Comments on: Better E-Commerce Design using the Luhn Algorithm?

By: Barry Staes

Barry Staes — Thu, 12 Aug 2010 09:34:09 +0000

Sorry, but this was around since 1999. Allas not for credit card numbers afaik, but almost identical algoritm is used in validating some european bank account numbers, by javascript and in a website. Before that, it was used by just about any financial application to check for erroneous entries.

By: Thomas

Thomas — Tue, 15 Jun 2010 23:30:29 +0000

Amazon.com now does this live credit card checking in their checkout.

By: Tom Fallowfield

Tom Fallowfield — Mon, 17 May 2010 15:55:30 +0000

So – if no pre-post feedback is to be given, the algorithm will only be used to sanity check numbers before the payment is processed? Is that really that useful?

By: George

George — Tue, 16 Mar 2010 13:21:48 +0000

Ah ok I didn’t realize that Luhn Algorithm is a public domain source. Particularly since IBM is always so tight with everything they do and never release (to my knowledge) anything as PD.

By: Forrest

Forrest — Wed, 10 Mar 2010 19:32:33 +0000

The majority of ecommerce sites I’ve worked on over the past 10+ years do this in one form or another. Another item others haven’t mentioned is that there are test card numbers that satisfy the algorithm but are not valid card numbers. I’ve used these to test live sites without having to put the cart in test mode, or quickly hop into the gateway admin and cancel the charge. I don’t know if all gateways do this, but at least the ones I’ve used will accept the number as valid, but not process it as a real sale.

By: Josh Bryant

Josh Bryant — Mon, 08 Mar 2010 07:26:24 +0000

Peter, I could be mistaken, but I’m pretty sure I’ve seen real scenarios of actual processors that do validate the name on card.

By: Peter H

Peter H — Thu, 25 Feb 2010 06:15:00 +0000

OLD…

Answering your Q, this works with every card #, and has been used for client-side card validation for a very long time. See validation kits like Peter Blum, etc …

Related to comments – it’s astonishing is that sites ask for card type at all. It always is a bit irritating too when phone card takers, like florists, ask for card type. Card type is not a field used by any card processor that I am aware of, and even if it was needed it could be determined from the card number as described above. Whenever ecom sites ask users for card type, they are just wasting our time!

The same is true, actually, for “name on card”. No card processor uses the “name on card” field for validation or other processing. It’s also a useless field to ask customers for …

What is TRULY astonishing is that a system designed in the 1950s is now the basis for so much of our electronic commerce. We have such a wealth of means to authenticate people on the web … and yet we still use CC number, expiration, CVN, and house number/zip. (And give the card networks 2.5% of the transaction for the privilege) …

By: Mike D.

Mike D. — Thu, 25 Feb 2010 03:27:36 +0000

Tim: It’s probably only of use to a product like Square if the credit card swipe doesn’t work (which definitely happens). The algo is really meant to catch the fat-fingering of a number if and when it’s manually mistyped… I think.

By: Tim

Tim — Thu, 25 Feb 2010 03:16:14 +0000

Funny that it’s been around since the 50’s and used so little. Sounds useful to me.

Some have probably heard of Square by now- the credit card service being developed by Twitter founder Jack Dorsey. (For those who haven’t, see http://squarecreditcardreader.com )

This new way of using credit cards would put that capability in the hands of ordinary folk who would for one reason or another, rather take a card transaction than mess with cash.

I personally think it will get big, and was thinking how if they used this Luhn algorithm, it might serve as an added plus to assure a person paying and accepting that the transaction went through correctly.

Thanks for keeping us on our algorithmic toes Mike. :)

By: Mike D.

Mike D. — Wed, 24 Feb 2010 16:26:00 +0000

Colin: Yep, I always thought type of card was just determined using the first digit, but looks like it’s slightly more complicated than that.

Jeff: Yep, messaging is key there.

Adam: Interesting. Yeah, I don’t think it’s an uncommon step on the server side. Just uncommon to give feedback to the user before they’ve actually submitted anything. There was a small debate about “feedback before submission” a couple of years ago when people started actually sending form input to servers via AJAX. The general consensus was that it was a creepy practice and except under circumstances where there was little chance any sort of sensitive info would be inputed, it shouldn’t be done. An example of where it seems to be ok is username availability checking.

By: Adam Zamora

Adam Zamora — Wed, 24 Feb 2010 15:36:29 +0000

We started doing this around 2000 at the company where I was working at the time. It didn’t happen on the client in Javascript, but we did it server side before sending the number to the processor – it was a sanity check and we could decline the transaction without contacting the processor, which had costs both in transaction time and in real money for us.

I don’t think it’s an uncommon step.

-adam

By: Jeff Hartman

Jeff Hartman — Wed, 24 Feb 2010 15:15:57 +0000

We’ve used the Luhn algorithm at our small online store since we started in 2005. Reason being that in a multi-step checkout process I’d much rather let the customer know they mis-typed their credit card number prior to getting to the “place order” step.

I’ve never heard anyone mention it was creepy or suspicious, but know that it’s made the process smoother.

Using appropriate messaging rather than (or in addition to) the check would make this clearer. Using just a checkmark would be confusing/suspicious to me. Some may think that my card has been authorized or even charged (and may increase cart abandonment).

By: Colin Williams

Colin Williams — Wed, 24 Feb 2010 08:43:26 +0000

The first time I built a checkout system and was researching CC card validation, I ran across this and was equally surprised. I also think there are deeper algorithms that allow you to determine which credit card provider issued that number (AMEX, Visa, Discover, etc. Read http://cuinl.tripod.com/Tips/o-1.htm) You’ll notice some checkouts don’t require that you choose the provider, or some auto-select it once your number is typed, which turns out to be a less-creepy version of the check mark.