4

Trying to settle an office argument on a challenging probability scenario, thought I'd see if anyone would like to take a stab:

We're trying to determine the probability of 2 credit cards matching amongst a global population given that only the first six and last four digits are known. We also know the expiry date. A couple of rules for each field:

First six: We're working strictly with a single card issuer who's range of first six digits is between 222100-272099 or 510000-559999. For simplicity this allows for 100,000 possible combinations.

Last four: These for simplicity can be assumed to be completely random. (ignoring Luhn checks)

Expiry date: Only valid future dates within a four year time frame.

What's the probability of 2 cards in the entire population being the same?

So far our best theory by breaking this down into parts is:

  1. A = There are 100,000 combinations of the first 6 digits.

  2. B = There are 10,000 combinations of the last 4 digits

  3. C = There are 48 combinations of the date field.

We are looking for the number of clashes in the population. For simplicity we've assumed a population of 1 billion. So we are assuming ultimately that there will be 1 billion events and are looking for the probability of getting 2 identical outcomes from those events:

A * B * C = 1,000,000,000x
1/100,000 * 1/10,000 * 1/48 = 1,000,000,000x
x = 1/48

So the theory is that there is a 1/48 chance of there being a single clash in 1bn cards.

contool
  • 141

1 Answers1

3

Your calculation $A \times B \times C = 10^9x$ is not really relevant here. The result $x = 1/48$ is (a very close approximation of) the probability that a given person has a clash with someone else. But there are 1 billion people!

Your problem falls under the birthday paradox, which means the number of clashes you'll find is much bigger than is intuitive to most people. Even without doing the calculation exactly, you can ascertain that the probability of no clash is almost 0. To see this, suppose first that 900 million credit card numbers were handed out without a clash. (That's already astronomically unlikely actually, but let's pretend that that has already happened). Then there are 100 million people left who still need a credit card number. If you pick these randomly, per person, just the probability that they'll match one of the numbers already handed out is, very conservatively, greater than 1/100. Which means that the probability that none of them clash is at the very, very most $$ (1 - 1/100)^{10^8} = (99/100)^{10^8} \approx 2.8824 \times 10^{-436481}. $$ That is, the probability of no clash is at most a zero, followed by a decimal point, followed by over 400,000 zeroes, followed by the first non-zero number.

And again, this is still a really, really gross overestimation.

Mees de Vries
  • 26,947
  • 1
    Thanks for the answer Mees. It's a very valid approach. The argument on our side stems from the nature of credit cards and the difficulty in framing the question within acceptable rules. Take your 900m pool with 100m further events. We can assume that all 100m events will differ from the 900m because of the nature of the expiry date i.e. all 100 will have an exp at >= 4 years where the 900 will be < 4yrs. So the addition of the extra field is very important. Also, where did you get the ^10^8? – contool Sep 25 '18 at 11:24
  • 1
    @contool, the division into 900m and 100m is not temporal, it's conceptual. You just randomly divide the population into the two groups, assuming that there is no clash in the first group and reasoning about the second. – Mees de Vries Sep 25 '18 at 11:35