Hacker News Reader

Comment by IanCal | Hacker News Reader

Expiry date: It checks that you're not using an old card that someone has just thrown away, often card numbers remain the same if you get a new one. This is effectively just specifying the version of the card, and is something that needs to be on cards anyway (so the user knows when they're no longer valid). Additional benefit is that it means your customer has just checked that their card is still valid.

CVV: Not sure why it's on the back, but the point of this is that it's a number that's not raised, so it's not recorded when using a credit card imprinter (less common than is used now).

View on HN

That doesn't seem convincing, for the expiry. The issuer needs to keep track of cancelled cards anyway, and they should be cancelling expired cards anyway - it seems like a huge security hole to keep expired cards in an active state and rely on an expiry date check to reject transactions.

I assumed that it's a leftover from early days, before online card checks, so the merchant can check that the card is still valid (besides checking signature and ID or whatever). When introducing online checks of the magnetic swipe, expiry date was part of the data transmitted, and early phone/Internet payment systems relied on reconstructing the data present on the magnetic strip, to "fake" a swipe. Then it just stuck from there.

Expired cards and active cards generally have the same card number. I've certainly had multiple cards with the same long number across them. If you have to write the expiry date on anyway then why not use it?

Wait, I thought the expiration date was just theoretical. Nobody keeps the same card number that long without having the card compromised, do they? :)

All my debit cards have had the same number on them for the past 5 years (at least). No part of it is my account number. I know it by memory. I have no evidence that it's been compromised.

One reason for this is that it's at the discretion of the issuing bank whether or not to accept an expired card (in fact, you can get into trouble for handling this locally with some processors).

I believe it's a convenience thing for the end user, when issuing a new card - offer a couple of days "grace" - and arguably there isn't much risk associated with this practice: lost/stolen cards are always cancelled immediately.

Expiring cards has a few other benefits as well. It ensures that the card company has a reasonably-recent mailing address for each of their customers. And it makes it easier to roll out security features/improvements to the actual card since they can limit the maximum age of any valid card. Also, merchants can use the expiry date to alert customers to re-enter credit card details prior to expiry for recurring charges.

exp date could be checked by the server. I just mean they shouldn't ask me to enter it during a purchase.

When I get replacement cards, they have the same long number on them, so the expiry date distinguishes between an old/lost card and my current one.

Reply on news.ycombinator.com