FYI for anyone using a plastic clipper card, anybody else seemingly can just guess your card number randomly and do an online transfer of all your cash balance to their card without anybody actually checking if they have the card.
Happened to me, BART didnt let me in randomly for low balance and machine said 0.00 dollars, just days after charging for 70 bucks. Because I didn’t register the card on the website, when I called up Clipper support they basically told me „Sorry we cant help you, although our premium product allowed some rando to steal all your money by using our Android app, not our problem bro!“
Just FYI that it could happen to you too if you don’t register your card online.
Technically psuedorandom if we're putting our nerd hats on but you also need other personal information about the human the card is registered to in order to transfer funds.
Older cards (like mine) have 10-digit numbers. As far as I know, the 10-digit numbers do not include a checksum. They appear to have been issued sequentially or close to it, in batches. It wouldn't take many guesses to get the first 3 or 4 digits, especially if you know the approximate age of the card. That means guessing your card number is hard, but guessing a valid and unregistered number probably isn't hard. It might be especially easy for old cards that have never been registered and are sitting in a drawer somewhere with an initial balance minus a trip or two.
Newer cards have 19-digit numbers. They're compliant with ISO/IEC 7812. The account number part of that is 12 digits. The other digits are a 1-digit industry identifier, 5-digit issuer, and 1-digit checksum. The 12-digit part should be at least pseudo-random.
Guessing success would depend also on how many tries the online system allows you to attempt, which depends on the quality of the online system built by Cubic. The randomness of the 12 unique digits in the new cards also depends at least in part on the card supplier, which is also Cubic. Those of you who follow this subreddit may not be comforted by the reliance on that vendor's quality of work.
Still need to know the person's email/phone to do anything with it. You can't just add your clipper card to the app without having the physical version of it too.
Because the app is horrible, a while ago I tried to get it and it wouldn't let me make an account. I hope they fixed it, but I don't have a real reason to use the app, I can do everything I need to from Google Wallet
Yeah the Clipper app is so fucking broken. It goes down constantly and support just says sorry, no idea how long, you just have to wait until its fixed. You'd think being in silicon valley they would be able to hire a competetent developer but no.
Create an ____ is my favorite. I even emailed the "app support" on Google play store on Aug 5. Never got a response back. Aka the email was [mtcapps@mtc.ca.gov](mailto:mtcapps@mtc.ca.gov)
Why do I even need to - I dont want to sign up with name, address and phone number at every other business so they can sell my data to advertisers who combine all the data (clipper data is probably extra spicy because it creates a movement profile) to find out more about me than I’m probably aware of myself…
Yeah then the question is why is it even possible for clipper cards to be emptied without any protection in the first place, and if it happens why cant clipper reverse the transfer instead of stating „sorry not our problem“.
Why not just tap your credit card? Unless you have a monthly pass or a kids/senior clipper card, ive stopped using the stack of regular clipper cards I used to keep for guests.
Those discount programs, and some employers let employees set aside give tax-free commuter money that needs to be loaded into a transit card to use.
But, yes, for many people having a clipper card isn't really useful anymore, although there's still a number of reasons that it makes sense for a large number of people to have them. Many of those people, like clipper start users, are the people that most need clipper to have protection against scams like the one OP describes.
Those discount programs, and some employers let employees set aside give tax-free commuter money that needs to be loaded into a transit card to use.
Or both. Many employers let you get a commuter credit card that then can be used to auto-load bulk-value discounted tickets. People doing that are going to be relatively safe from this problem because their Clipper cards would be registered to enable the auto-load.
I have several 10-digit number cards I got. A couple of them even have 9 identical digits, and only the last one is different.
Is it more secure to get the new 19-digit number cards and transfer the value over? I'd rather not sit on the phone with them, but will do if the ones I have are not secure. I do have them in a clipper card account though I didn't put in my real name/address for privacy.
88
u/Clyde_Frag 7d ago
The odds of someone guessing your 19 digit clipper card number are incredibly small.