1

I was wondering what info is stored in the CC mag strip. For example: if someone got a hold of by CC number, just the numbers-no CCV, no exp date, etc... it is pretty hard to use my credit card for online purchases as most places require things like exp date, CCV, etc...

If someone got a hold of just my CC number though, is that enough info to use a magstrip writer like this this be able to write my data to a physical card to then be used like a normal one in a physical store?

Brian
  • 21
  • 3
  • Did you have a specific question about the specification for magstripe encoding? The full details of the spec are easily googleable. – Don Simon Apr 10 '19 at 21:19

1 Answers1

4

Could someone write just your card number to a blank card? Yes. But would that let them masquerade as you and charge up your account by swiping that card at point of sale machines in brick and mortar stores? No. Mainly because, when a transaction is sent from a point of sale machine to a card processor for validation, they require data besides the card number (just like you mention for online transactions). Those other required data elements are also written to the mag stripe, in addition to the account number, on a valid card.

Credit card mag stripes contain three tracks - the first two are essentially standard, and describe your account (including account number, expiration date, your full name, country code, etc). Those two tracks are what's used to actually process a transaction when the card is swiped, and essentially replicate the info you're used to typing in when using your card online.

The third track is largely unused, and when it is used, the info stored there varies bank to bank - sometimes including things like PIN numbers, or ID numbers associated with rewards programs, or your max line of credit, or other info. It's essentially unimportant in the scenario of validating a transaction at a point of sale machine, though.

dwizum
  • 534
  • 2
  • 7
  • This answer is correct, except that the extra data on the tracks is specifically _not_ the same as what you enter when you key your card in. Same purpose, but there’s no way to get one from the other. – Bobson Apr 11 '19 at 01:41