Hubbry Logo
Payment card numberPayment card numberMain
Open search
Payment card number
Community hub
Payment card number
logo
7 pages, 0 posts
0 subscribers
Be the first to start a discussion here.
Be the first to start a discussion here.
Payment card number
Payment card number
Payment card number
View on Wikipedia
from Wikipedia

A payment card number, primary account number (PAN), or simply a card number, is the card identifier found on payment cards, such as credit cards and debit cards, as well as stored-value cards, gift cards and other similar cards. In some situations the card number is referred to as a bank card number. The card number is primarily a card identifier and may not directly identify the bank account number(s) to which the card is/are linked by the issuing entity. The card number prefix identifies the issuer of the card, and the digits that follow are used by the issuing entity to identify the cardholder as a customer and which is then associated by the issuing entity with the customer's designated bank accounts. In the case of stored-value type cards, the association with a particular customer is only made if the prepaid card is reloadable. Card numbers are allocated in accordance with ISO/IEC 7812. The card number is typically embossed on the front of a payment card, and is encoded on the magnetic stripe and chip, but may also be imprinted on the back of the card.

The payment card number differs from the Business Identifier Code (BIC/ISO 9362, a normalized code—also known as Business Identifier Code, Bank International Code or SWIFT code). It also differs from Universal Payment Identification Code, another identifier for a bank account in the United States.

Structure

[edit]

Payment card numbers are composed of 8 to 19 digits,[1] The leading six or eight digits are the issuer identification number (IIN) sometimes referred to as the bank identification number (BIN).[2]: 33 [3] The remaining numbers, except the last digit, are the individual account identification number. The last digit is the Luhn check digit. IINs and PANs have a certain level of internal structure and share a common numbering scheme set by ISO/IEC 7812. The parts of the number are as follows:

  1. ^ IIN length has been extended to 10-digits in fifth edition of ISO/IEC 7812 published in 2017[4] and PAN will continue to remain variable length, ranging from 10 to 19 digits.

Issuer identification number (IIN)

[edit]
Partial IIN on a credit card (both printed and embossed)

The first six or eight digits of a card number (including the initial MII digit) are known as the issuer identification number (IIN). These identify the card issuing institution that issued the card to the card holder. The rest of the number is allocated by the card issuer. The card number's length is its number of digits. Many card issuers print the entire IIN and account number on their card.

In some circumstances, the issuer identification number (IIN) or bank identification number (BIN) may not be licensed directly from the issuing network (such as Mastercard or Visa). Obtaining a BIN/INN number can be costly, time consuming and demand intensive operational burdens on in-house regulatory and compliance teams. For this reason, some new card programs may use a 'BIN sponsor', in which case the IIN/BIN number is effectively sub-licensed from a scheme regulated entity. This is known as BIN sponsorship, and is a popular way for financial institutions to fast-track access to market.[6]

In the United States, IINs are also used in NCPDP pharmacy claims to identify processors, and are printed on all pharmacy insurance cards. IINs are the primary routing mechanism for real-time claims.

The ISO Register of Issuer Identification Numbers database is managed by the American Bankers Association. ABA is the Registration Authority for this standard and is responsible for allocating IINs to issuers.

Online merchants may use IIN lookups to help validate transactions. For example, if a card's IIN indicates a bank in one country, while the customer's billing address is in another, the transaction may call for extra scrutiny.

Issuing network IIN ranges Active Length Validation
American Express 34, 37[7] Yes 15[8] Luhn algorithm
Bankcard[9] 5610, 560221–560225 No 16
China T-Union 31 Yes 19
China UnionPay 62 Yes 16–19[10]
Diners Club enRoute Yes 15 No Validation
Diners Club International[11] 30, 36, 38, 39 Yes 14–19[10] Luhn algorithm
Diners Club United States & Canada[12] 55 Yes 16
Discover Card 6011, 644-649, 65 Yes 16–19[10]
622126–622925 (China UnionPay co-branded) Yes 16–19[10]
UkrCart [uk] 60400100–60420099 Yes 16–19
RuPay 60, 65, 81, 82, 508 Yes 16
353, 356 (RuPay-JCB co-branded) Yes 16
InterPayment 636 Yes 16–19
InstaPayment 637–639 Yes 16
JCB 3528–3589 Yes 16–19[10]
LankaPay 357111 (JCB co-branded) Yes 16
Laser 6304, 6706, 6771, 6709 No 16–19
Maestro UK 6759, 676770, 676774[13] Yes 12–19
Maestro 5018, 5020, 5038, 5893, 6304, 6759, 6761, 6762, 6763 Yes 12–19
Dankort 5019 Yes 16
4571 (Visa co-branded)[14] Yes 16
Mir 2200–2204 Yes 16–19
BORICA [bg] 2205 Yes 16
NPS Pridnestrovie [ru] 6054740–6054744 No[15] 16
Mastercard 2221–2720[16] Yes (since 2017)[17] 16
51–55[16] Yes 16
Solo 6334, 6767 No 16, 18, 19
Switch 4903, 4905, 4911, 4936, 564182, 633110, 6333, 6759 No 16, 18, 19
Troy 65 (Discover co-branded[18]) Yes 16
9792[19] Yes 16
Visa 4 Yes 13, 16, 19
Visa Electron 4026, 417500, 4844, 4913, 4917 No[20] 16
UATP 1 Yes 15
Verve 506099–506198, 650002–650027, 507865–507964 Yes 16, 18, 19
Uzcard [ru] 8600, 5614 Yes 16
HUMO [ru] 9860 Yes 16
GPN 1946 (BNI cards) Yes 16, 18, 19
50, 56, 58, 60–63 Yes 16, 18, 19
Napas [vi] 9704 Yes 16, 19 Unknown

