Use rust particles to reveal the data on your credit-card's magstripe

Discuss

35 Responses to “Use rust particles to reveal the data on your credit-card's magstripe”

  1. Dewi Morgan says:

    I’ve been having fun on his blog, decoding the Shoo!Tag’s data from the photos of the mag strip (kinda hamfistedly, but it’s fun anyway).

    I think I should point out that anyone planning to put pics of doing this on the net should beware. The photos can be decoded to get all the relevant details required to use your credit card for online transactions.

    So, use an old card, not your current credit card.

  2. Elmo Gearloose says:

    Sometimes those mag stripe cards can’t be read after a swipe through the reader.
    So the cashier will swipe the card faster which might work.
    But after a few unfruitful tries they would wrap the card in a plastic bag and swipe that through the machine. Most of the time that would be successful.

    Now why would those seemly wrong procedures work?

    • Antinous / Moderator says:

      When I first moved to the desert about ten years ago, I had a lot of problems with strips, frequently getting my card bagged. The problem seems to have resolved itself, because I have some cards that I use five or so times a week that have been working for three or four years. I think that they may have improved the strip integrity.

  3. anaglyph says:

    Oh, I should add: I wouldn’t advise trying this with a credit card you actually use. I don’t think it would make much difference, but it is possible that you might get some kind of erasure of the mag information with all that iron on it. To be safe, use an old card – the one in my experiment is three years old and still has its magnetic data intact.

  4. Clifton says:

    Antinous:
    Yes, the US as a whole is a technological backwater in this. Almost all of Europe went to smart cards 15 to 20 years ago. To greatly simplify, MasterCard was more advanced in smart card technology, so VISA used its leverage via the big banks sitting on both companies’ boards to kill the MasterCard smart card program, and that’s why the US is still using ’70s technology.

    Elmo:
    Good question. Because there is no independent sync signal on the track, the software reading the bits off the mag track has to self-synchronize to it and automatically adjust for the speed at which the card is slid past the read head. This is a lot harder if the speed is changing as the card slides past the mag head, perhaps changing in the middle of a symbol. It may seem counter-intuitive, but if the user slides it faster they’re more likely to slide it at nearly a constant speed, so it’s more likely the software will decode it correctly.

    I’ve never heard of the plastic bag trick, but if I had to guess, I’d guess that maybe the bag reduces the friction so the card slides more evenly. If that’s not it, I have no idea.

    • Chrs says:

      I was under the impression that it makes a tighter fit in the reader, which keeps the distance of the strip from either side more constant.

    • Itsumishi says:

      Europe still certainly has all the magnetic strip readers around. I had no trouble using my ol’ magnetic strip anywhere I visited in Europe in 2007.

  5. PorkyPrimate says:

    I came across a card this week that had a blue stripe on it. It was so close to the color of the plastic that at first I wasn’t sure there was a stripe to swipe.

    I’ve often had luck reading a reluctant card after several very vigorous rubbings on my shirt.

  6. AllyPally says:

    It’s been a long time since I saw a magnetic stripe on a credit card. Store loyalty cards, sometimes, though they tend to have barcodes instead. Credit cards, no.

    • Matt J says:

      Really? My card has a chip in it, but it also has a strip for fallback, if the shops phone connection is down or I’m in the US.

    • dculberson says:

      Maybe you’re confused by the color of the modern magnetic stripes? They’re not necessarily brown, but they’re still there. Every credit card I have, which is quite a few, has a magnetic stripe. Only a couple are brown, most are white, some are gray/etc. Just ’cause it’s not brown doesn’t mean it’s not a magnetic stripe. If you can swipe it in a card reader then it’s magnetic.

    • Antinous / Moderator says:

      My credit cards, bank card, health insurance card, AAA card and license all have magnetic strips. Is SoCal a technological backwater?

  7. mechko says:

    Really? where do you live? All my cards have magnetic strips, whether they have anything else or not. And I don’t think I’ve used the ‘anything else’ anywhere…

    I feel like I’m missing out on some really cool tech.

  8. Anonymous says:

    All my credit cards have mag stripes.

    However, they no longer require an obvious separate strip of dull oxide material on the surface of the card. That may be why you think yours don’t have one. They do usually have a stripe of color where the magstripe is, so folks know which edge and side to scan.

    I bet there’s not many here who remember what “face down, 9 edge leading” means. ;-)

    • Anonymous says:

      Face Down, 9 Edge leading? Want the box of cards that is behind my desk? (I use them as note paper/bookmarks)

  9. Anonymous says:

    Don’t forget it also contains the encrypted value of your pin as well, though most banks use the encrypted value stored in their servers, the original encrypted pin will be on your card in the mag-stripe as well. Useless without the key to decrypt it, but interesting.

