///# ///# ///# ///# RACK ///#///# //////# ////# ////# ///#///# /////# /////# ASTER ///# ///# ///#////#///# ///# ///# ///# //# ///# ///////////# ///# ///# ///# ///# RODUCTION ///# ///# ///# ///# ///# ///# ///////////# ///# ///# ///# Dissecting Credit and Calling Cards !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! by Krackmaster 7/27/91 -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- DISCLAIMER: I wrote this file not to encourage carding, frauding, or any other illegal activities. This file will uncover secrets of the world of credit/calling cards to help you understand it not to abuse it. This is for informational purposes only! -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Credit cards are used everyday by millions of people all over the world but very few people even know anything about it. This file will try to explain to you the various types of cards, its structure and some other interesting things I feel you may want to know. First of all, there are different types of cards, but I will break them down into 2 categories. The first are credit cards. These are cards such as Visa, American Express, Diners, etc. The other cards are calling cards. Within this category are BOC, CIID, and Corporate cards. Credit Cards ------------ One of the most common credit cards are the Visa cards. It will always start with a 4 and will be either 13 or 16 digits. These are the formats: 4xxx xxx xxx xxxx or 4xxx xxxx xxxx xxxx. The last digit is the checksum digit. The expiration dates are usually no more than 2 years in the future. If you look on your card, you will see a cv or pv next to the date. The cv means that this is a common card but the pv means you are a preferred customer. Also, there will be the first 4 digits of your card number somewhere on the card. They have to match. This is the issuing bank's number. Each bank has their own unique 4 digit number. The most common is Citibank, which is 4820 or 4128. Another common credit card is the MasterCard. This will always begin with a 5 and will be 16 digits. The format is 5xxx xxxx xxxx xxxx. Again the last digit is the checksum digit. The issuing bank's id number will also appear on the card as well as being the first 4 digits of your card number. An "entertainment card" called American Express is also common. These cards begin with a 37 and the format is like this: 37xx xx xxxx xxxxx (15 digits). Likewise, the Discovers card is gaining in customers. Their format is: 6011 xxxx xxxx xxxx (16 digits). Their last digits also check for validity. Other cards are the Diners Card, Carte Blanche and a Japanese card called JCB (Japanese Credit Bureau) which is fast becoming the most popular card in Japan. These cards are also dominant here in the US and sometimes are identified as being a Visa card, strangely enough. Here are the formats: Diners (14 digits): 30xxx xxxx xxxxx 31xxx xxxx xxxxx 35xxx xxxx xxxxx 36xxx xxxx xxxxx Carte Blanche: 38xxx xxxx xxxxx JCB (16 digits): 35xx xxxx xxxx xxxx Checksum Digit -------------- The checksum digit is the last digit of the card number. This number is checked a couple of times by the switch and billing computers. If the last digit is incorrect, the card is automatically unaccepted. There are phreak programs out there can validate a card for you as well as make valid-looking cards for you (it's still not valid because there isn't any expiration date). But in case you haven't figured it out or had the time to look at the code, here is how they do it. For all types of credit cards and most entertainment cards this procedure will work. I wrote a GW-Basic program that will validate cards for you. I wrote it in a way that is long so that you can see what it does. You can shorten it and reduce the number of lines but hope that this will give you a good starting point. If you don't want to type in the program and just want to figure