so MasterCard gets only 5.* and Visa gets 4.*) but there are other 5's that have been assgned to non MasterCards. The short answer is that two cards with the same first 6 number will be issued by the same bank. Currently a given BIN range is also used to tell if its a "gold" as well.
Different countries tend to use different number schemes. The US tends to use nice blocks of well defined numbers which makes scanning trivial. Other banks have even used fully random assignements.
There is no check digit. The "mod 10" system used simply says the sum of the even digits plus the sum of the odd digits x 2 will be a nice mod 10 number. Go look at some of the perl code that does the check and then write the routine in assembly on a machine with BCD instructions. One is about 5 lines and the other isn't. The system was designed to catch transposed digits. if the card is 1234 then the system will catch 1324 and 2134 but not 3214 or 1432. These is also a 1 in 10 chance that bad card number will correctly checksum. Keep in mind that there are still places where those numbers are routinely hand keyd.
Start disposable credit cards, just like a phone card. Go to a supermarket or mall and pay cash for a "prepayed" credit card.
The float would be a great profit center.
But this would be a debit card on a cash account. Get it recharded when it runs out. Great way to launder cash too.
Fight Spammers!
It seems to me that what would make the most sense would be that every account (with a regular old account number) would be linked to a number of "sub-accounts" that would be generated on demand.
In short, the scheme seems to work like this:
1. The AMEX system would open the account, linking it to a master account.
2. The merchant then processes a transaction against the account.
3. The account is set up to automatically close after one transaction is posted.
4. The balance of that account is then transferred to the master account.
Disclaimer: I don't know that it works that way, it just my inferences based on the article.
The numbers could be linked to a master account by running the account number through some kind of one-way algorithm. Or maybe by picking them out of a pool of available numbers and assigning them in sequence.
In any event, it's a really interesting approach, although I'm afraid that the number of valid mod-10 account numbers will diminish quickly. Sort of like the way IP addresses have.
What I find MOST insteresting about this strategy is that it cuts down on an online merchant's ability to invade my privacy by using credit card numbers to link information in puchasing databases.
Account, name address and 2 forms of photo id?
Sig it.
Regarding your third point: AmEx is not offering disposable numbers to just anyone (check the article). They are offering them to their customers -- i.e. people with AmEx accounts, who thus, one presumes, have met AmEx's standards of credit rating, etc. Thus this is no different than already having a credit card from AmEx, except that it can't be stolen (online). The numbers being instantly available on-line just means their customers will be more likely to go to the minimal effort of getting the more secure disposables rather than just typing their real AmEx# into ghu-knows what website.
So the billing (wrt your second point) is no different: you get it on your AmEx card bill, is all.
Think of the disposable # as an alias for your real number. In the same way people use hotmail accounts as disposable spam-filter accounts, these AmEx#s are disposable theft-filter accounts.
So to use this, you need to apply for a regular AmEx account, and then you can get the disposable #s.
----------------------------------------------
-*- Any technology indistinguishable from magic is insufficiently advanced -*-
Sorry, but this seems funny to me - the term "The income tax people" sounds like a corporate slogan, i.e.
Network Solutions: The dot com people.
The US Government: The income tax people.
Someone else encrypts your card number...
Well, how does that "someone" gets your card number in the first place? The idea of the system is that you never transmit this new card number in clear.
There's another weakness, though and here's the fix: the merchant's (public) key needs to be signed by Am Ex, so that a merchant can't send you a dummy public key for which it has the private key and decrypt your number. I can't find other weaknesses for now...
Opus: the Swiss army knife of audio codec
AMEX was supposed to release details on this at 0900 PDT today. Is there a link yet?
The income tax people will FREAK on this.
This is why offshore accounts are illegal!
(1st?)
A disposable credit card is an interesting idea, but unless it's possible to refill the card (thereby defeating part of the reason for having one), it means we'll have the same problem we have with disposable phone cards: they get thrown away with money still on them. After normal use, there's always a small balance that can't be spent through normal use, and the credit company will stand to rake it in as pure profit.
...and I'm talking about cryptological permanant credit card numbers that cannot get compromised
Opus: the Swiss army knife of audio codec
Did a credit card company come up with this? This is actually a great idea-- I'm really impressed. While it isn't digital cash, it still seems like a good idea. If nothing else, it will make people more confident with giving the number out, rather than feeling like a year from now some guy will trash them and then start carding TV's from Best Buy.