On 8 November 2004, Mastercard and Diners Club formed an alliance. Diners Club cards issued in Canada and the United States start with 54 or 55 and are treated as Mastercards worldwide. International cards use the 36 prefix and are treated as Mastercards in Canada and the United States, but are treated as Diners Club cards elsewhere. Diners Club International's website makes no reference to old 38 prefix numbers, and they can be presumed reissued under the 55 or 36 IIN prefix. Effective 16 October 2009, Diners Club cards beginning with 30, 36, 38 or 39 have been processed by Discover Card.[21]

On 3 November 2014, Mastercard announced that they were introducing a new series of BIN ranges that begin with a "2" (222100–272099). The "2" series BINs will be processed the same as the "51–55" series BINs are today. They became active 14 October 2016.

On 23 July 2014 JSC NSPK was established in the Russian Federation. The joint stock company National System of Payment Cards (NSPK) is the operator of the Mir National Payment System. The main initiatives of NSPK are to create the national payment system infrastructure and to issue a national payment card, Mir.

Effective 1 October 2006, Discover began using the entire 65 prefix, not just 650. Also, similar to the Mastercard/Diners agreement, China UnionPay cards are now treated as Discover cards and accepted on the Discover network.

While the vast majority of Visa's account ranges describe 16 digit card numbers there are still a few account ranges (forty as of 11 December 2013) dedicated to 13 digit PANs and several (439 as of 11 December2013) account ranges where the issuer can mix 13 and 16 digit card numbers. Visa's VPay brand can specify PAN lengths from 13 to 19 digits and so card numbers of more than 16 digits are now being seen.

Switch was re-branded as Maestro in mid-2007.[22] In 2011, UK domestic Maestro (formerly Switch) was aligned with the standard international Maestro proposition with the retention of a few residual country specific rules.

EMV Certification requires acceptance of a 19-digit Visa card (ADVT 6.1.1 Test Case 2) and Discover Card (E2E Test Plan v1.3, Test Case 06).

Canadian bank card numbering

[edit]

Bank card numbers issued by Canadian banks also follow a pattern for their systems:

Issuing network Ranges Length
Canadian Imperial Bank of Commerce Advantage Debit Card 4506 (Interac and Visa Debit) 16 digits
Royal Bank of Canada Client Card 4519 16 digits
TD Canada Trust Access Card 4724 (Interac and Visa Debit) 16 digits
Scotiabank Scotia Card 4536 16 digits
BMO ABM Card 500, 5510 16 digits
Conexus Credit Union Member Card 629449 16 digits

Security measures

[edit]
Example of PAN truncation on a banking mobile application for an album bought at Bandcamp

To reduce the risk of credit card fraud, various techniques are used to prevent the dissemination of bank card numbers. These include:

  • Format-preserving encryption: in which the account number is replaced with a strongly encrypted version which retains the format of the card data including non sensitive parts of the field such as first six and last four digits. This permits data field protection without changing payment IT systems and applications. A common use is for protecting card data from the point of capture in a secure reader to the payment processing host end-to-end to mitigate risk of data compromise in systems such as the Point of Sale (POS). AES-FF1 Format-Preserving Encryption is defined in NIST Specification SP800-38G.
  • PAN truncation: in which only some of the digits on a card are displayed or printed on receipts. The PCI DSS standard dictates that only the first six and last four digits of the PAN may be printed on a receipt or displayed in cases other than where a business need requires the full PAN. US federal law (FACTA) allows only the display of the last 5 digits. In order to comply with both PCI DSS requirements and US federal law, generally only the last four digits are provided elsewhere to allow an individual to identify the card used.
  • Tokenization: in which an artificial account number (token) is printed, stored or transmitted in place of the true account number.

