Hacker News Reader

This is a very shortsighted and short-lived idea - cyber criminals will find out the first digits of all these canary credit cards and never bother to test them. Even if multiple prefixes come into existence, unless they are mixed with normal credit cards, this won't ever make practical sense.

View on HN

From the article:

"Savvy attackers may start looking for patterns in the bank identification numbers (BINs) that we issue, and proactively deleting or excluding them from their dumps. For this reason we are in discussions with a number of banks to onboard their BINs to the system too, further mixing in legitimate cards with tokens."

True. But this only mitigate the problem, doesn't solve it. Whatever BINs they use, there must be some noticeable patterns, simply because these cards are NOT regular cards.

No bank would mix their numbers with other service providers. Being in talks does not mean there will be a successful resolution.

Reply on news.ycombinator.com