Pretty cool. I wonder what kind of tracking database they'll use to match people with their purchases. If there were a privacy guarantee, it would be even better, but I guess that that is wishful thinking.
how long before a cryptologist breaks the algorith to determine whether the number is a valid entry? at that point, we'll have tons of fake cards and stuff getting billed to the wrong person.
it will end up being just like those $5 calling card scams that you see in NYC all the time.
Assuming that using a disposible cc number is anonymous, (why wouldnt it be, it would be like a phone card), by using this and sneakemail.com an "e-consumer" would have much more control over his/her purchasing identity and power over junk in their mailboxes (both snail and e) and more importantly, would significantly impact the very valuable side effect of current purchases - customer data. By drying up that source of data we might effect businesses hunger for it, turning their desire elsewhere (maybe towards quality), and be closer to turning an ebusinesses view of the internet as a black box that their goods go in and money comes out. Of course the danger is that cc companies see the value and start selling customer data back to the ebusinesses.
Sneakemail is to spam filters what an ounce of prevention is to a pound of cure.
Time-related as well. They can recycle them over a period of time. Numbers would be valid for say, 24 hours or some such thing, and then recycled (but not active until reassigned.)
You go to the amex secure site, identify yourself, and they give you a one-time-use number for the transaction. YOu use it.. done deal.
A week later, they can use the same number again.
is this the vendor reader or the personal reader?
the original smart vendor reader had the problems.
i'll try to find documentation of it online
--locust
Second, how will AMEX ensure that you will pay your bill?
If I understand this correctly, the disposable number will be linked to your normal, non-disposable AMEX card. AMEX will still have all your details, and any bills you run up will acrue to your regular account, but the number will cease to be valid after one use, so that an unscrupulous merchant can't run up extra charges on it after you've paid for what you meant to pay for. They will probably have to have some sort of mechanism where merchants with legitimate complaints can add an extra charge after the fact (like if you use it to pay for a hotel bill, but then they found you stole all the towels).
Think of it as just a symlink to your regular card, one that you (or AMEX) destroy as soon as it's fullfilled its purpose.
I conceed your first point, though, that the process of getting the disposable number from AMEX is just as prone to interception and theft as any credit card purchase, but I think the real problem with credit card fraud so-far has been unscrupulous merchants adding extra charges (like double billing) and/or idiot merchants leaving your credit card number on their system where it is stolen by crackers and script kiddies. This concept addresses both of those problems.
--
The next Cmdr Taco duplicate will be ready soon, but subscribers can beat the rush and see it early!
If we were using the truly anonymous cash card (phonecard machine type), then couldn't the government just tax the purchase of the card itself, and stop worrying about it?
But then, how not to re-tax the sale itself, differentiating between a cash card and a credit/debit card...
And then, that would require the identification of the location where you purchased the cashcard, which would be worse in terms of anonymity than current credit cards. And odds are the government would be perfectly happy to tax twice, and..
Oh, nevermind.
---
"The Constitution...is not a suicide pact."
"Life. Don't talk to me about life."
too bad they released the card without a reader that didn't blow up when they tried to use the card.
(this is a true story, the reader would short out if you actually tried to use it the way it was meant to be used)
This may sound like a good idea, but it has its drawbacks.
The first drawback is granularity.
The second drawback is non-rechargability. If recharging devices were available, people would start stealing those and recharging their cards at will. To make this impossible, one has to provide each card with a sort of "shadow bank account" and have the recharger communicate with some central authority. Then, you could desable known stolen rechargers.
The third and worst drawbacks is that if it's an electronic device, you can fake it. I spent some time in 1996 assembling a microcontroller-based board that could pretend it was a German phonecard. No one would introduce a payment card that could be faked this way. In order to stop this, one has to introduce either advanced secret card signing algorithms, which are sure to either leak out or be faked sooner or later, or use shadow accounting like with the German GeldKarte ("money card"). Again, anonymity and non-traceability can no longer be guaranteed, and the advantage will be gone.
A very good introduction how the German GeldKarte payment card system works can be found here. I'm sorry that it's all in German, but the system is specific to Germany, so most people wouldn't bother to translate it. You can try the fish, though. An English introduction can be found at Manni's page
.As a state gets corrupt, its laws multiply; the most corrupt states have the most numerous laws. (Tacitus, Annales 3:27)
Currently I use a similar variation where I have an account at one bank with a debit card and I only keep a small amount of money in there for online buying. This could be made easier if I could just transfer money to a temporary number while I am shopping, use that number and never have to worry about who has sniffed that number. It would also make tracking my online purchases easier as I would get one statement listing all my debits from my account to temp numbers and a list of the amount of money stored on the temp numbers.
