Loading page
About this tool
What to do when a card number leaks without CVV or expiry: kill the number, check pending charges for card-testing, and score how much worse it gets if more leaked with it.
The Card Number Exposure Checklist is for the specific case of a leaked card number without the CVV or expiry date — a lower-risk exposure than a full card dump, but not a harmless one. It scores two things: how far through the 16-step response you are, weighted towards killing the old number before card-testing scripts find it, and how much worse the leak gets if the dump also included the CVV, expiry, PIN or other identity fields. Unlike a home address or a date of birth, a card number can be rotated, and getting the issuer to reissue a genuinely new number — not just a new expiry on the same digits — is the single step that fully closes the leak.
Open Card Number Exposure Checklist on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
Distinguishes a leaked number alone from a full card number plus CVV and expiry, which needs a faster, harder response.
Reporting the card compromised and confirming the replacement has a different number outweigh clean-up tasks, and missing either caps the score.
You never type your actual card number — you tick which categories leaked, and nothing leaves the browser.
Less dangerous than a full card dump, but not safe. A bare number still passes the Luhn checksum, reveals your issuing bank through its first six to eight digits, and can be run through card-testing scripts against merchants that accept CVV-optional or recurring stored-card charges. Reissue it rather than assuming it is unusable.
Watch pending authorisations, not just settled transactions. Card-testing typically shows up as one or more small, oddly specific charges — sometimes under a dollar or a few units of local currency — used to confirm a number and any guessed CVV or expiry work before a larger charge follows.
It depends how you report it. A routine "lost or damaged card" replacement or an expiry-date renewal sometimes keeps the same underlying number. Telling the issuer the number was exposed in a breach gets it treated as compromised, which normally triggers a full number change, not just a new physical card.
Generally no, if you report it promptly. Visa's and Mastercard's zero-liability policies, and most card-issuer terms, cover unauthorised transactions you report in good time. This is general information, not legal advice — check your specific card's terms, and involve your bank immediately if a charge you did not make has already posted.