msr90- Documentation & Code Examples for the MSR90 Magnetic Strip Card Reader 💳 |
| git clone git://git.acid.vegas/msr90.git |
| Log | Files | Refs | Archive | README | LICENSE |
README.md (8334B)
1 # MSR90 2 > A journey into learning about magnetic strip data in modern day cards 3 4 #### WORK IN PROGRESS 5 **Hardware:** [Deftun MSR90 3 Track Reader](https://www.amazon.com/MSR90-Magnetic-Credit-Reader-Deftun/dp/B01DUB4GVO/) 6 7 ## Legal Disclaimer 8 The information and code provided in this repository are intended for educational and research purposes only, focusing on magnetic stripe data security and the documentation of the MSR90 magnetic card reader. The author of this repository does not endorse or promote the use of this information for fraudulent or illegal activities. The content is provided "as is" without warranty of any kind, express or implied. Neither the author nor the contributors shall be held liable for any damages arising from the use of this information. Users are encouraged to comply with all applicable laws and regulations regarding magnetic stripe data usage. 9 10 ## Information 11 This repository serves as a personal exploration of magnetic stripe data as used in modern payment systems. The focus is on understanding the formatting of magnetic strip data, the mechanics of how systems interpret this data, and the associated security risks and vulnerabilities. 12 13 Despite the widespread use of magnetic stripe technology in financial transactions, there is a notable scarcity of accessible information and practical code examples on this topic. 14 15 Let's hope we don't get Banned 🤷 16 17 ###### Initial discover & observances 18 To my suprise, most of these card readers act as an HID that mimics a keyboard. Simply put, you swipe a card and it types the data out that is on the magnetic strip. Also to my suprise these work out of the box on Linux & Android systems. 19 20 ## Financial Cards 21 These follow the ISO/IEC 7813 standard which define the properties of financial transaction cards. 22 23 ### Track 1 24  25 26 Track 1 is written with code known as DEC SIXBIT plus odd parity. 27 28 It can contain up to 79 characters. 29 30 Most bank cards are using format B 31 32 ###### Additional un-common formats 33 | Format | Description | 34 | ------ | ----------------------------------------------- | 35 | A | Reserved for proprietary use of the card issuer | 36 | C-M | Reserved for use by ANSI Subcommittee X3B10 | 37 | N-Z | Available for use by individual card issuers | 38 39 ###### Example data 40 ``` 41 %B4815881002867896^YATES/EUGENE JOHN ^37829821000123456789? 42 %B4815881002861896^YATES/EUGENE L ^^^356858 00998000000? 43 ``` 44 45 ### Track 2 46  47 48 It can contain up to 40 characters. 49 50 ### Track 3 51  52 53 It can contain up to 107 characters *(same density as track 1 but has the same character encoding as track 2)* 54 55 Most cards do not even use a 3rd track, and is mostly un-used worldwide. 56 57 ### Service Code 58 ###### First digit 59 | Code | Description | 60 | ---- | ------------------------------------------------------------------------------------------ | 61 | 1 | International interchange OK | 62 | 2 | International interchange, use IC *(chip)* where feasible | 63 | 5 | National interchange only except under bilateral agreement | 64 | 6 | National interchange only except under bilateral agreement, use IC *(chip)* where feasible | 65 | 7 | No interchange except under bilateral agreement *(closed loop)* | 66 | 9 | Test | 67 68 ###### Second digit 69 | Code | Description | 70 | ---- | ---------------------------------------------------------------------------------------- | 71 | 0 | Normal | 72 | 2 | Contact issuer via online means | 73 | 4 | Contact issuer via online means except under bilateral agreement | 74 75 ###### Third digit 76 | Code | Description | 77 | ---- | ----------------------------------------------------------- | 78 | 0 | No restrictions, PIN required | 79 | 1 | No restrictions | 80 | 2 | Goods and services only *(no cash)* | 81 | 3 | ATM only, PIN required | 82 | 4 | Cash only | 83 | 5 | Goods and services only *(no cash)*, PIN required | 84 | 6 | No restrictions, use PIN where feasible | 85 | 7 | Goods and services only *(no cash)*, use PIN where feasible | 86 87 ### Major Industry Identifier *(MII)* 88 | Number | Description | 89 | ------ | ------------------------------------------------------------------------------------------------------------------------ | 90 | 0 | ISO/TC 68 and other industry assignments | 91 | 1 | Airlines | 92 | 2 | Airlines, financial and other future industry assignments | 93 | 3 | Travel and entertainment | 94 | 4 | Banking and financial | 95 | 5 | Banking and financial | 96 | 6 | Merchandising and banking/financial | 97 | 7 | Petroleum and other future industry assignments | 98 | 8 | Healthcare, telecommunications and other future industry assignments | 99 | 9 | For assignment by national standards bodies *(next 3 digits are [ISO 3166-1](https://en.wikipedia.org/wiki/ISO_3166-1))* | 100 101 ### Issuer Identification Number *(IIN)* 102 | Issuer | INN Range | PAN Digits | 103 | ------------------------- | -------------------------------- | ---------- | 104 | American Express | 34-37 | 15 | 105 | China Union Pay | 62 | 16-19 | 106 | Diners Club International | 36, 38, 39, 309, 300-3005 | 14 | 107 | Discover | 65, 644-649, 6011, 622126-622925 | 16, 19 | 108 | JCB | 3528-3589 | 16 | 109 | Maestro | 50, 56-69 | 12-19 | 110 | Mastercard | 51-55, 2221-2720 | 16 | 111 | RuPay | 607 | 16 | 112 | Visa | 4 | 12, 16, 19 | 113 114 ## Notes 115 The [Luhn Algorithm](https://en.wikipedia.org/wiki/Luhn_algorithm) or modulo-10 Algorithm *([example python code](./luhn_algo.py))* is used to determine the last digit of the account number, also known as the Check Number. 116 117 This number should be divisible by 10, hence "modulo-10" ;) 118 119 ## References 120 - [Digital Card](https://en.wikipedia.org/wiki/Digital_card) 121 - [Magnetic Stripe Card Standards](https://www.magtek.com/content/documentationfiles/d99800004.pdf) 122 - [ISO/IEC 7813](https://en.wikipedia.org/wiki/ISO/IEC_7813) 123 - [ISO/IEC 7812](https://en.wikipedia.org/wiki/ISO/IEC_7812) 124 ___ 125 126 ###### Mirrors for this repository: [acid.vegas](https://git.acid.vegas/msr90) • [SuperNETs](https://git.supernets.org/acidvegas/msr90) • [GitHub](https://github.com/acidvegas/msr90) • [GitLab](https://gitlab.com/acidvegas/msr90) • [Codeberg](https://codeberg.org/acidvegas/msr90)