A card number check confirms that a payment card number is structurally valid. It tests the digit count for the brand, the leading issuer digits, and the Luhn checksum. A pass means the digits could belong to a real card. It does not mean the account is open, funded, or approved for a charge.
Card Number Check System: How Card Validation Actually Works
What does a card number check verify?
Card numbers follow a pattern defined in ISO/IEC 7812. The first six to eight digits form the issuer identification number (IIN, still labeled BIN in most tools). The rest is the account portion plus a final check digit. A validation routine tests that pattern and nothing more.
- Length: the digit count must match the brand (15 for American Express, 16 for most Visa and Mastercard numbers).
- Prefix: the first digits must fall inside an assigned issuer range.
- Checksum: the last digit must satisfy the Luhn formula against the other digits.
How does the Luhn algorithm work?
The Luhn formula (Mod 10) catches single-digit typos and most swapped digit pairs. It walks the number from right to left, doubles every second digit, adds the digits of each doubled value, then sums everything. A total that divides by 10 means the number passes.
- Drop the check digit and set it aside.
- Starting from the rightmost remaining digit, double every second digit.
- If a doubled value is above 9, subtract 9.
- Add all results plus the check digit.
- If the total ends in 0, the number is well formed.
Example: the sandbox number 4242 4242 4242 4242 passes Luhn, which is why payment gateways publish it for testing. It belongs to no real account and no issuer will authorize it.
card number authentication process
Card length and prefix rules by brand
Prefix ranges come from the card networks and change as new ranges get assigned. A validator that hardcodes 2019-era rules will reject valid numbers. Common ranges:
- Visa: 13, 16, or 19 digits, starts with 4.
- Mastercard: 16 digits, 51-55 or 2221-2720.
- American Express: 15 digits, 34 or 37.
- Discover: 16 digits, 6011, 65, 644-649, or 622126-622925.
- JCB: 16 to 19 digits, 3528-3589.
- Diners Club: 14 to 19 digits, 300-305, 36, or 38.
What a card number check cannot tell you
A Luhn pass says nothing about the state of the account. It cannot confirm balance, expiry date, CVV match, or that the issuer will approve a charge. Only an authorization request through a processor answers those questions.
That gap is why tools promising to "prove" a card is live are not credible. A number can pass every format test and still be closed, frozen, or invented. Guessing produces false positives too: about 1 in 10 random digits passes Luhn by chance.
Why the CVV needs a separate check
The CVV is three digits (four for American Express) with no internal checksum. A format check confirms the digit count and nothing else. The issuer compares the value during authorization, so no local test can verify it.
Card number check vs. card authorization
A number check runs offline and costs nothing. An authorization sends the number, expiry, CVV, and amount to the issuer and returns an approve or decline code. The two steps answer different questions: are these digits possible, and will this account pay?
Where card number checks get used
- Checkout forms: catch typos before the customer submits, which cuts failed authorizations.
- Billing systems: flag records corrupted during import or manual entry.
- Fraud screening: a failed checksum is a strong signal that a number was invented.
- Data cleanup: find rows in a CRM where a stored number is truncated.
How do I validate card numbers without handling raw card data?
Use the payment provider's SDK so the card number goes from the customer's browser straight to the processor. Your server receives a token, not a PAN. This keeps most of your systems out of PCI scope.
- Never log full card numbers; mask to the first six and last four when a reference is needed.
- Test with sandbox numbers from your processor, never with customer data.
- Store the token and the last four digits, nothing more.
Why does a card number fail validation?
Most failures come from typing, not from fraud. A single wrong digit or two swapped digits breaks the checksum. Other numbers fail because the length does not match the brand.
- Transposed digits (19 typed instead of 91).
- A missing or extra digit from a copy-paste.
- Spaces, dashes, or letters mixed into the field.
- A prefix from a range the validator does not know about yet.
Is a card number check legal?
Testing the format of a number is a math exercise and is legal. Using a card number that belongs to someone else, or testing numbers you did not receive from your own customers, is card fraud under US law (18 U.S.C. § 1029) and similar statutes elsewhere.
Developers should test only with sandbox numbers published by their processor. Anyone offering to sell card numbers or "verified" card data is selling stolen financial records, and buying or using that data carries criminal exposure.