This is not the way to build a lasting empire.
But beer should be free. hehe. Touche~, good point. I generally want cash for the little things though...and never take out more than 100 bucks at a time. If I want a bigger badder item, I whip out Mr. Plastic.
Sig it.
VISA and AmEx have been kicking around ideas to do something equivalent to one time password cryptocards. This is a simple version of the same idea, without all the fancy hardware. If it works, expect the idea to take off with all the major card issuers.
What will probably happen later on is, you will be given an electronic card, with a special token embedded in the circuitry. When you want to use your credit card number online, instead you push a button and a small display tells you the cryptographically hashed version of the card, valuable for a single use over the next hour or so.
The hash function combines a real time clock value, the token, and a counter for each use.
The servers will have a copy of your token, know the time, and keep a local counter. Then the server can compare the crypto hash of your card. If they match, the transaction is authorised. Then later the billing department matches up your hashed number with the real number, and you see the charge show up on your bill.
There are a ton of other little details which the crypto card industry has worked out, but the system mostly works. Too bad this neat methodology will be patented to death, so only the big boys can play with it.
the AC
Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
Personally, the "ideal" would be a smart-card on which you could lodge a mixture of cash & credit, do online transfers from any suitable station, and use as a practical alternative to credit cards, debit cards, cheques and cash.
Such systems are being tried out, in the US and UK, but only over small scales. Despite everyone I've talked to liking the cards, the card companies won't put them out for general use. Stupid idiots!
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
see here or here for extra details, including the fact that this will be for American Express consumer and small business cardholders in the United States.
so it's a step, but not a huge one. of course, bill murray said it best in What About Bob - Baby Steps!
/* Half alive and half dead too, work is for suckers and the sucker is you. - "Half-life" by Local H*/
If you take 19 numbers and stuff them in your database you are in all probability going to be violating your agreement with the credit card company. You aren't allowed to store the final three digits (the CVC) at all.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
Baker's Law: Misery no longer loves company. Nowadays it insists on it
http://www.sigsegv.cx/
cryptological credit card number!
Here's the process...
1) Am Ex holds special private keys for all merchants (the merchant only has the public key).
2) I encrypt my card number, as well as the amount of money using the merchant's public key and send that to the merchant.
3) The merchant sends the message (he cannot decrypt it) to Am Ex.
4) Am Ex, decrypts is with the merchant's public key (if somebody else had intercepted, it wouldn't be encrypted with the right key).
5) Am Ex pays the merchant the right amount from the right credit card.
Looks safe (to me), though IANACS (I am not a cryptography specialist)
Opus: the Swiss army knife of audio codec
I felt pretty safe buying online too -- Until somebody somewhere hijacked my card number, and I suddenly had over a $1000 worth of speakers and stereo equipment show up on my bill. No, I did not have to pay for it, and even if they caught the person who did it (a pretty good bet, since the moron also used it to pay his cell phone bill), I wouldn't know for sure that it was from an online purchase becuase they don't release any information about the investigation. But it makes you feel quite vulnerable, and does a lot to make you a little more cynical about tossing your card number around (it was an AmEx, by the way). So, I'm all for this because my security concerns are based on more than artificial worries.
Buying online is probably safer than buying in person. If you take the normal precautions (secure site that is known) you are almost guarenteed safety. Compare this with a restaurant. You eat your meal and give you card to Joe Waiter to carry away and do whatever he wants. No one steals credit cards off the internet, because it is hundreds of times easier to talk to your buddy who works at Denny's and ask him to get you some credit card receipts. People use stolen credit card numbers on the Net, they don't get them there...
"Information wants to be expensive" - Stewart Brand, the same guy who said "Information wants to be free"
I think this is a darn good idea, as long as the number space for the one-time numbers is large enough to avoid collisions for many years between usages. (And the resultant numbers will have to contain some kind of cryptographic signature information so that fraudsters won't be able to just make up random numbers to try and get a hit on an open one-shot account number).
:). I can only hope that other card vendors and/or banks might follow their lead.
About how many digits will they have to use to make these assumptions feasible (including the cryptographic check?). Maybe if they go to letters AND numbers?
This kind of scheme would handle a lot of my objections to giving credit card numbers to untrustworthy merchants (given that I trust AMEX not to release my personal information to anyone else
I'm assuming that the one-time numbers are not TRULY anonymous (otherwise AMEX wouldn't know where to send the bill, and/or it would be too convenient for money laundering).
