15 for American Express. 14-16 for various kinds of Diner's Club. 16, 18, or 19 for Solo and Switch.
It would not have occurred to me that the number might even be in the raw data. Sounds like the supplier is violating PCI. (That doesn't apply if the supplier is the card company or issuing bank--PCI is just something they require others to follow. They hold themselves to a much lower standard).
It might be a useful heuristic for companies anywhere remotely in this space to use during early alpha/beta periods though. There aren't that many legitimate cases where you're going to be sending 14-to-19-digit numbers in HTML, so at least during the early phases, flag them and make sure they're not CC#s that somehow got there.
Comments
Hint for the future: if you're processing raw data that could include credit card #s, filter out 16-digit sequences as a whole.
15 for American Express. 14-16 for various kinds of Diner's Club. 16, 18, or 19 for Solo and Switch.
It would not have occurred to me that the number might even be in the raw data. Sounds like the supplier is violating PCI. (That doesn't apply if the supplier is the card company or issuing bank--PCI is just something they require others to follow. They hold themselves to a much lower standard).
It might be a useful heuristic for companies anywhere remotely in this space to use during early alpha/beta periods though. There aren't that many legitimate cases where you're going to be sending 14-to-19-digit numbers in HTML, so at least during the early phases, flag them and make sure they're not CC#s that somehow got there.