    • Ito Kagehisa says:

      The Disney stores experimented with kiosk computers that could read credit cards. The card reader was a PS/2 keyboard wedge type card reader mounted from underneath with a couple screws. When the experiment failed they threw the machines into the dumpster. One man gathers what another man spills.

      You can plug it into a computer, open up a text editor, and read nearly any card – certainly all credit cards I’ve tried – but you have to plug a PS/2 keyboard on the female end because it won’t work otherwise. It’ll work with a USB-to-PS2 adapter but you still need a keyboard on the end (which looks funny on a laptop). I suppose I should’ve figured out how to jumper the thing so that I didn’t need a keyboard to use it, but honestly I got bored once I figured out how the system works and threw it in the parts bin.

      All the cards I’ve examined don’t encode anything, they either just have a lookup number for a db index or they have all your data in plaintext. I never saw any PINs on any of my cards, encrypted or otherwise.

  10. Elmo Gearloose says:

    I think it depends on the card reader rather than the card itself. My card works fine in most stores but not in certain ones. And besides, the cashiers with the defective machines show a familiarity with the card-bagging procedure.
    I’ll venture to guess that the card reader is crooked and that the bag reduces the amount of conflicting info somehow.

  11. Anonymous says:

    I remember a felonious friend awhile back saying that if you took the dust out of an Etch a Sketch, sprinkled it on the credit card strip and inserted that into a VCR it would display the credit card numbers for use. I was fairly dubious of this claim, and not having any criminal intentions never tried it. This article reminded me of that; anyone ever heard this story?

    • Ito Kagehisa says:

      I remember a felonious friend awhile back saying that if you took the dust out of an Etch a Sketch, sprinkled it on the credit card strip and inserted that into a VCR it would display the credit card numbers for use.

      Your friend’s highly misinformed! For starters, VCRs use helical scan – the tape to be read is spirally wrapped around a drum which contains read/write heads spun by a motor inside the drum so that signals are laid down in curved, angled “slices” across the tape width.

      See here: http://www.google.com/search?q=helical+scan

      How exactly would you wrap a credit card around the drum? Additionally, the (linearly encoded) credit card mag stripe is digital, while the (helically scanned) VCR tape is analog, so there is zero format compatibility.

      See here: http://en.wikipedia.org/wiki/VHS

      And finally, the use of etch-a-sketch dust… see here:

      http://entertainment.howstuffworks.com/question317.htm

      If you put any quantity of ultra-fine aluminum dust in your VCR you can forget about it ever working properly again. Whoever told this to your friend hated him… or maybe your “friend” hated you.

    • dmoisan says:

      I’m thinking of the way VCR heads work — sweeping the media at very high media-to-head speed to get the frequency response needed for video. And concluding: It’s all but impossible for any value of “seeing the digits on the card”

      Needless to say, numbers aren’t going to come up on the screen. So, one thinks, does it show a pattern like the one in this post on the screen?

      Not freaking likely; the video signal is encoded on a carrier so that the VCR heads aren’t trying to encode the full band from 0 Hz to 4.5 MHz; it’s impossible, so they don’t try, instead the luma (Y) and chroma are separated and modulated so they fit in the bandwidth available to the head/tape system.

      The magstripe is a very low frequency system, that much is obvious if you can decode the stripes by eye.

      Well below what the rotary heads are designed to decode.

      But nothing’s stopping one from getting one of the multitudes of junk VCR’s for free, bypassing the sensors to make it run without a tape, and bending a junk magstripe card against the head. If it even almost worked it’d be in the wild already.

  12. Dewi Morgan says:

    A bag might also affect how deep into the slot the card goes – only by the tiniest fraction of an inch, but possibly that’s enough to get the head aligned with a moer readable bit of track?

    I prefer the other ideas suggested, though: they seem more likely.

  13. Chentzilla says:

    Will metal non-rusted filings also work?

    • anaglyph says:

      Finely ground iron filings will work, or iron powder. I used rust because it’s really easy to crush, is highly visible in photos and I had a big metal pan of it to hand. And for the peeps who wrote about ‘tape developer’ – yes, that was where I got the idea. I used to use it when I worked in a tv station back in the early 1980s. Unfortunately it seems to be a pretty rare item these days.

      I live in Australia and pretty much ALL our credit cards, debit cards and so forth have magnetic stripes. The one that you see above is actually a Virgin Frequent Flyer Card. I can understand how people might think it’s primitive. I’m still flabbergasted that these cards are in use.

    • arikol says:

      Should do so if the are ferrous (contain iron and are magnetic). Just remember that aluminium filings, copper etc. won’t work.
      I would think that the rust particles would just be easier to see…

      Maybe I’m off the mark on this one.

      Anyone?