it out, this is how it works: For Visa, Mastercard, American Express, Diners (and Carte Blanche), Discovers, and JCB this mod-10 integer procedure will work. Weight #1: 1212121212121212 (for Visa, Amex, and Diners) Weight #2: 2121212121212121 (for Mastercard, Discovers, and JCB) Example One: 4444 0041 3001 128? Visa card x1212 1212 1212 121 Weight #1 -------------------- 4848 0042 3002 148 result of multiplication 4+8+4+8+0+0+4+2+3+0+0+2+1+4+8 = 48 add together 4+8 = 12 add the digits of the result together 12x10 = 120 multiply by 10 120-48 = 72 subtract from first result 72 mod 10 = 2 result modular 10 equals the checksum digit or the last digit of the result Example Two: 5555 0125 1500 058? MasterCard x2121 2121 2121 212 weight #2 ------------------- 1515 0145 2500 057 result of muliplication (in this case the multiplication may have confused you. Look at the 15th digit, 8 x 2 should be 16 but if you add 1+6 that's how you get 7. 1+5+1+5+0+1+4+5+2+5+0+0+0+5+7 = 41 result of addition 4+1 = 5 add the digits together 5x10 = 50 multiply by 10 50-41 = 9 subtract first result 9 mod 10 = 9 result mod 10 equals the checksum digit Remember to use the correct weight for the specific card. Wasn't that easy??? By the way, there is a file out there on how to make a valid American Express card by Saturday Knight (thanks S.K.!). It made valid cards most of the time but it didn't include this procedure so some of the cards that I made didn't validate and, at that time, I didn't know why. So if you want to make a valid AMEX card, be sure to use the above method. There are 5 other methods on making valid AMEX cards by using a cancellation bulletin. Here's what to do (again for informational purposes only!)... Example: 37xx xx xxxx x111x The 37 will always be there for AMEX cards and the 111 will be the format to look for and modify. Everything else will be the same. Ok, now for the real stuff: 37xx xx xxxx x101x (Saturday Knight's method) || +1-2 Add 1 to the 14th digit and subtract 2 from the 15th digit. If it's 0 it means 10. Everything else will be the same. 37xx xx xxxx xx000 Add 1 to the 14th digit and subtract || 2 from the 15th digit. +1-2 37xx xx xxxx x100x Add 1 to the 12th digit and subtract | | 2 from the 15th digit. +1 -2 37xx xx xxxx x102x Convert the 102 to 201. ||| 201 37xx xx xxxx x101x Subtract 1 from the 14th digit and add || 2 to the 15th digit. -1+2 37xx xx xxxx x100x Add 2 to the 9th digit, add 4 to the | | | 11th digit and add 4 to the 15th +2 +4 +4 digit. Be sure to check the last digit with the checksum routine I just gave you. If it doesn't come out, use another card number. I've made a lot of cards with about 99% efficiency with the above methods! The other major credit cards cannot be made in this way, unfortunately. If there is a way, I would like to see a file on it! Calling Cards ------------- Most calling cards are issued by BOCs (Bell Operating Companies). They are always 14 digits. The format is their phone number and a 4 digit pin number: NPA NXX XXXX ####. The pin digits are usually random (or chosen by the customer) and the last digit isn't a checksum digit. These cards can be used on all systems since it isn't proprietary like the CIID cards. The NPA NXX are used to identify the issuer. Each NPA NXX belong to their own OCN (Operating Company Number). An OCN is a number from 0002 to 9999 that identifies the Local Exchange Carrier or Telephone company. All Telcos have a number assigned to them. CIID (Card Issuer IDentification) cards are AT&T-Only cards. Obviously, they can only be processed by AT&T. The format is the same except that it is only validated on an AT&T-type company. This means that if you were to call MCI or Sprint and make a call, they couldn't approve it because the database for this card cannot be accessed by them. Unfortunately, AT&T is trying to get more of these kinds of cards out there