Credit Card Expiration Date Ignored by Banks?

[barneda]

We've just recently established a connection from our Shopping Cart app to our merchant account, using VeriSign Payflow Pro.

In testing, I found the following scenario: If I use a valid credit card number, but specify an incorrect expiration date, it still is "approved" through the financial networks!

I called VeriSign, and also our merchant account bank, and asked them why. Both of them told me that as long as the date is in the future (i.e. not in the past, meaning the card expired), most card issuing banks will "approve" the transaction even though the card expiration date does not match what is on your card.

Have others found this to be the case? I was so amazed by this, that I proceeded to order a product from a well-known catalog site, using my valid credit card number... and an incorrect expiration date, and it was approved!

Can anybody out there with more experience than me in eCommerce shed some light on this?? What's the point of asking for expiration date if it's not checked?

By the way... we also do AVS (address verification system) check, which works fine.

thanks,

 

[foxdev]

Wow, what an eye-opener.

I just tried an American Express card in my Authorize.Net virtual terminal using an incorrect expiration, and it was approved!

I am indeed amazed. You realize what this means, right? It means that anyone who sees your credit card number - such as people who handle your check to the credit card companies where you write your "account number" on the memo line - can then use that number and make up an expiration date to make an online purchase! --------------
Low Cost Prints:

http://www.lowcostprints.com

 

[barneda]

Wow... so it's not just me.

I am dumb-founded. I always thought my card number was relatively "safe" because it would be useless without the expiration date.

I'll be curious to see if anybody else has experiences they can post.

I can't understand why the banks don't check the expiration date? One of my colleagues jokingly said "they probably used to check the date before Y2K, but when Y2K came they couldn't figure out how to handle the 4-digit year, so they just stopped checking the expiration date"!

Makes you wonder...