  14. Anonymous says:

    There is evidence of a “tri-vector” encoding in there. All ‘tri-vector’ means is that it must have three separate vectors traced on it before it can read it all. Realistically, it’s easiest to use a single motion, so in this case there’s three separate bands of data.

    If you look at the top stripe (the part that looks almost, but not quite, like line noise), there’s many smaller vertical lines. If you look at the bottom line, it looks much more like white noise, but if you look at the center of the photo and don’t have blurry vision, then look at the bottom line directly down from there, you can see vertical bars in the iron dust there as well.

    All in all, very cool. I have an expired credit card that I can try this on. :)

  15. Christovir says:

    I’m not an expert, but I agree – any magnetic filing should work, but I suspect rust is used because it is 1)easily visible 2)comparatively light weight, hence easier to attract to the swipe 3)easier to make the filings small enough at home.

  16. dreamfish says:

    Now we have the opportunity to see if magnetic strips contain one or more sequences of ’666′ – thus proving the mark of the beast is forced on everyone!

  17. wrwetzel says:

    In the late 1960′s, while designing tape drive interfaces, I used a material known as “Tape Developer” to reveal the magnetic patterns recorded on tape to help debug the controller. The developer consisted of iron or iron oxide powder mixed in a fast-drying solvent, likely Freon. When applied to tape it was quite easy to see the recorded data visually. Of course the densities then were in the few-hundred of bits-per-inch range.

    For my Christmas card one year I wrote a program that spelled “Merry Christmas” on the tape. I developed it, lifted the image with a piece of scotch tape, and stuck it to an IBM card (i.e. punched card). Now that was a really nerdy Christmas.

    Bill

  18. Anonymous says:

    I hope the picture doesn’t depict a current/valid Credit/Debit card!

  19. Ito Kagehisa says:

    To do this easily and repeatedly without leaving residue on the card, try a sight glass of the sort we used to use to read 9-track computer tapes. This was a polished metal ring, like a bearing race, that held two thin rounds of glass like monocles, between which was a bunch of fine iron powder. I think they might have been vacuum sealed, or maybe argon filled, to keep the dust black. Anyway, you’d unroll a magtape on your lab bench, and slide the sight glass onto it, then tap the side of the ring a few times and the iron dust would make bit patterns somewhat reminiscent of the ones in the picture Cory posted. You’d record the blocks on graph paper, then slide the glass over a bit, then tap it some more, ad infinitum. Afterwards you could decode it – as long as the tape was 800 or 1600 bpi, once the speeds went above 1600 bits per inch it was no longer possible.

    • dmoisan says:

      Toy stores used to sell things like these! I had one. Square, filled with oil and filings. Makes spikes when you put magnets against it. If you’ve seen those dynamic ferrofluid movies it’s very much the same only 2D.

      Mine was lost long ago sadly.

  20. Clifton says:

    wrwetzel:
    We were using similar stuff in the credit card terminal development industry in the ’80s. This is notable as a neat DIY way to get the same result; who hasn’t got something rusty around?

    Bonus nerdy info:
    These tracks are such low density because the formats were originally developed in the 1970s based on magnetic tape, and the content and format have been standardized ever since. It also makes readers very cheap to build.

    Track 1 is the IATA track – this is the alphanumeric one which includes your name. That’s what the airlines use on the electronic check-in kiosks to look up your reservations when you insert your credit card; if a cashier greets you by name after you pay with your card, that’s probably also where they’re getting it from.

    Track 2, the very very low density one, is standardized by the ABA and is just your card number in a 5-bit code, a couple digits specifying its processing, and usually either the 3-4 digit CVV code from the back of your card or some kind of verification hash on your PIN, plus a parity character. Any payment application reads this track.
    Track 3 was standardized by the thrift industry (S&Ls) and is similar data density and content to track 1, in a different format, but I don’t remember the details and I’m too lazy to look it up. Most applications just read the first two tracks.

    To give an idea how low-density track 1 is, if you slide the card past a standard mag reader head, you can decode the data purely in software on a 5MHz 8 bit CPU.

    Wikipedia for more info: http://en.wikipedia.org/wiki/Magnetic_stripe_card#The_magnetic_stripe

  21. Clifton says:

    P.S. The last paragraph should have read “how low-density track 2 is” – I can’t remember if we could read track 1 via bit-banged IO but we definitely did track 2 that way.

  22. Jeff says:

    Tape “developer” was critical in the earliest days of videotape, when video was edited by cutting and splicing the tape. In order to cut the tape between video tracks to ensure that the picture wouldn’t lose sync and break up at the edit point, developer was brushed on the tape, which the editor looked at under a microscope to find the precise edit point. Check out this YouTube:

    http://www.youtube.com/watch?v=7YtmwB9Ds5Y

    This method was used until at least the late 1960s.

Leave a Reply