Visa CardType providing invalid format Cards

[cbattlegear]

Version Information

Software	Version(s)
Bogus NuGet Package	30.0.1-beta-3
.NET Core?	3.1
.NET Full Framework?
Windows OS?	10
Linux OS?
Visual Studio?	2019

What locale are you using with Bogus?

EN

What is the expected behavior?

Generating a Valid Visa credit card

What is the actual behavior?

50/50 shot of an invalid 13 digit card number

Any possible solutions?

Change line: https://github.com/bchavez/Bogus/blob/master/Source/Bogus/data/en.locale.json#L10266 to "4##############L" or remove it all together

How do you reproduce the issue?

Generate a CardType.Visa Credit card more than a few times

Do you have a unit test that can demonstrate the bug?

The current unit test should fail

Can you identify the location in Bogus' source code where the problem exists?

https://github.com/bchavez/Bogus/blob/master/Source/Bogus/data/en.locale.json#L10266

If the bug is confirmed, would you be willing to submit a PR?

Yes / No (Help can be provided if you need assistance submitting a PR)

[bchavez]

Hi Cameron,

Thank you for posting an issue. A few more questions: What is invalid about the 13 digit Visa number? Is the problem that Bogus generated a 13 digit card number for Visa? Or is the checksum digit wrong?

From the looks of it, it seems that a 13 digit card number can be a valid length for a Visa credit card number.

[cbattlegear]

I was going based on the Wikipedia entry which shows only 16 digits as valid: https://en.wikipedia.org/wiki/Payment_card_number

Also based on Faker changing it to "Retired Visa" fzaninotto/Faker#1400

[bchavez]

Hi Cameron,

Thank you very much for the links; they helped a lot. I was looking at the Wikipedia link and this caught my eye:

While the vast majority of Visa's account ranges describe 16 digit card numbers there are still a few account ranges (forty as of 11 December 2013) dedicated to 13 digit PANs and several (439 as of 11 Dec. 2013) account ranges where the issuer can mix 13 and 16 digit card numbers. Visa's VPay brand can specify PAN lengths from 13 to 19 digits and so card numbers of more than 16 digits are now being seen.

---

Searching for Visa's test plan for credit card acceptance devices we find traces of PAN lengths:

Visa Transaction Acceptance Device Guide - Version 3.0 - May 15 2015

https://technologypartner.visa.com/download.aspx?id=32

Visa Transaction Acceptance Device Guide - Version 3.2 - January 2020

https://technologypartner.visa.com/Download.aspx?id=573

From the information I gathered, it seems that a system accepting Visa should allow 13 digit PANs.

As a result of the findings above, I'm inclined to keep the current codebase as-is. However, if others start making the same requests I'm open to changing it in the future.

Workaround

If you'd like a workaround for the issue; you can generate 16 digit PANs for Visa as shown below:

• Note: for this code to work, update to Bogus v30.0.1-beta-4. I opened up the .CheckDigit() extensions methods to public.

using Bogus.Extensions.Extras

void Main()
{
   var f = new Faker();
   f.Finance.Visa16Digit().Dump();
}

public static class ExtensionsForFinance
{
   public static string Visa16Digit(this Bogus.DataSets.Finance finance)
   {
      const string format = "4##############";
      return finance.Random.ReplaceNumbers(format).AppendCheckDigit();
   }
}

https://www.freeformatter.com/credit-card-number-generator-validator.html

Let me know your thoughts.

Thanks,
Brian

[cbattlegear]

Nice, from what I can tell this should work from a solid workaround standpoint while still providing backwards compatibility to the older versions.

Thanks for the information!

[bchavez]

Thank you for your feedback and for raising the issue, Cameron.

I'll keep an eye on this issue and if we find more people looking for 16 digit-only Visa numbers, we'll consider making the change. I like to wait until we get more hits on a particular issue before we start making changes to the API and diverging from faker.js.

Also, leveraging C# extension methods on the DataSets or the Faker object is a great way to customize generated data to tailor fit a particular scenario.

Thanks again for posting the issue.