What is card number validation?
Card number validation is a format check that confirms a payment card number has the expected length, a recognized issuer prefix, and a valid check digit. It answers one question: does this string of digits look like a genuine card number? It does not confirm that the account is open, funded, or authorized for a transaction.
How does the Luhn algorithm work?
The Luhn algorithm, also called the mod 10 check, scans the digits from right to left and doubles every second digit. When doubling produces a value above 9, subtract 9 from it. If the sum of all resulting digits is divisible by 10, the number is structurally valid.
The test number 4539 1488 0343 6467 passes: its digits total 80. Change any single digit and the total no longer divides by 10, which is why the check catches most typos and transpositions.
Card Number Check System: How Card Validation Actually Works
What do the parts of a card number mean?
ISO/IEC 7812 defines the layout of a payment card number: a major industry identifier, an issuer identification number, an individual account number, and a final check digit.
card number verification method
- First digit: major industry identifier, where 4 and 5 signal banking and financial institutions.
- Digits two through six: the issuer identification number, commonly called the BIN, which maps to the issuing bank and card product.
- Middle digits: the account identifier assigned by the issuer.
- Last digit: the Luhn check digit.
How do BIN ranges and length rules differ by network?
Each card network publishes its own prefix and length rules, so a validator needs a lookup table rather than a single pattern.
- Visa: 16 digits, beginning with 4.
- Mastercard: 16 digits, using ranges 51 to 55 and 2221 to 2720.
- American Express: 15 digits, beginning with 34 or 37.
- Discover: 16 digits, beginning with 6011, 65, or the 644 to 649 range.
What card number validation cannot tell you
A passing checksum says nothing about whether a card is active, has available credit, or belongs to the person entering it. Only an authorization request through a payment processor can answer those questions, and only the cardholder can consent to it.
Running numbers you do not own through validation tools is carding, and buying or selling stolen card data is a federal crime in the United States. A format check is a usability feature for legitimate checkout forms, not a way to test accounts.
Where should validation sit in a payment flow?
Run a light format check in the browser to give shoppers fast feedback, then repeat the check on the server, which is the authoritative layer. Client input should never be trusted for anything that touches money.
Store only what PCI DSS allows. Sensitive authentication data, including the CVV and full magnetic stripe contents, must not be retained after authorization. Tokenization replaces the account number with a surrogate value so the primary account number never sits in your database.
Frequently asked questions
Is the Luhn check enough to accept a payment?
No. A complete checkout also validates the expiration date and security code format, then sends an authorization request. The processor, not your form, decides whether the card works.
Can a card number be validated without charging it?
A zero-dollar or small authorization can confirm an account is open, but it requires a merchant account and the cardholder's permission. Unauthorized test authorizations violate card network rules and often the law.
Do you need the CVV to validate a card number?
No. The CVV is a separate three- or four-digit code used during authorization, and it plays no part in the number's structure or checksum.
Why do some validators reject prepaid cards?
Some merchants block specific BIN ranges on purpose to limit fraud and chargeback risk. That is a business rule layered on top of validation, not a flaw in the checksum math.