Posted September 07, 2015
hedwards: More likely they just store the transaction ID or something similar. It's basically useless as a way of getting the original CC number, but if they need to give a refund or keep track of sales, they can use that. The CC processor is the only party that's going to be able to turn that ID into a CC number and honestly, why would they even bother? They already have that.
toxicTom: They seem to have at least the last four numbers: http://www.gog.com/forum/general/known_scammers_mach_two/post91 See Wishbone's post above, too.
There's any number of ways in which they can take 4 digits to verify against the ID that the processor gave them without needing to know the rest of the number.
Considering that Mastercard and Visa have forced American issuers to include a chip on the cards, I doubt that the processors are requiring people to store the whole number just to verify that the card is the same one that was used to make the original purchase.
EDIT: Probably the easiest way of handling it is to hash all but the last 4 of the card and then hash that along with the last four in order to generate an ID. It's possible to break that, but the likelihood is rather slim and it doesn't take much processing power to do that.
Post edited September 07, 2015 by hedwards