Skip to main content

Search logic

the idea is to optimize the search speed and detection of possible numbers that could represent the number of a credit (or debit) card.

We know that for a card number to be considered valid it must present these characteristics:

  • They should be all digits with a length of 16 or 19
  • The first digits (usually the first 6) represent the BIN (Bank Identification Number) which is used to identify the issuer entity of the card
  • The last digit is used as a checksum calculated by using the Luhn algorithm

So, any number that has those three characteristics is potentially a valid card number, but it is also generic enough to allow a great number of values that are not real card number. For example, many ID used in systems or even dates and times could have those characteristics.

In order to minimize those "false positives", we will add some filters that can discard as many of those cases as possible. These filters are subdivided into two categories, pattern rules usually associated to card numbers, and rules that discard know false positives (like an ID used in the system we have already discarded but appears frequently in logs).

Confidence levels​

Each potential number we find is assigned a confidence level which is a number between 0 and 3, and is an indicator of how probable is that the number represents a real card number.

Each of these levels have the following meaning:

Level 0​

Is the lowest confidence leve and they are numbers that only pass the check digit verification (Luhn), that is, we don't check it has a valid known BIN or that it is near a key word.

This level has many chances of being a false positive and they usually create a lot of "noise" in the results

Level 1​

This level is higher but only because we have found key words associated to card numbers near the value, so it is more probably that it can represent a valid card number. We are not checking the BIN here either, just the check digit and proximity to key words.

Level 2​

If the number passes the check digit verification (Luhn) and also its first digits correspond to a valid known BIN, it is assigned this level. The list of known BINs is taken from a file named reveal_binlist.txt if present.

The BINs can be defined with different lengths starting from just one digit. It is important to note that the more digits we define for a BIN, the more specific we will be and we will be able to discard more false positives. This level assumes that we have not fouln key words near the value, if we do we will be promoting the confidence value to the next level.

Level 3​

Is the most confident level where all the filtering conditions apply, that is, the number starts with a known BIN, the check digit is correct, and it is near a key word separated by a defined distance. Numbers with this level are the most probable to be a real card number.

Key words

There is a list of key words that, if found near the number, increase the probabilities that the number corresponds to a valid card. If, for example, the line where the number if found also contains the word card or pan, then there are great chances that in that same line a card number is present.

It is important to note that the key words must be present before (to the left) of the value, if they are after it (to the right) they are just ignored.

The current list of key words to consider (case insensitive) is:

card
pan
field35
field 35
field_35
field-35
f35
f-35
f_35
DE35
DE035
track
visa
master

Distance​

Here we introduce the concept of "distance", which is the maximum number of characters before the value to search for key words. It is a "proximity" value used to search for key words.

Using the flags by default, most of the results will be evaluated as confidence levels 2 (Known BIN) and 3 (Known BIN + key word).

Confidence levels 0 and 1 will appear if we use the flags --bin-length=0 and/or --paranoid.