References

[edit]
Revisions and contributorsEdit on WikipediaRead on Wikipedia

Payment card number

View on Grokipedia
from Grokipedia
A payment card number, also known as the primary account number (PAN), is a unique sequence of 13 to 19 numeric digits that serves as the primary identifier for a cardholder's account on , debit, prepaid, or other cards, enabling transaction and routing. The structure of a payment card number follows the ISO/IEC 7812, which defines a numbering system to identify card issuers and format the account details. The first 6 to 8 digits comprise the issuer identification number (IIN), formerly known as the bank identification number (BIN), beginning with a major industry identifier (MII) that categorizes the card type—such as 4 for Visa, 3 for American Express, 5 or 222100–272099 for Mastercard, and 6 for Discover—and followed by digits specifying the issuing . The total number of digits varies by network: typically 13, 16, or 19 for Visa; 16 for Mastercard; 15 for American Express; and 16 to 19 for Discover. Subsequent digits (typically 6 to 12) represent the individual account identifier assigned by the issuer, while the final digit is a calculated using the to detect errors or invalid numbers during entry or transmission. Payment card numbers are physically embossed or printed on the front of the card and encoded in its magnetic stripe, chip, or contactless interface for use in point-of-sale terminals, online payments, and systems. Due to their sensitivity as account identifiers, full PANs are classified as protected data under the Industry Standard (PCI DSS), which mandates , tokenization, or for storage and transmission to mitigate risks like skimming or data breaches. The expansion of IINs from 6 to 8 digits in 2017, as updated in ISO/IEC 7812, accommodates the growing volume of issued cards while enhancing precision in global payment networks.

Fundamentals

Definition and Purpose

A payment card number, also known as a primary account number (PAN), is a unique numeric identifier consisting of 12 to 19 digits, embossed or printed on the front of payment cards such as , debit, or prepaid cards. It functions as the core identifier linking the card to the cardholder's financial account issued by a or . The primary purpose of the payment card number is to facilitate the , , and settlement of electronic transactions within the global ecosystem. During a transaction, it enables payment networks to direct requests to the correct for approval, verifies account legitimacy, and supports secure processing by distinguishing the card from others without exposing sensitive full-account information. This structured identification ensures efficient interoperability across merchants, acquirers, and issuers while minimizing fraud risks in card-not-present scenarios. Payment card numbers originated in the mid-20th century with the advent of plastic cards for retail purchases, gaining prominence after the launch of the first modern charge cards in 1950, which replaced cumbersome paper-based systems. The numbering format was later formalized under the ISO/IEC 7812 standard in 1987 to promote global consistency and prevent duplication across international payment systems. Notably, the payment card number is distinct from supplementary security features like the card verification value (CVV) or expiration date, which provide additional layers of authentication and temporal validity.

Types of Payment Cards

Payment cards encompass various types that rely on a unique numerical identifier to facilitate transactions across payment networks. These types differ primarily in their funding sources, repayment structures, and usage constraints, yet all employ the card number as the core element for authorization and processing. The primary categories include , debit, prepaid, and charge cards, each serving distinct financial needs while adhering to standardized numbering for . Credit cards provide cardholders with a revolving , enabling borrowing up to an approved limit set by the issuer, such as networks like Visa or . The card number serves to authorize these purchases, which accrue interest if not repaid in full by the due date, allowing flexible spending beyond immediate funds. Debit cards link directly to a or account, deducting funds immediately upon transaction to reflect spending of existing balances. They frequently share numbering formats with ATM cards issued by the same , ensuring seamless access to account funds without borrowing. Prepaid cards function by pre-loading a specific amount of onto the card, limiting expenditures to the available balance without establishing a line. These cards support one-time use or reloadable options, with the assigned number enabling transactions until funds are depleted, after which purchases are declined unless reloaded. Charge cards, such as those offered by , permit purchases without a fixed spending limit but require full payment of the balance each billing cycle, often catering to higher spending volumes. The card number authorizes these transactions, emphasizing pay-in-full discipline over revolving balances. Across these types, major networks like Visa and standardize on 16-digit card numbers, while typically uses 15 digits for its charge and credit products. This numerical structure differentiates physical payment cards from alternatives like mobile wallets, which rely on tokenized virtual identifiers rather than exposed card numbers.