Personally, my Blue card has 15 digits. Presuming that they have to keep with the same general self-authorizing numbering schemes (numbers so that quick checking schemes can tell right away if the card is bogus) how long could they continue to issue unique "one time use" numbers before overlapping occurs? Couldn't someone just try entering a number at random and more than likely stumble across someone elses current temporary account number?
Don't get me wrong, these are just questions, I think the system is a great step forward. While I don't EVER use my credit card online unless that "little lock" appears in my web browser and don't let companies store my CC info for quick "one click shopping" (shudder) this will ceratinly help bring a little more confidence to newbie online consumers.
Ad in classifieds: Pandora's Box (no box) $5
(1) Turn off computer
(2) Go to retail outlets
(3) Pay cash
Kinda. If the expiration date is MM/YY, MM is restricted from the values 1 - 12, not the full range of values from 00 - 99.
I could not justify my existence if I were a turkey farmer. Would I terminate myself? Undoubtably, yes.
No. It is meant to challenge your assumptions.
The best technologies are ones which don't mystify their users; which are reliable and robust, not cantanerous and prone to disasterous failure from small errors; which work themselves into the fabric of everyday, mundane life so well we don't even think of them as "technology" anymore. One should not have to engage in ritual sacrifice; to learn strange, archane words or glyphs; to prepare extensive containment mechanisms in the eventuallity that what one raises one cannot put down; to have to perform an extensive series of precise gestures to a level of exactitude which demands years of training, lest in erring one looses upon an unwitting world a reign of absolute darkness and terror; or to invoke metaphysical powers... merely to use, say, a spreadsheet. Yet for decades, that has been precisely the experience of many users of commercial software products.
Geeks are people who delight in being wizards. For us, playing with the arcane is intrinsically enjoyable. But that a technology is arcane does not make it a good technology -- it makes it a marginal technology.
The best technologies are like hammers, bridges, and automated teller machines. No matter how little the general public understands them, there is nothing mystical, occult or "magical" about them for even the least technical person.
The "magicalness" of technology is an indication of its poverty of elegance, its brittleness, its limited user interface.
A "magical" technology is anything but advanced.
----------------------------------------------
-*- Any technology indistinguishable from magic is insufficiently advanced -*-
As if the IP number shortage wasn't enough, now we're going to run out of AMEX numbers too. AMEXv6 anyone?
I just hope they didn't issue all the AMEX card numbers starting with 18 to MIT!
The same way they tax cash purchases?
--
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
They were testing this stuff earlier this year at several tech expos. I received a card worth (I think) worth $50 for sitting there and answering a few questions. They could have just as easily emailed me the numbers and said here ya go, use it online instead of giving me a piece of plastic that was worthless after just one usage.
:-)
Hmm...looking through my wallet I still got it...I probably still have a dollar or two on this card if anyone wants it
3790 112994 91001
good 02/00 thru 11/01
Blah...to be honest, I really wish I had more of these things. Much easier than carrying cash, and I don't have to worry thieves getting access to my Debit Card (long since gave up the credit thing...) and depleting my account and waiting the 8 months for my lousy bank to redebit the 2 grand the fuckers stole and charged up 4 days after reporting it stolen.
grumble grumble...
clif
What Do the Numbers on My Credit Card Mean?
Although phone, gas and department stores have their own numbering systems, ANSI Standard X4.13-1983 is the system used by most national credit card systems. Here are what some of the numbers mean:
________________
They're - They are
Their - Belonging to them
I don't want free as in beer. I just want free beer.
credit card numbers are already instantly available in their wallets. Overextended credit already happens all the time (and making purchases you can't afford is what keeps credit card companies in
There is a problem with your reasoning: Amex is not a credit card, it is a debit card. You are required to pay the entire balance every month. A credit card allows you to not pay the full balance, but you pay a high interest rate (in general) if you don't.
www.webcertificate.com
Put in the cash you want when you want. It works like a mastercard, at any store that takes mastercard. Simple. Easy. Effective.
---
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
Don't mean to nitpick, but at anytime you get your card stolen...you can call up the card company and cancel it. That's why it doesn't really bother me. I'm not liable for the fraud as the consumer, the cards are.
Sig it.
The article is amazingly scarce on technical details.
Anonymity is not the intended purpose of these cards. The purpose of these cards is to generate credit card numbers which are one-time use only so that anyone stealing them has no use for them.
