Struts Credit Card Validation

[Dom]

Hi,

does anyone know what the business rules are behind struts credit card validation?

Thanks,
Dom

 

[Sudsy]

Hi,

does anyone know what the business rules are behind struts credit card validation?

Thanks,
Dom

Digging through the source reveals the following:
- all characters in string must be numeric
- the number has to pass the mod10 check
- the prefix must be valid Amex, Visa, MasterCard or Discovery

Interesting, as I use a different approach in my own classes.
I also check the length of the string and can handle JCB and
others.
Still, it might be adequate for North American applications,
unless you don't accept all those card types...

 

[Sudsy]

Hi,

does anyone know what the business rules are behind struts credit card validation?

I should always scroll down...
Turns out that GenericValidator#validateCreditCardPrefixCheck DOES,
in fact, check the number length.

 

[Roedy Green]

I don't know what struts does, but you can get the source for credit
card validation from http://mindprod.com/products.html#CREDITCARD

basically it is just some check digit validation.

You an do range checks to figure out which company issued the card.

 

[Steven J Sobol]

Still, it might be adequate for North American applications,
unless you don't accept all those card types...

nah, it's still simple, you just check the first couple digits of the
account number first.

--Visa starts with 4
--Mastercard starts with 5
--Discover starts with 6
--American Express starts with, I believe, either 32 or 37 - be careful
with this because there are some other non-AMEX cards that have 3 as the
first digit. You MUST check the second digit if the first is 3.

 

[Sudsy]

Sudsy <[email protected]> wrote:

nah, it's still simple, you just check the first couple digits of the
account number first.

Maybe not... ;-)

--Visa starts with 4
correct

--Mastercard starts with 5

wrong...it starts with either 51, 52, 53, 54 or 55

--Discover starts with 6

wrong...it starts with 6011

--American Express starts with, I believe, either 32 or 37 - be careful
with this because there are some other non-AMEX cards that have 3 as the
first digit. You MUST check the second digit if the first is 3.

wrong...either 34 or 37

Still thinking it's so simple? And we haven't event touched on Diner's
Club, JCB and different number lengths for some cards...

 

[Steven J Sobol]

wrong...it starts with either 51, 52, 53, 54 or 55

I stand corrected

wrong...it starts with 6011

Of the four major types of bank cards used here in North America, it still
is the only one whose first digit is 6. I was specifically referring to
the four big guys. I thought that was obvious - I apologize if it wasn't.

wrong...either 34 or 37

34, sorry. It's been a while since I have had to write any CC verification
code.

Still thinking it's so simple? And we haven't event touched on Diner's
Club, JCB and different number lengths for some cards...

Yes, I am still "thinking it's so simple." I was referring to doing a simple
check BEFORE calling any mod10/LUHN verification libraries, and I was
specifically posting in response to the post immediately upthread from mine
that only talked about accepting the Big Four. I am aware that once you
introduce other types of cards it gets a little more complex, but even then,
there's still a system.

WRT lengths: Mastercard is always 16, Visa is 16 or 13, Discover is
always 16, Amex is always 15.

 

[Sudsy]

Steven J Sobol wrote:

Yes, I am still "thinking it's so simple." I was referring to doing a simple
check BEFORE calling any mod10/LUHN verification libraries, and I was
specifically posting in response to the post immediately upthread from mine
that only talked about accepting the Big Four. I am aware that once you
introduce other types of cards it gets a little more complex, but even then,
there's still a system.

WRT lengths: Mastercard is always 16, Visa is 16 or 13, Discover is
always 16, Amex is always 15.

Super! And correct, of course. What I was specifically addressing was
a common misconception that credit card processing is "simple". While
it may be straight-forward once you know the tricks, there's still a
lot of work involved in creating a robust system.
Without mentioning the payment processors I've used, there's a per
transaction fee charged for authorization attempts. Due diligence
requires a significant effort up-front to "scrub" the data. It's not
just the simple checks, but doing things like performing lookups in
the lists of stolen or otherwise compromised card numbers, watching
for multiple attempts with different numbers from a single IP address,
etc.
It's not exactly trivial.

To the OP: when in doubt, check the source.

 

[Roedy Green]

I stand corrected

the tables are in http://mindprod.com/products.html#CREDITCARD

There is a new range of Amex I have not got the detail on, but other
than that I think they are complete.

 

[Dom]

Thanks everyone for this,

Much appreciated!
Dom