Numbering Structure

General Format

Payment card numbers, also known as primary account numbers (PANs), adhere to a standardized numeric format established by the (ISO) to facilitate global interoperability in payment processing. These numbers vary in length from 13 to 19 digits, with 16 digits being the most prevalent configuration for cards from major networks; for instance, Visa cards can consist of 13, 16, or 19 digits, Mastercard cards consist of 16 digits, American Express cards feature 15 digits, and Discover cards can consist of 16 to 19 digits. The minimum length of 13 digits applies to certain payment card schemes like Visa's VPay, while most are 15 or 16 digits. To enhance , the digits are conventionally grouped into sets of four, separated by spaces—such as 1234 5678 9012 3456—and comprise only numeric characters, excluding letters except in certain or non-standard implementations. The number is generally positioned on the front of the physical card, where it may be embossed for tactile verification or printed for visibility, and it is identically encoded within the card's magnetic stripe or chip to support both manual and electronic transaction capture. This layout originated in early credit systems of the and has progressed to conform with ISO/IEC 7812 specifications, which accommodate variable PAN lengths up to 19 digits (including an 8-digit issuer identification number and a ) and promote seamless integration with point-of-sale terminals across diverse infrastructures.

Components

The payment card number, formally known as the Primary Account Number (PAN), follows a standardized structure outlined in ISO/IEC 7812 to ensure global and identification of issuers and accounts. This structure divides the number into sequential segments, each serving a distinct purpose in routing, processing, and securing transactions. The total length varies from 13 to 19 digits, with 16 digits being standard for most and debit cards issued by financial institutions. The initial segment is the Issuer Identification Number (IIN), formerly known as the Bank Identification Number (BIN), consisting of the first 6 or 8 digits of the PAN. The first digit of the IIN is the Major Industry Identifier (MII), which categorizes the industry sector of the card issuer—for instance, the value 4 denotes banking and financial services. This component, including the following 5 or 7 digits, uniquely designates the issuing financial institution and can specify details such as the card product type or geographic region. Since the 2017 update to ISO/IEC 7812 and implementation in April 2022, new IINs are assigned as 8 digits, while existing 6-digit IINs continue to be supported. The IIN facilitates accurate transaction authorization by directing requests to the correct issuer for validation and approval. The bulk of the PAN consists of the remaining digits, serving as the individual account identifier. This portion assigns a unique reference to the specific cardholder's account within the issuer's portfolio, enabling precise linkage to the holder's financial records and transaction . The length of this identifier varies (typically 7 to 12 digits depending on the total PAN length and IIN size), and issuers often generate it in a randomized , avoiding sequential or predictable patterns that could expose account details to unauthorized or testing attacks. To safeguard , issuers often generate this identifier in a randomized , avoiding sequential or predictable patterns that could expose account details to unauthorized or testing attacks. The final digit is the , positioned at the end of the PAN to confirm the overall number's structural integrity during transmission and processing. Per ISO/IEC 7812, the complete format comprises the IIN (6 or 8 digits, including the ), individual account identifier (variable length, typically 7 to 12 digits depending on total PAN length and IIN size), and (1 digit), supporting lengths from 13 to 19 digits while maintaining consistency across international payment systems.

Check Digits

The check digit serves as the final digit in a payment card number, functioning to verify the validity of the preceding digits and detect common errors introduced during manual transcription or data transmission. By incorporating redundancy into the number, it enables systems to identify invalid entries without requiring real-time communication with the issuer, thereby enhancing in payment processing. This digit is derived mathematically from all the digits that precede it, employing a arithmetic method to ensure the overall number satisfies a specific condition. The calculation integrates the entire preceding sequence, making the dependent on the full account structure while remaining computationally simple for validation purposes. Check digits were introduced in the as part of early error-checking mechanisms for emerging card systems, with the underlying patented in 1960 by researcher to address human errors in numerical data handling. They are now present in nearly all payment card numbers, standardized under ISO/IEC 7812 to promote consistent validation across global financial networks. The method exhibits a low for typical manual entry errors, effectively safeguarding against inadvertent mistakes in high-volume transaction environments. In terms of error detection, the reliably catches all single-digit substitution errors—such as entering a 5 instead of a 6—and all transpositions of adjacent digits, like swapping 1 and 2 to read 21 instead of 12. This capability is particularly valuable for preventing processing of garbled numbers in point-of-sale or entry scenarios, where such errors are prevalent.

