Forum Moderators: buckworks
The transaction was an online order from 5/6. After reading the letter, I checked all aspects of the transaction. I had verified the customer's name and address with the bank that issued his card. I had shipped the merchandise, followed up with my customary "are you satisfied" email, and received a reply from the customer that he was very happy.
The request letter had the transaction date as well as ten of the sixteen digits in the credit card number (I'll use letters instead here): AYDF HAxx #*$!x MLSF.
When I did the verification with his credit card company, the company was here in the US. When I called Mastercard today to get the phone number for the credit card company, I was told that it was in South America. Huh?
I called the customer to see if there was a problem on his end. He's foreign, most likely South American judging from his name. Anyway, he said that I had his credit card number wrong, and that it was AYDF LSMQ FTMN MLSF, not the AYDF HAYS FTMN MLSF that I had in my database. The second set of four digits in the card number was wrong, he told me.
I thanked him for his time, and called the bank I'd called back on 5/6. I gave them the first number I'd used, and they said it wasn't in their system. I then gave them the new number that the customer provided today, and they said it matched his name and address.
What's going on? How did the first number verify and the transaction go through? How could the "new" number the customer gave me be identical except for the second string of four digits?
This really has me confused. If anyone has any ideas, please reply.
Did you verify the CSC code (also called the CVV code) from the back of the card? The odds of having two Mastercards with the same CSC code are 1000 to 1.
As for the CVV number, my card processing company doesn't use those.
What are the odds of two cards having three of the four clusters of numbers the same and in the same order, yet not be issued by the same bank or held by the same customer?
As for the CVV number, my card processing company doesn't use those.Can I question that assertion? I've worked with 40+ U.S. gateways, and they all support the (optional) submission of the CVV code. Many of them don't make it mandatory, but they all support it, and will flag an incorrect code.
This test is important, as 16-digit credit card numbers can be manufactured with a simple algorithm, but the CVV code cannot.
They will be able to figure this out with additional documentation.
[edited by: MrHard at 1:52 am (utc) on May 28, 2009]
