CC Dumps: What They Are and How Magnetic Stripe Data Works

A credit card dump is data extracted from a payment card's magnetic stripe, which contains three tracks, though only Track 1 and Track 2 are actively used in processing[1]. Track 1 holds the cardholder name and account number, while Track 2 holds numeric data used for most ATM and POS transactions[1][2].

What Data a CC Dump Actually Contains

A credit card dump is data extracted from a payment card's magnetic stripe. Magnetic stripe payment cards are divided into three tracks of data, but only Track 1 and Track 2 are actively used in payment card processing, with Track 3 rarely used and sometimes absent[1]. Track 1 and Track 2 each hold the primary account number, expiration date, service code, and discretionary data, but they differ in encoding and practical use. Understanding the structure of these tracks clarifies what a dump file can and cannot do when used to clone a card or analyse compromised payment data.

Track 1 Structure and Contents

Track 1 data begins with a start sentinel of "%", includes a format code of "B" for credit/debit cards, the primary account number (PAN) of up to 19 digits, the cardholder name, a four-digit expiration date in YYMM format, a three-digit service code, discretionary data, and ends with a "?" sentinel[1]. The expiration date in Track 1 is always encoded in the four-digit YYMM format, such that a card expiring in December 2027 would be encoded as 2712[1]. Track 1 uses alphanumeric encoding, so it can store letters, numbers, and punctuation, including the cardholder's full name as it appears on the card[1]. Discretionary data on Track 1 is determined by the card issuer and may include the Card Code and/or PINs[1].

Track 2 Structure and Contents

Track 2 data begins with a start sentinel of ";", contains the PAN, a field separator of "=", the four-digit YYMM expiration date, a three-digit service code, discretionary data, and an end sentinel of "?", and cannot exceed 40 characters total including sentinels and the LRC[1]. Track 2 is the ABA (American Bankers Association) track and is the most commonly used track for ATM and POS transactions, containing only numeric data[2]. Track 2 data is restricted to a maximum of 37 characters of actual data, or 40 characters counting the sentinels and the LRC, which limits the length of discretionary data to fairly short values[1]. The service code in Track 2 is a three-digit field that indicates what types of charges can be accepted on the card[1].

Why Both Tracks Matter

Most card readers are able to read both Track 1 and Track 2 data so that processing can continue if one of the tracks has become unreadable[1]. This redundancy means that a dump containing both tracks is more reliable for cloning: if Track 2 is damaged or poorly encoded on the counterfeit card, the terminal can switch to Track 1 without declining the transaction. A "Track 2 only" dump lacks the cardholder name, so merchants that verify the name against a signature or identification document may reject the transaction. A "Track 1 + Track 2" dump provides both alphanumeric and numeric data, increasing the likelihood that automated and manual checks will pass.

For security professionals analysing compromised data, the presence of both tracks suggests the attacker captured the full magnetic stripe, either through a physical skimmer or malware that reads the entire stripe during a transaction. Dumps with only Track 2 indicate the attacker had access to the numeric track alone, which is sufficient for most automated POS and ATM transactions but omits the cardholder name field.

Understanding Service Codes and Discretionary Data

The service code in both Track 1 and Track 2 is a three-digit field that indicates what types of charges can be accepted on the card[1]. Each digit conveys a specific restriction or capability: the first digit defines the card's international or domestic authorisation scope, the second specifies whether the card has EMV chip capability and what authorisation method is required, and the third sets PIN and other usage restrictions. A security professional analysing a dump can use the service code to predict where and how the cloned card will work. A code permitting international use and signature-only transactions offers broader usability than one restricted to domestic chip-and-PIN terminals.

Discretionary data on both Track 1 and Track 2 is determined by the card issuer and may include the Card Code and/or PINs[1]. Issuers use this field to store internal identifiers or verification values that supplement the primary account number and expiration date. Track 1's alphanumeric encoding allows longer discretionary strings, whereas Track 2 is restricted to a maximum of 37 characters of actual data, or 40 characters counting the sentinels and the LRC, which limits the length of discretionary data to fairly short values[1]. This constraint means that issuers cannot embed extended cryptographic tokens or long verification sequences in Track 2. Cards requiring such data must place it in Track 1 or rely on EMV chip authentication instead.

Role of the LRC Character

The Longitude Redundancy Check character at the end of each track is used to verify that the track was read accurately, and most reader devices do not return this value to the presentation layer, using it only internally for verification[3]. A dump file that omits the LRC is not incomplete, because the LRC is a check digit consumed by the reader hardware, not a data field exposed to payment applications or transaction logs. When a terminal reads a magnetic stripe, it calculates an expected LRC from the track data and compares it to the recorded LRC; if they match, the read is accepted, otherwise the terminal prompts the user to swipe again or switches to the redundant track.

For fraud investigators, the absence of the LRC in a dump listing does not indicate data corruption. The LRC is an internal integrity check that the reader applies before passing the track contents to the authorisation system. Dumps circulated on card shops typically exclude the LRC because it serves no purpose once the data has been extracted and verified.