Issuer Identification

Major Industry Identifier (MII)

The Major Industry Identifier (MII) is the first digit of a payment card number, consisting of a single numeral from 0 to 9 that denotes the primary industry sector of the card-issuing entity, as specified in the international standard ISO/IEC 7812-1. This digit enables initial categorization during transaction authorization, facilitating appropriate routing to payment networks and processors based on the issuer's sector. The MII assignments are defined to reflect broad economic sectors, with specific ranges allocated as follows:
MII DigitIndustry Sector
0ISO/TC 68 and other industry assignments
1Airlines
2Airlines, financial institutions, and other future industry assignments
3Travel and entertainment
4Banking and financial
5Banking and financial
6 and banking/financial
7
8Healthcare and
9National use
These ranges are assigned by the ISO based on the issuer's primary business description during registration. For instance, cards issued by major payment networks like Visa begin with 4 (banking/financial sector), while cards start with 5 (also banking/financial). The framework originated in the 1980s, developed collaboratively by the (ANSI) Accredited Standards Committee X9 for financial services and the (ISO) to standardize issuer identification globally. By providing an upfront industry classification, the influences transaction processing paths and can impact associated fees through sector-specific network rules. It forms the initial component of the broader Issuer Identification Number (IIN), enabling seamless integration for issuer-specific routing.

Issuer Identification Number (IIN)

The Issuer Identification Number (IIN), also known as the Bank Identification Number (BIN), is an up to eight-digit code (expanded from six digits in 2017 per ISO/IEC 7812-1 revision) comprising the as the first digit followed by up to seven additional digits that uniquely identify the issuing for payment cards such as credit, debit, and prepaid cards. This structure enables the precise routing of transactions to the correct issuer during payment processing. For instance, the IIN 411111 is commonly used for Visa test cards to simulate transactions in development environments. Major payment card networks use designated primary IIN ranges to identify the network itself:
  • Visa: Starts with 4 (BINs begin with 4 followed by any digits; card length 13, 16, or 19 digits).
  • Mastercard: 222100–272099 or 510000–559999 (card length 16 digits).
  • American Express (Amex): 340000–349999 or 370000–379999 (card length 15 digits).
  • Discover: 601100–601199, 644000–649999, 650000–659999, and 622126–622925 (card length 16–19 digits).
These are the primary ranges used to identify the card network; specific IINs (historically referred to as 6-digit BINs) are assigned to individual issuers within these ranges. The assignment and management of IINs are overseen by the (ISO) through its designated , which was the (ABA) from the early 1970s until 2024, when administration transitioned to Global Services under ANSI oversight. Applications for new IINs must be sponsored by a national standards body and submitted to the , with approvals typically processed within five business days after receipt of a complete application and a non-refundable ; one IIN is allocated per legal entity to ensure uniqueness in international interchanges. New ranges are allocated periodically to accommodate growing demand from issuers as the payment ecosystem expands. In addition to identifying the issuer, the IIN conveys information about the card type, such as whether it is a credit or debit card, based on the specific range assigned during registration, where applicants declare the intended usage (e.g., credit, debit, or ATM access). This facilitates appropriate transaction handling, including routing and fee structures, by payment networks. In Canada, IINs align with the ISO standard but support domestic debit routing through the Interac network, enabling seamless local transactions while maintaining international compatibility.

