Why do credit card forms ask for Visa, Mastercard, etc.? • Hacker News Board

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#21

Post by notdonspaulding » Fri, Jan 31, 2014, 8:50 PM UTC

If you only accept the 4 biggest card issuers, you can get away with some dead-simple code to indicate to the user what card type their number indicates they are.

Personally, I bind an onkeyup event handler to fade in the appropriate icon based on the first digit of the number. This is not safe if you accept more than these 4 card types, (we don't).

    function detect_cc_type(number){
        return {
            '3': 'american_express',
            '4': 'visa',
            '5': 'mastercard',
            '6': 'discover'
        }[number[0]];
    }

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#22

Post by henrikschroder » Fri, Jan 31, 2014, 8:51 PM UTC

pbreit wrote: post #7

wcfields wrote: post #2

Could someone who deals with PCI compliance please explain some other nuances of credit cards that I've been curious about: * Fault/Decline Codes returned from processors like CyberSource. How are these factored? How do processors do Regex on names/addresses? [1][2] * CVV numbers and what they mean/how they are treated in the system? If CVV number is included does this increase chargeback protection? * How CHIP cards…

Checks are typically very simple, no regex-ing involved. First, names are not really checked. For addresses, usually only the number (and sometimes just first three digits) are checked as well as the zip. Generally the processor tries to decline as few txns as possible and instead deliver the information to the merchant to make a decision. The merchant can usually pre-configure error codes that it would like the proc…

> charge more for missing or incorrect CVVs.

Wait, what? Can transactions still go through without the CVV, except the merchant's transaction fee is a bit higher? They're just not declined outright?

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#23

Post by kogir » Fri, Jan 31, 2014, 8:54 PM UTC

The same reason forms make your enter your phone number in a particular format.

It's easier to make the user do all the work, and lazy developers can't be bothered to do simple things like strip all non-digits from a phone number.

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#24

Post by jonknee » Fri, Jan 31, 2014, 8:57 PM UTC

pbreit wrote: post #7

wcfields wrote: post #2

Could someone who deals with PCI compliance please explain some other nuances of credit cards that I've been curious about: * Fault/Decline Codes returned from processors like CyberSource. How are these factored? How do processors do Regex on names/addresses? [1][2] * CVV numbers and what they mean/how they are treated in the system? If CVV number is included does this increase chargeback protection? * How CHIP cards…

Checks are typically very simple, no regex-ing involved. First, names are not really checked. For addresses, usually only the number (and sometimes just first three digits) are checked as well as the zip. Generally the processor tries to decline as few txns as possible and instead deliver the information to the merchant to make a decision. The merchant can usually pre-configure error codes that it would like the proc…

> It's harder to "steal" a chip card since the information is not sitting on an easy-to-read mag-stripe. It's not clear that chip cards would have avoided the Target thing since the fraudsters infiltrated the terminal software. I'm guessing more current terminals/software is simply harder to compromise. "Chip & pin", as is widely used in places such as Canada and Europe, might help a bit since you would need the PIN to shop off-line. But it would have minimal effect for online shopping since PIN is typically not requested.

Limiting the fraud to online only would have greatly reduced the potential damage. There was a reason why carders were making physical cards to use, it's muuuch easier to get a transaction through. Address verification and CVV (not part of Target's dump because it's not on the mag stripe and is not collected by Target) would catch anyone using a stolen number online.

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#25

Post by frankus » Fri, Jan 31, 2014, 9:03 PM UTC

For a good example of how to do this right, see skeuocard:

http://kenkeiter.com/skeuocard/

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#26

Post by pfg » Fri, Jan 31, 2014, 9:04 PM UTC

henrikschroder wrote: post #22

pbreit wrote: post #7

Earlier quoted context omitted.

Checks are typically very simple, no regex-ing involved. First, names are not really checked. For addresses, usually only the number (and sometimes just first three digits) are checked as well as the zip. Generally the processor tries to decline as few txns as possible and instead deliver the information to the merchant to make a decision. The merchant can usually pre-configure error codes that it would like the proc…

> charge more for missing or incorrect CVVs. Wait, what? Can transactions still go through without the CVV, except the merchant's transaction fee is a bit higher? They're just not declined outright?

Yes. Quite a lot of merchants do not ask for CVV/CVCs (Amazon being an example).

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#27

Post by dylz » Fri, Jan 31, 2014, 9:06 PM UTC

henrikschroder wrote: post #22

pbreit wrote: post #7

Earlier quoted context omitted.

Checks are typically very simple, no regex-ing involved. First, names are not really checked. For addresses, usually only the number (and sometimes just first three digits) are checked as well as the zip. Generally the processor tries to decline as few txns as possible and instead deliver the information to the merchant to make a decision. The merchant can usually pre-configure error codes that it would like the proc…

> charge more for missing or incorrect CVVs. Wait, what? Can transactions still go through without the CVV, except the merchant's transaction fee is a bit higher? They're just not declined outright?

Yes. Physical transactions, card present, with chip and pin have lowest txfee.

You can run a card with only a number and exp even. No AVS at all. Just higher cost higher risk.

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#28

Post by jonknee » Fri, Jan 31, 2014, 9:07 PM UTC

marcusr wrote: post #4

Why do credit card forms ask you to enter the credit card number without spaces between the clusters of digits, when it's simple for the machine to parse with or without them?

If you follow the letter of the law with gateways it's frequently the case that you cannot modify the payment data. At least that was the case years ago when I integrated with a couple (in the scary days before Braintree and Stripe).

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#29

Post by kevinconroy » Fri, Jan 31, 2014, 9:09 PM UTC

michaelt wrote: post #19

pbreit wrote: post #7

Earlier quoted context omitted.

Checks are typically very simple, no regex-ing involved. First, names are not really checked. For addresses, usually only the number (and sometimes just first three digits) are checked as well as the zip. Generally the processor tries to decline as few txns as possible and instead deliver the information to the merchant to make a decision. The merchant can usually pre-configure error codes that it would like the proc…

Can I piggyback on this and ask an unrelated question I'm curious about? Let's say an online merchant gets a transaction they very strongly suspect is a stolen credit card (perhaps it's from a customer with a long history of using stolen cards) but it validates just fine. Is there any provision in the interface for merchants to ask the credit card company to perform extra fraud checks, like calling the cardholder?

No, there are no such provisions. The card companies have their own fraud prevention/detection departments which mine transactions and look for abnormal behavior. If they spot something out of the ordinary (big purchase, foreign purchase, etc) then they will call you to validate.

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#30

Post by ansimionescu » Fri, Jan 31, 2014, 9:10 PM UTC

http://creditcardjs.com/