Mmmm.. Donuts
Except those cases where these "reputable merchants" had an architecture that left their SQLServer databses exposed on the Internet and they got sucked dry. I had my CC number stolen, and it was not log after CDNow (or one of those guys) had their database scarfed off of the 'net.
Do you even know anything about perl? -- AC Replying to Tom Christiansen post.
Yes, but some cards are trying to encourage ONLINE transactions and thus even waive the deductable. My card does that currently. While I don't like paying for the $50, I'd rather pay that than what a guy can charge for my limit!
Sig it.
Eventually, someone will develop "e-checks". Essentially, it'll be like writing a check to
cash right now. The bank gives you a check number
(say 16 alpha-numeric = 80 bits worth), you
tell them the dollar amount, which is debited
from your checking account. You forward the
bank identification (their routing number),
the check number, and the amount to the merchant.
He gives that info to HIS bank, which collects
from your bank.
All this can happen in real time. You shop online, find something you like. Open another window to your bank, and get a check number.
Copy/paste the number into the merchants form,
with the amount and bank rounting info. The
banks do some back office magic, and your payment
is in the merchant's account immediately.
Stealing the number does no good, since it is
only valid for one transaction. Similarly, you
eat at a restaurant. You get bill. You pull out
PDA and get a check number from your bank. Give
to server. Server takes number over to their terminal. A few seconds later it comes back as
good/paid, and everyone goes away happy.
There's no reason you couldn't do this with a
credit account. Instead of giving the card
to a store clerk, you swipe it through the
card reader in your handheld PDA. Your credit
card issuer then gives you a single use number to
give to the clerk. Clerk feeds it into the
terminal, and it clears.
Daniel
For truely anonymous purchases we need prepaid cards that you can purchase anywhere just like phonecards. If those prepaid cards would act like a credit card online then it would be perfect. You could buy these cards at the local grocery store with cash. Suddenly you have a card that acts like a credit card without anyone knowing who you are. Granted if your buying something that needs to be sent to you they get your address but for micropayments and such where you're only getting digital data back, it would be perfect.
We should be asking ourselves what we want the on-line transaction of the future to look like. This is certainly one way of doing it, and you can bet that Visa and Mastercard will shortly follow suit, but is it the best way?
It certainly has advantages over typing your card number into 50 different on-line databases, but your credit card itself is still the weak link in the chain. Sooner or later the question of authentication will rear its ugly head. How do you know that it was really Joe Shopper requesting that disposable number, and not Joe Cracker?
On another note, notice how anonymity is hyped in the article, and sometimes used in place of privacy? Do we have an unlikely ally in our quest for true web anonymity (i.e. "You don't know who I am."), as opposed to privacy (i.e. "We know who you are. Trust us; we'll try really hard not to tell anyone.")?
Lastly, as another poster already said, the government is sure to get twitchy about this. How will they tax anonymous purchases? Requisition monthly transacion records from AmEx?
10100111101010010
--
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
How will this effect online banking and accounting? You would have to tie this "anonymous" account number to YOUR account...
Here's how it would likely work:
The numbers need not be "one time only" usage by AMEX. Basically, AMEX only needs to keep the number active long enough for the transaction to be processed, which would last perhaps one month, then the number goes back into circulation. What they would track then is an activity log for each number (for each number, who used it, when, and where) and an activity log for each user (what number they used, when, and where). Any billing questions can be referred to the log for archive purposes and the numbers stay active only for as long as they're needed, then AMEX drop them back into general circulation.
This is not going to be an easy accounting task: issuing number, tracking their usage, deactivating, then reactivating them. I can tell you that I'm pretty good with logistics (being a police dispatcher tends to develop those skills ) and it'd be a nightmare for me to track. I'm not sure of any better way to do it, though.
If there's going to be a security loophole, it'll come in the time a number is active, after the transaction is processed, but before the number is deactivated and put back into circulation.
-Jimmie
That was my though exactly, but what if the system issued the credit card AFTER you made the payment, with the limit set to the payment amount and the expiration date set randomly?
Then you couldn't easily brute force it, and you wouldn't get more than a couple dollars if you did. Also, in case of an abuse by a small company, you could specifically tag the payment to only one payee. Then it works out well.
-Ben
What a neat idea! At least it seems as though it would be an electronic equivalent to a travelers' check.
Numbers could be handled easily. These "credit cards" could be "sold" either individually or in lots. Once a number is issued, it could be reserved, certainly until used, or until some fixed amount of time has passed. Subsequently the number could be reissued, though it might be a few years before that happens.
Graham
Graham
Linux - Fast Pane Relief