Consumer advocates have always advised the public to cut expired credit cards in half so they could not be used for fraudulent purposes by a garbage-picking crook. Following that conventional wisdom, however, is no safeguard that your full credit card number will not be stolen and used.

Here is the left half of an expired American Express card:

With only half the number showing, even an enterprising crook could not use it to make a purchase. However, that is only one side of the story, so to speak. Turn over that half of the card:

*MOUSE PRINT:

The back side of the card reveals a small engraved number that represents the second half of the card number. (The leading “7” duplicates the last number visible on the front of the card.) And, note to crooks, the number on the reverse side has been altered so as not to jeopardize the real credit card number.

With the full credit card number visible, as well as the cardholder’s name, a clever crook could surmise the expiration date from the portion showing, and could potentially use the card to make online purchases. (Amex’s four digit security code, however, is not visible, and should a retail website ask for that information, this card would be rejected.)

When asked to comment on this security issue, and in particular why they issue cards with such an obvious security flaw and whether they were going to change the card’s design, a spokesperson for American Express responded in relevant part:

“I’m following up to let you know that we take the security of our cardmembers’ information, as well as fraud prevention, very seriously and have a number of sophisticated monitoring systems and controls in place to detect fraudulent card activity. We are constantly evolving these techniques to adapt to the changing activities of fraudsters.

We have learned that the best way to approach fraud prevention is from a holistic perspective. This means preventing fraud both on the consumer and merchant side of the transaction, looking at physical features of the Card as well as security information only the true Cardmember would know about the account. I cannot discuss specifics on this since the techniques would no longer be effective if we made them public.

One suggestion is for cardmembers to protect their personal and account information by shredding documents or cards before discarding them.” –Manager, Public Affairs & Communications | Risk, Information Management & Banking Group

Lest you think this is only an American Express issue, it is not. Below is the left half a Washington Mutual Visa card, front and back. The full credit card number is visible when putting the numbers found on the front and back of just that half together, as is the customer’s name and the security code. The expiration date can be discerned with a little guessing.

*MOUSE PRINT:

A spokesperson for Chase, which took over Washington Mutual said:

“Chase only prints the last four digits of the customer account number on the back of the plastic. So, as WaMu accounts convert to Chase, the plastics will follow this specification.”

This is not a new problem.  It does not affect all card issuers by any means, and not all cards of the above issuers are affected.  The practice of printing the full account number on the reverse side of credit cards has been going on for a long time, as this was a problem first noticed with some MasterCards about 15 years ago.

Does your card have all 15 or 16 digits of credit card number printed on the back?

The lesson here is to not merely cut your old, expired cards in half when disposing of them, but to shred them.  If you don’t have a shredder, just cut the card in a number of small pieces, and throw them away in separate garbage bags.