Validation Methods

Luhn Algorithm

The , a formula invented by engineer in 1954 and patented in 1960 under U.S. No. 2,950,048, serves as the primary method for generating and validating the in numbers. Widely adopted by issuers starting in the 1960s, it provides a simple yet effective way to detect common errors in numeric sequences like card numbers, ensuring basic integrity without requiring complex computation. The validation process begins with the card number's digits, treating the rightmost digit as the to be verified (or generated if absent). Starting from the second digit from the right and moving leftward, double every second digit. For any doubled value exceeding 9, either subtract 9 or sum the individual digits of the result (e.g., 7 doubled to 14 becomes 1 + 4 = 5, or 14 - 9 = 5). Add all processed values together with the undoubled digits and the . If the total sum is a multiple of 10 (i.e., sum mod 10 = 0), the number is valid. This method is applied from right to left to align with how check digits are appended. Mathematically, for a sequence of digits dn−1dn−2…d1d0d_{n-1} d_{n-2} \dots d_1 d_0 where d0d_0 is the check digit and positions are indexed from the right starting at 0, the sum ss is calculated as s=∑i=0n−1ais = \sum_{i=0}^{n-1} a_i, where ai=dia_i = d_i if ii is even, and ai=2dia_i = 2 d_i if 2di<102 d_i < 10, else 2di−92 d_i - 9 if ii is odd. The number is valid if s≡0(mod10)s \equiv 0 \pmod{10}. Consider the example card number 4539 1488 0343 6467, a test Visa number. From right to left, the digits are 7,6,4,6,3,4,3,0,8,8,4,1,9,3,5,4. Ignoring the check digit 7 initially, double the positions (every second digit starting from the second from the right): 6→12 (1+2=3), 6→12 (3), 4→8, 0→0, 8→16 (1+6=7), 1→2, 3→6, 4→8. The undoubled positions remain 7 (check), 4,3,3,8,4,9,5. Summing all processed values (3 + 4 + 3 + 3 + 8 + 3 + 0 + 8 + 7 + 4 + 2 + 9 + 6 + 5 + 8 + 7) yields 80, and 80 mod 10 = 0, confirming validity. This process is routine for credit and debit cards to catch transcription mistakes at point-of-sale or online entry. The algorithm excels at detecting all single-digit errors and nearly all transpositions of adjacent digits (e.g., swapping 12 to 21), though it misses some cases like transpositions of non-adjacent digits or certain twin errors. It is efficiently implemented in software libraries for real-time checks during payment processing, contributing to the reliability of trillions in annual transactions without adding significant overhead. While the Luhn algorithm validates the format of payment card numbers, it does not confirm whether the number is associated with a real account. Fake credit card numbers generated by tools may pass this check but fail in real payment systems because they are not linked to actual accounts issued by financial institutions. These attempts are typically rejected during the authorization phase by issuers or processors like Stripe, often flagged as potential fraud through measures such as address verification, CVV checks, and behavioral analytics to prevent unauthorized transactions.

BIN/IIN Validation

The ISO/IEC 7812 standard was revised in 2017 to expand IINs from 6 to up to 8 digits to accommodate the growing number of issuers, with major card networks completing migration by April 2022 and the 8-digit standard becoming mandatory as of November 1, 2025. BIN/IIN validation extends beyond basic checksum verification by cross-referencing the Issuer Identification Number (IIN; the first 6 to 8 digits of the payment card number, formerly a fixed 6 digits and also known as the Identification Number (BIN) for the initial 6 digits)—against specialized databases to confirm the legitimacy of the issuing and identify the card's type, such as , debit, or prepaid. This ensures that the card originates from a registered issuer and helps categorize the transaction for appropriate routing and during payment ing. Performed primarily by acquiring banks or payment processors as part of the authorization phase, it leverages real-time lookups to flag discrepancies, such as mismatched issuer details or unsupported card products, thereby reducing the risk of processing invalid or fraudulent cards. Additionally, BIN/IIN validation frequently incorporates geographic verification by comparing the country of issuance, derived from the IIN, with the billing or shipping address provided in the transaction. This check is particularly important for detecting potential fraud or mismatches in international payments, where inconsistencies between the card's origin and the transaction location may indicate stolen cards or unauthorized cross-border use. Key techniques in BIN/IIN validation include range checks, which compare the provided BIN against predefined valid ranges assigned by card networks to detect invalid or fabricated prefixes, and velocity checks, which monitor the frequency and volume of transactions linked to a specific BIN within a given timeframe to identify anomalous patterns indicative of , such as rapid testing of card variations. These methods are particularly effective in countering BIN attacks, where fraudsters exploit known BINs to generate and test potential card numbers, by enabling early detection of stolen or compromised prefixes through issuer-specific risk profiling. For instance, if a BIN associated with high-fraud issuers shows unusual activity, the transaction may be scored higher for review or declined outright. In chip-enabled cards adhering to standards, the BIN/IIN is accessed via ISO/IEC 7816 protocols, which define the application protocol data units (APDUs) for reading the primary account number (PAN) from the card's , ensuring secure extraction of details during contact or contactless interactions. This integration facilitates seamless validation at the point of sale by combining chip data with network-level BIN databases. Major card networks provide dedicated BIN lookup services to support these validations and enhance fraud scoring; for example, Visa's BIN Attribute Sharing Service (VBASS) delivers attributes like card level and country of issuance to acquirers for real-time decisioning, while Mastercard's BIN Lookup offers similar data for and transaction optimization. These tools contribute to broader fraud prevention by enabling velocity monitoring and range verification at scale, with studies indicating reductions in unauthorized transactions through proactive BIN-based interventions.

