Answer
A Luhn verification test is a checksum. It reads a number from the right, applies one doubling rule, adds the digits, and divides the total by 10. A remainder of 0 means the number passes. A pass means the check digit matches the rest of the digits. It does not mean the number belongs to a live account.
Origin
IBM engineer Hans Peter Luhn filed a patent for the method in 1954. US Patent 2,950,048 issued in 1960. The method became ISO/IEC 7812, the numbering standard for payment cards. The same formula appears in IMEI numbers on phones, National Provider Identifiers, and Canadian Social Insurance Numbers.
Steps
- Start at the rightmost digit. That digit is the check digit.
- Move left one place at a time. Double every second digit.
- If a doubled value is 10 or higher, subtract 9 from it.
- Add the untouched digits and the reduced doubled digits.
- Divide the sum by 10. Remainder 0 is a pass. Any other remainder is a fail.
Worked example: 79927398713. Doubling every second digit from the right gives 2, 7, 6, 4, 9. The untouched digits are 3, 7, 9, 7, 9, 7. The sum is 70. 70 divided by 10 leaves remainder 0, so the number passes.
What the test does not cover
Luhn catches single-digit typos and most swaps of adjacent digits. It misses the swap of 09 and 90, because both orders produce the same sum. It also misses some twin errors where two digits change together.
The test gives no information about account status, available funds, expiration date, or cardholder authorization. A number that passes the checksum can be unassigned, closed, or revoked. Only the issuer can confirm that an account exists and that a charge is approved.
Where the test is used
- Payment card primary account numbers under ISO/IEC 7812
- IMEI identifiers on mobile devices
- National Provider Identifiers, with the 80840 prefix
- Canadian Social Insurance Numbers
- Some loyalty and transit card numbers
Legal status in the United States
The arithmetic itself is public and legal. 18 U.S.C. section 1029 covers producing, selling, or using access devices with intent to defraud. Penalties include fines and prison terms that reach 15 years in several offense categories. Running a checksum on account numbers you do not own or have written permission to test is not a legitimate use, and a passing check digit is not evidence that a number is real.