Anyone who offers credit card payment for their web service may want to validate the credit card number in advance. This way, the number of incorrect API calls can be reduced.
The validity of a credit card number can be determined using the Luhn algorithm. Hans Peter Luhn designed the algorithm and patented it in 1960 as US Patent 2950048A. The algorithm is now considered public domain and was specified under ISO/IEC 7812-1. The algorithm is very general and is generally suitable for validating identification numbers. This means that the process can also be used for the use of gift cards or voucher codes.
In order to protect credit card holders from fraud or misuse, several security factors come into play when paying online. The most important point here is the credit card number in combination with an expiration date and a verification code (CVC/CVV). The validity period and the check digit, which are also printed on the credit card, are assigned arbitrarily by the credit card companies and can therefore only be verified by the bank during the payment process.
Before we turn directly to the Luhn algorithm, a note on storing the check digits. These should not be stored in the database if possible, but should be requested anew each time. Payment is only possible through the combination of card numbers, check digit and expiration date. If a single parameter is missing, the payment process fails. Of course, one could argue that it is more convenient for users if the check digit is also stored. But security and convenience are unfortunately conflicting requirements. The higher the security, the more inconvenient it is to use. However, if, for example, the user account has been hacked or an SQL injection has been successfully carried out on the database, the attackers can immediately go on an even more devastating raid with their loot. Such an incident causes considerable damage to the reputation of your own online offering.
Leave a Reply
You must be logged in to post a comment.