Security and Privacy

Protection Techniques

Protection techniques for payment card numbers, also known as Primary Account Numbers (PANs), focus on minimizing exposure during storage, display, and transmission to prevent unauthorized access and fraud. These methods are mandated by standards like the Payment Card Industry Data Security Standard (PCI DSS), which was introduced in December 2004 to establish uniform security requirements for organizations handling cardholder data. PCI DSS v4.0, mandatory from March 2025, introduces additional controls such as targeted risk analyses and enhanced to further protect cardholder data. Key approaches include masking, truncation, tokenization, and , which collectively reduce the risk of full PAN compromise while supporting compliance and operational needs. Masking involves displaying only partial portions of the PAN in user interfaces, statements, or logs to obscure sensitive details from unauthorized viewers. Under PCI DSS Requirement 3.3, the full PAN must be masked such that only personnel with a legitimate need can see more than the first six and last four digits; for example, a 16-digit number might appear as "**** **** **** 1234." This technique limits visibility without impacting functionality, such as transaction reconciliation, and is a foundational control for protecting displayed card . Truncation complements masking by permanently removing middle digits from stored PANs, retaining no more than the first six or eight (per IIN length and brand guidelines) and last four digits for reference purposes. PCI DSS guidance explicitly endorses as a secure storage method, ensuring that even if is breached, the full PAN cannot be reconstructed. This approach is particularly useful in logs or databases where partial information suffices for auditing, thereby shrinking the compliance scope under PCI DSS Requirement 3. Tokenization replaces the full PAN with a surrogate token—a random, non-sensitive identifier—that maps back to the original only through a secure, PCI-compliant tokenization . As outlined in the PCI DSS Tokenization Guidelines, this process detokenizes the PAN only when necessary for transactions, reducing the volume of sensitive stored or transmitted and simplifying PCI compliance by scoping out tokenized environments from full cardholder data protection requirements. Tokens are format-preserving to maintain compatibility with existing but hold no intrinsic value if intercepted. Encryption secures PANs using cryptographic algorithms during storage and transit, with PCI DSS specifying strong standards such as (AES) at 128 bits or higher, Triple Data Encryption Standard (TDES) with double-length keys, or equivalent. For data in transit over public networks, Transport Layer Security (TLS) version 1.2 or higher is required to protect against interception, ensuring that PANs remain unreadable without the decryption key. PAN-specific encryption standards, like point-to-point encryption (P2PE), further isolate sensitive data from merchant environments until it reaches secure processors. The adoption of chip technology represents a hardware-level shift in PAN protection, moving from static magnetic stripe data—easily skimmed and cloned—to dynamic, cryptographically generated values unique to each transaction. This evolution, promoted since the early 2000s, aligns with PCI DSS by reducing reliance on vulnerable static PAN transmission in physical card-present scenarios.

Common Risks and Mitigations

Payment card numbers face several significant risks from fraudulent activities that exploit vulnerabilities in physical, digital, and networked environments. Skimming involves the unauthorized capture of card data from magnetic stripes or chips using devices attached to ATMs, POS terminals, or gas pumps, enabling criminals to create cards for unauthorized transactions. attacks trick users into revealing card numbers through deceptive emails, websites, or calls that mimic legitimate entities, with such tactics contributing significantly to breaches. breaches, where hackers infiltrate merchant or processor systems to steal large volumes of card information, represent another major threat, often leading to widespread identity theft and financial losses. A prominent example of a is the 2013 incident at , where attackers compromised the retailer's network and exposed approximately 40 million credit and accounts over several weeks during the holiday shopping season. This breach highlighted vulnerabilities in point-of-sale systems and resulted in over $200 million in direct costs for the company, including settlements and remediation efforts. Such events underscore the scale of risk, as stolen card numbers can be sold on markets for as little as $5 to $110 per card, fueling further . To counter these risks, several mitigation strategies have been widely adopted. For online transactions, protocols add an extra authentication layer, such as one-time passcodes or biometric verification, shifting liability for fraud from merchants to issuers and reducing unauthorized payments by up to 80% in some implementations. (AVS) compares the billing address provided during checkout with the issuer's records, flagging mismatches to prevent card-not-present (CNP) fraud, which has seen a 19.8% increase in the U.S. since 2020 amid rising volumes. Real-time monitoring using analyzes transaction patterns, device fingerprints, and behavioral signals to detect anomalies instantly, blocking suspicious activities before completion and minimizing losses. Tokenization services further mitigate breach impacts by replacing actual card numbers with unique, non-sensitive tokens that are worthless to thieves if intercepted, thereby limiting the usability of stolen data in subsequent fraud attempts. Emerging threats like relay attacks, where criminals intercept and relay contactless payment signals over longer distances, are addressed through transaction limits, such as the $100 cap on contactless payments in many regions, which restricts potential damage from unauthorized taps while maintaining convenience for low-value purchases.