Track 1 vs Track 2: Technical Differences

Track 1 and Track 2 both carry the primary account number, expiration date, service code, and discretionary data, but they differ in encoding, length, and practical use. Track 1 data begins with a start sentinel of "%" and includes a format code of "B" for credit/debit cards, the PAN of up to 19 digits, the cardholder name, a four-digit expiration date in YYMM format, a three-digit service code, discretionary data, and ends with a "?" sentinel[1]. Track 2 data begins with a start sentinel of ";", contains the PAN, a field separator of "=", the four-digit YYMM expiration date, a three-digit service code, discretionary data, and an end sentinel of "?", and cannot exceed 40 characters total including sentinels and the LRC[1]. Track 2 is the ABA (American Bankers Association) track and is the most commonly used track for ATM and POS transactions, containing only numeric data[2].

Character Set and Length Constraints

Track 1 uses alphanumeric encoding, allowing letters, numbers, and punctuation, which is necessary to store the cardholder's full name as it appears on the card[1]. Track 2 contains only numeric data[2]. Track 2 data is restricted to a maximum of 37 characters of actual data, or 40 characters counting the sentinels and the LRC, which limits the length of discretionary data to fairly short values[1]. Track 1 has no such strict limit, so issuers can place longer discretionary strings or additional verification values in Track 1 without running out of space. This difference matters when analysing dumps: a Track 2 dump cannot hold extended metadata or cryptographic tokens that exceed the 37-character boundary, whereas Track 1 can accommodate them.

Redundancy and Practical Use

Most card readers are able to read both Track 1 and Track 2 data so that processing can continue if one of the tracks has become unreadable[1]. This redundancy ensures that a damaged or poorly encoded track does not automatically decline the transaction. A dump containing both tracks is more reliable for cloning, because the terminal can switch to the undamaged track without prompting the user to swipe again. A "Track 2 only" dump lacks the cardholder name, which some merchants verify against a signature or identification document. A "Track 1 + Track 2" dump provides both the alphanumeric name field and the numeric ABA track, increasing the likelihood that automated and manual checks will pass.

For payment system developers, the dual-track design reflects a legacy compromise: Track 1 was defined by the International Air Transport Association for airline ticketing and includes the name field, while Track 2 was standardised by the American Bankers Association for financial transactions and prioritises brevity and numeric encoding[2]. Modern terminals read both tracks to maximise compatibility with cards issued under either standard.

Typical Mistakes and Misconceptions

Confusing dumps with CVV and fullz

A dump is data extracted from a payment card's magnetic stripe, not a bundle of card number, expiry, and CVV. Track 1 and Track 2 contain the PAN, expiry in YYMM format, service code, and discretionary data, with Track 1 also holding the cardholder name[1]. A CVV is a separate three- or four-digit verification value, and fullz typically adds personal identity details such as address or date of birth. Treating these as interchangeable leads to wrong assumptions about what a seller is actually offering.

Assuming Track 3 is part of every dump

Magnetic stripe cards are divided into three tracks, but only Track 1 and Track 2 are actively used in payment card processing[1]. Track 3 is rarely used and sometimes absent, so a dump advertised as "complete" does not need to include Track 3 data. Buyers who expect all three tracks may reject valid listings or pay extra for data that has no functional role in most transactions.

Expecting the LRC to appear in dump files

Each track ends with a Longitude Redundancy Check character that verifies accurate reading[3]. Most reader devices use this value only internally and do not return it to the presentation layer[3]. A dump file that lacks the LRC is not incomplete, because the LRC is a check digit consumed by the reader, not a data field exposed to applications.

Believing Track 2 can carry extensive discretionary data

Track 2 is restricted to 37 characters of actual data, or 40 characters counting the sentinels and the LRC[1]. This limit constrains the length of discretionary data to fairly short values[1]. Claims that a Track 2 dump contains long issuer metadata or embedded PIN blocks contradict the documented structure.

Overlooking the service code when assessing where a cloned card works

The service code in both Track 1 and Track 2 is a three-digit field that indicates what types of charges can be accepted on the card[1]. A dump with a service code restricting transactions to domestic use or requiring PIN will not work in the same scenarios as one allowing international or signature-based transactions. Ignoring this field leads to overestimating the usability of a given dump.

Assuming Track 1 and Track 2 are redundant copies

Most card readers can read both tracks so processing can continue if one becomes unreadable[1]. This does not mean the tracks are identical. Track 1 holds alphanumeric data including the cardholder name, while Track 2 is numeric-only and is the ABA track most commonly used for ATM and POS transactions[1][2]. A Track 2 dump alone may lack the cardholder name that some merchants verify, so "Track 2 only" is not always equivalent to "Track 1 + Track 2".

Conclusions

• A credit card dump contains Track 1 and Track 2 magnetic stripe data, while Track 3 is rarely used and sometimes absent[1].
• Track 1 holds alphanumeric data including the cardholder name, PAN, expiry in YYMM format, service code, and discretionary data[1].
• Track 2 is numeric-only, limited to 37 characters of actual data, and is the ABA track most commonly used for ATM and POS transactions[1][2][1].
• The service code indicates what charges the card accepts, and the LRC is an internal check character not returned to applications[1][3].
• Most readers read both tracks for redundancy, so processing continues if one track becomes unreadable[1].

To understand how dumps are sold and used, see Dumps with PIN: What They Are and How They Work.

Explore More on Payment Card Security

Discover additional resources and insights on payment card technology.