so that they can get back their share of the market. They are trying to make it difficult for non-AT&T customers but, ironically, AT&T customers are the ones who sometimes suffer. The other type of calling cards are corporate. These cards can be used on most systems. Again the format is 14 digits and the last 4 is the pin. This time the first 6 digits (sometimes referred to as an SCC or Special Calling Card) don't follow the NPA NXX format like the BOC cards do. Here is an example: 222 059 xxxx xxxx. The first 3 digits will be the RAO (Regional Accounting Office). This is how they identify the issuer. Again, each RAO identifies a Local Exchange Carrier but in a different way (different in terms of billing). Validation companies validate calling/credit cards by calling up the respective issuing company such as Visa, AMEX, PacBell, Nynex, etc in real time. This means that it isn't a week old database. If a card turns out to be bogus, the BOC can update their database in a matter of seconds and the validation company will receive a code saying to decline it because it is bad. For example, a validation company will usually send out 2 ascii characters to respond to the card check request. For example, AN (A = Accept, N = No Restriction) would be sent as a 65 78 while a DE (D = Decline, E = Excessive Use) would be sent as a 68 69. The database the validation companies access are always positive in that it will store only good cards. A negative database will hold only cards that should not be accepted. These negative databases are usually found in hotels for their PMS (Property Management System) or bong boxes (automated operators that will process operated assisted calls for guests). Since the hotel's system can hold only so much, they do a download of a negative database from validation companies around once a week to a couple of days. Also, some "Smart Phones" access their own little database in order to validate their customer's cards. These Smart Phones are payphones that allow the user to input their calling/credit card numbers to make an "operator assisted" call. It will then check back with the owner's database and will approve (process the call) or decline the card. Some of these phones, for example, will prompt you for your name and play it back to the called party to ask if they will accept a collect call from so and so (your name). Since these operator assisted calls are very expensive, these Smart Phone owners capitalized on this by converting these operator assisted calls as cheap direct dial calls to get the huge profits. After the call is made, the phone will either call or will be called by the owners and all the information (calling/credit cards numbers) are retrieved and used to bill the customer. By the way, validation companies contain enough information about the call to bust you. The companies will usually send (depending on the service they have) the calling ani, the called number, the date, time, and the billing number (third party, calling/credit card with expiration date). The phone company can later pull a report to see what phone numbers were trying to make calls using bogus calling/credit cards with their Administrative Terminal. They send this information in order to block calling areas or track the number of times someone calls a certain number (identifies fraud). Other things you can do with the Administrative Terminal besides blocking cards numbers, you can block trunk numbers or block the number you're calling from or to, change the number of card uses per 24 hour period (usually set at 15-20), reset or clear this number, inquiry about the card and when it was used (you can usually go back around a month or so), or override the card (make it always approve). Unfortunatly, you need their proprietary software to access and run this service. You also need to know special keystrokes to navigate around