Discretionary data from magnetic strip credit card, how to parse?

Question

according to wiki, the Discretionary data —

may include Pin Verification Key Indicator (PVKI, 1 character), PIN Verification Value (PVV, 4 characters), Card Verification Value or Card Verification Code (CVV or CVC, 3 characters)

This means that it's not guaranteed that I would always be able to get the CVC, which is a problem for me. I was able to use an existing implementation to parse my credit card stripe and got a bunch of numbers for the discrepdata. I'm not sure exactly how to interpret exactly. Since its more than 8 chars and does not match my cvc, or pin number.

It looks like(numbers are random, but the padded 0's are the same): 0000031200100

What does this mean?

Slave

Answer 1

You shouldn't use the discretionary data. It is (as it's name implies) entirely optional. Some card schemes simply don't use it at all, and within the schemes that do allow it, most card issuers do not use it. Where it is used you'll find differences in how it is populated, both between card schemes and potentially between card issuers.

Further, the CVC that is on the mag stripe is actually a CVC1 code, which only attempts to verify that the mag stripe details have not been tampered/corrupted. It is not the same as the CVC code printed onto the back of the card.

The CVC that is printed onto the card is (by design) intended to be viewed with eyes only.

Polyglot

The CVC1 is used to check for tampering/corruption of the data like a checksum, but it is also an additional security mechanism so someone cannot make a purchase online but only within a store or vice versa. Stop me if I am wrong but I think it is not possible to create a CVC1 using just card data as we do not know how the card companies' algorithm works? – Downtime

Answer 2

You answered your own question there at the end of your inquiry. So anybody with knowledge of the PVKI & Algorithm used by the bank can then create a cloned card and use for "Credit Only" transactions. Since the ATM pin code is not in the track data you can't withdrawl funds unless you also have the pin code. Even then there are still ATMs in use that will accept any pin code if you adjust the discretionary data accordingly.

Manxman