Turning tables on scammers is a satisfying idea, but a reader’s letter in the Guardian this week suggests the enterprise can be made considerably more convincing with a little technical knowledge: specifically, a grasp of how card numbers are structured and why the last digit is not random.
Gary Calder, writing from Chandler’s Ford in Hampshire, was responding to an article in which a reader strung along bank-card fraudsters with invented account details. His advice: if you are going to fabricate a card number, at least make it pass the basic checks that card-processing systems run automatically.
What the first eight digits of your card actually tell a scammer
The opening six to eight digits of any payment card form what is known as the Issuer Identification Number (IIN), sometimes called a Bank Identification Number or BIN. According to Reap Global, Visa and Mastercard expanded the IIN from six digits to eight digits globally in 2022, driven by a shortage of available number ranges as the volume of card issuers grew.
The governing standard, ISO/IEC 7812, sets the full Primary Account Number (PAN) at a maximum of 19 digits: an 8-digit IIN, an individual account identifier of up to 12 digits, and a single check digit. That final digit is the one Calder urges scam-baiters to get right.
Administration of the IIN standard passed, as of February 2024, from the American Bankers Association to CUSIP Global Services. The standard reaches well beyond banking: IINs beginning with ’80’ are designated for healthcare institutions and those beginning with ’89’ for telecommunications, which illustrates how broadly the numbering system has spread.
The Luhn algorithm: turning tables on scammers one digit at a time
The check digit Calder refers to is governed by the Luhn algorithm, sometimes called Mod 10. According to Ground Labs, the formula detects almost any single-digit error and catches transpositions of adjacent digits. It is not designed to block malicious attacks; it was built to catch typing mistakes. A fabricated number that fails the Luhn check would be rejected at the first automated validation step, which is precisely why Calder recommends getting it right before handing any invented digits to a fraudster.
The algorithm is not exclusive to card numbers. It also validates IMEI phone identification numbers and various government identification numbers, a breadth of application that testifies to its usefulness as a lightweight integrity check.
There is a darker side to this arithmetic. According to Secure Bancard, a fraud method known as BIN Attack Fraud involves criminals taking the first six to eight known digits of a real card and using software to auto-generate the remaining digits, then testing combinations through small-amount authorisations to find live numbers. Knowing how card numbers are constructed, in other words, is not a purely defensive skill.
The postcode flourish
Calder’s second suggestion adds a theatrical element. Scammers often request a billing postcode alongside card details, so why not supply one that is technically valid but hard to miss? He proposes SW1A 2AA or 2AB (10 and 11 Downing Street), SW1A 2JL (New Scotland Yard), or SL4 1NJ (Windsor Castle).
According to Britannica, SW1A 2AA has been associated with the prime minister since the 18th century and has served as a continuous official residence since 1902. Whether a call-centre fraudster on the other end of the line would catch the joke is uncertain, but it would sit neatly in any subsequent data dump they assembled.
The formal card-number structure, as laid out by Pay.UK, the UK payments standards authority, runs to a maximum of 19 digits, with the check digit as the final element calculated by the Luhn formula under ISO 7812:2017. Build your fictitious number to that specification and it will at least survive an initial automated screen.
There is, of course, a limit to how far this sport should go. The goal is to waste a fraudster’s time and, ideally, their resources. The postcodes of Downing Street and Windsor Castle serve that purpose with a certain elegance. When the scammer eventually realises the number is worthless, they will at least have been entertained by the address.
Whether that constitutes justice is for the reader to decide. The next time a fraudster calls, though, the arithmetic is already on your side.