their software. Pressing '#' will allow to you block a card, for example. The major validation companies are US West Service Link, Card*Tel, and LIDB (only validates calling cards). Luhn Check Digit Routine ------------------------ This routine written in Pascal will check the last digit of Visa and Mastercards to make sure it's valid. WEIGHT$=2121212121212121 WLEN$=LEN(WEIGHT$) CLEN=LEN(CC) (* CC = CREDIT CARD NUMBER) CK.DIGIT=CC[1] CNBR=CC[1,CLEN-1] CNBR.LEN=CLEN-1 RESULT=0 WI=CNBR.LEN WI=WLEN$ FOR IX=CNBR.LEN TO 1 STEP -1 PRODUCT=CNBR[X,1] * WEIGHT$[WI,1] FOR IDX2=1 TO LEN(PRODUCT) RESULT+=PRODUCT[IDX2,1] NEXT IDX2 WI-=1 NEXT IX MULTIPLE.OF.TEN=(INT(RESULT/10)+(MOD(RESULT,10) GT 0) * 10 TEMP.CHECK.DIGIT=MULTIPLE.OF.TEN-RESULT CC=(TEMP.CHECK.DIGIT EQ CK.DIGIT) RETURN GW-Basic Checksum Program ------------------------- 10 CLS:CLEAR 20 KEY OFF 30 GOSUB 620 40 INPUT "Card Number";C$ 50 IF C$="" THEN GOTO 10 60 VISAMEXDNR$="1212121212121212" 70 MASTDISJCB$="2121212121212121" 80 IF LEFT$(C$,1)="4" OR LEFT$(C$,2)="37" OR LEFT$(C$,2)="38" OR LEFT$(C$,2)="31" OR LEFT$(C$,2)="30" THEN WEIGHT$=VISAMEXDNR$:GOTO 100 90 WEIGHT$=MASTDISJCB$ 100 WLEN=LEN(WEIGHT$) 110 CLEN=LEN(C$) 120 CK$=RIGHT$(C$,1) 130 CK=VAL(CK$) 140 CN$=MID$(C$,CLEN-1,1) 150 CNBR=VAL(CN$) 160 CNBRLEN=CLEN-1 170 RESULT=0 180 IF LEFT$(C$,1)="5" OR LEFT$(C$,4)="6011" OR LEFT$(C$,2)="35" OR LEFT$(C$,2)="36" THEN WI=LEN(WEIGHT$)-1 ELSE WI=LEN(WEIGHT$) 190 FOR IX=CNBRLEN TO 1 STEP -1 200 PRO$=MID$(C$,IX,1) 210 WEI$=MID$(WEIGHT$,WI,1) 220 PROD=VAL(PRO$) 230 WEIGH=VAL(WEI$) 240 PRODUCT=PROD*WEIGH 250 PRODUCT$=STR$(PRODUCT) 260 FOR IDX2=1 TO LEN(PRODUCT) 270 RES$=MID$(PRODUCT$,IDX2,1) 280 RESU=VAL(RES$) 290 RESULT=RESULT+RESU 300 NEXT IDX2 310 WI=WI-1 320 NEXT IX 330 MULTI1=INT(RESULT/10):MULTI2=RESULT MOD 10 340 MULTI=(MULTI1+MULTI2)*10 350 CHECK=MULTI-RESULT 360 PRINT:PRINT "Check Digit is"; 370 FINAL=CHECK MOD 10 380 PRINT FINAL; 390 IF CK=FINAL AND LEFT$(C$,1)="4" AND CLEN=13 THEN PRINT VG$:GOTO 590 400 IF CK=FINAL AND LEFT$(C$,1)="4" AND CLEN=16 THEN PRINT VG$:GOTO 590 410 IF CK<>FINAL AND LEFT$(C$,1)="4" THEN PRINT VN$:GOTO 590 420 IF CK=FINAL AND LEFT$(C$,1)="5" AND CLEN=16 THEN PRINT MG$:GOTO 590 430 IF CK<>FINAL AND LEFT$(C$,1)="5" THEN PRINT MN$:GOTO 590 440 IF CK=FINAL AND LEFT$(C$,2)="37" AND CLEN=15 THEN PRINT AG$:GOTO 590 450 IF CK<>FINAL AND LEFT$(C$,2)="37" THEN PRINT AN$:GOTO 590 460 IF CK=FINAL AND LEFT$(C$,4)="6011" AND CLEN=16 THEN PRINT DG$:GOTO 590 470 IF CK<>FINAL AND LEFT$(C$,4)="6011" THEN PRINT DN$:GOTO 590 480 IF CK=FINAL AND LEFT$(C$,2)="35" AND CLEN=16 THEN PRINT JG$:GOTO 590 490 IF CK<>FINAL AND LEFT$(C$,2)="35" THEN PRINT JN$:GOTO 590 500 IF CK=FINAL AND LEFT$(C$,2)="30" AND CLEN=14 THEN PRINT NG$:GOTO 590 510 IF CK<>FINAL AND LEFT$(C$,2)="30" THEN PRINT NN$:GOTO 590 520 IF CK=FINAL AND LEFT$(C$,2)="31" AND CLEN=14 THEN PRINT NG$:GOTO 590 530 IF CK<>FINAL AND LEFT$(C$,2)="31" THEN PRINT NN$:GOTO 590 540 IF CK=FINAL AND LEFT$(C$,2)="36" AND CLEN=14 THEN PRINT NG$:GOTO 590 550 IF CK<>FINAL AND LEFT$(C$,2)="36" THEN PRINT NN$:GOTO 590 560 IF CK=FINAL AND LEFT$(C$,2)="38" AND CLEN=14 THEN PRINT NG$:GOTO 590 570 IF CK<>FINAL AND LEFT$(C$<2)="38" THEN PRINT NN$:GOTO 590 580 PRINT UC$ 590 PRINT:PRINT "Again (y/n)"; 600 INPUT A$ 610 IF A$="Y" OR A$="y" THEN GOTO 10 ELSE END 620 PRINT:PRINT TAB(9);"Visa/Mastercard/AMEX/Discover/JCB/Diners Credit Card Check" 630 PRINT 640 REM Variables 650 VG$="-- Visa Card is Good" 660 MG$="-- Mastercard is Good" 670 AG$="-- AMEX Card is Good" 680 DG$="-- Discover Card is Good" 690 JG$="-- JCB Card is Good" 700 NG$="-- Diners Card is Good" 710 UC$="-- Unknown Card" 720 VN$="-- Visa Card is Not Good" 730 MN$="-- Mastercard is Not Good" 740 AN$="-- AMEX Card is Not Good" 750 DN$="-- Discover Card is Not Good" 760 JN$="-- JCB Card is Not Good" 770 NN$="-- Diners Card is Not Good" 780 RETURN KyAEeRnoHhPp ----- End of File -----