Sunday, December 7, 2014

I Cut My Payment Card in Half and What I Found Surprised Me

Recently I received an American Express card from Citibank to replace my expiring one.  Naturally, I cut the old card in half.  My customary procedure is then to discard one of the pieces in a trash receptacle at my house and the other piece in a different trash receptacle.  I figure this will keep me pretty safe from dumpster-diving fraudsters because the trash receptacles are typically emptied at different times and go into different plastic trash bags.

This time I decided to examine the pieces of my card.  What I found was that having only the right-side piece would allow someone to reconstitute the full 15-digit account number! Given where I cut the card, which was pretty much right down the middle, the front showed the last 7 digits and the back showed the first 8 digits.  See the photos below (numbers masked for the protection of me).

What's more, the 4-digit security code appeared on the front side and my full signature was visible on the back (also masked for my protection).  At least the security code was different on my new card, so once activated, using the old code should cause a payment authorization failure.  Still, many e-commerce sites do not require the security code when making a purchase.

So with just half of my old card, the expiration date is the only unknown to a dumpster diver.  That is not a big obstacle to overcome at all.  Logically, if someone throws away a payment card, the probable reason is that he/she received a new card to replace the expiring one.  What would be the expiration date of the new card?  It's very likely to be either two years or four years from now - either the current month or the subsequent month.

This reminds me of the story of the torn-up credit card application that I read about a few years ago.  A man named Rob Cockerham taped the pieces back together, filled out the application, and sent it in.  Amazingly, a shiny new card arrived in the mail for him a few weeks later.

The bottom line is: Be aware that if you cut up your debit cards or credit cards and throw the pieces away in different receptacles like me, you're not necessarily safe from dumpster diving.

I'm asking for a shredder for Christmas.