Variations and Standards

International Standards

The evolution of payment card numbering standards traces back to the 1970s, when fragmented national systems began transitioning to interconnected global networks to facilitate cross-border transactions. A pivotal development was the establishment of VisaNet in 1973 by the National BankAmericard Inc. (now Visa), which introduced the first electronic authorization, clearing, and settlement system, laying the groundwork for standardized global payment processing. This shift from isolated domestic frameworks to unified international protocols enabled the harmonization of card numbering practices across more than 100 countries, promoting and reducing through consistent identification and validation mechanisms. Central to this standardization is ISO/IEC 7812, a joint standard by the (ISO) and the (IEC) that defines the numbering system for identifying card issuers, including the format and assignment of the Issuer Identification Number (IIN). First published in 1987, it established a structured approach to IIN allocation, managed through a to ensure uniqueness and prevent overlaps in global usage. The standard was revised multiple times, with the 2017 edition (ISO/IEC 7812-1:2017) expanding the IIN from six to eight digits to support the proliferation of issuers amid rising digital payment adoption. This update, effective for new assignments from April 2022, maintains while enhancing capacity for future growth. Complementing structural standards, the Payment Card Industry Security Standards Council (PCI SSC), founded in 2006 by major card brands including , Discover, JCB, , and Visa, develops and enforces security protocols for handling payment card data, including account numbers. The PCI Data Security Standard (PCI DSS), a core output of the PCI SSC, mandates requirements for protecting cardholder data during storage, processing, and transmission, influencing compliance in over 150 countries and territories. These guidelines ensure that card numbers are safeguarded against unauthorized access, aligning with global efforts to mitigate risks in an interconnected ecosystem. In the realm of technological advancement, EMVCo—formed in 1999 by Europay, , and —oversees specifications for chip-based payment cards, driving the migration from magnetic stripe to technology starting in 2003. This initiative, adopted in regions like the and by 2003, has standardized chip card functionality worldwide, embedding account numbers within secure protocols to verify transactions dynamically. As of the end of 2024, over 14.7 billion chip cards were in circulation globally, harmonizing security features across diverse networks. For the United States, the Accredited Standards Committee X9 (ASC X9) under the (ANSI) develops financial services standards, including those for retail payments that intersect with card numbering practices. ANSI X9.13 specifically addresses specifications for financial instruments like checks, but broader ASC X9 work supports payment integrity in card-related contexts. Collectively, these bodies—ISO/IEC, PCI SSC, EMVCo, and ANSI—form the backbone of international standards, ensuring payment card numbers are consistently structured, securely managed, and interoperable across borders.

Regional Examples

In Canada, the Interac network, managed by Payments Canada since its inception in 1984, facilitates domestic debit transactions using standard 16-digit payment card numbers compliant with ISO/IEC 7812. These cards, often co-branded with international schemes like Visa or , support both domestic Interac processing and global compatibility. In Europe, payment card numbering aligns with the (SEPA) framework, where debit transactions are linked to International Bank Account Numbers (IBANs) for seamless cross-border direct debits, ensuring a unified identifier for account-based payments across 36 countries. SEPA-compliant cards, typically 16 digits long with standard IIN prefixes, support this integration by associating card details with IBANs during , facilitating efficient routing without altering core numbering structures. chip technology has been widely mandated and adopted across SEPA countries since the early 2010s to enhance and , with migration deadlines varying by . In , regional variations emphasize local networks while maintaining ISO compatibility. cards, the dominant domestic scheme, feature 16- to 19-digit numbers starting with the prefix 62 (or sometimes 60), allowing extended length to accommodate 's vast issuer base and unique routing needs. In , JCB cards use a 16-digit format beginning with 35 (specifically 3528 to 358n for international variants), prioritizing domestic merchant acceptance while supporting global transactions through IIN validation. These schemes accommodate local routing protocols—such as UnionPay's emphasis on intra- clearing—while adhering to ISO 7812 for the initial digits to enable international use.

References

  1. https://www.pcisecuritystandards.org/documents/PCI_DSS-QRG-v3_2_1.pdf
  2. https://stripe.com/resources/more/primary-account-numbers
  3. https://www.iso.org/standard/70484.html
  4. https://www.investopedia.com/terms/i/issuer-identification-number-iin.asp
  5. https://www.investopedia.com/terms/l/luhn-algorithm.asp
  6. https://www.ixopay.com/blog/what-is-a-bin-bank-identification-number
  7. https://www.emvco.com/knowledge-hub/issuer-identification-number-extension-emvco-evolves-contact-card-specification-to-support-iso-and-iec-changes/
  8. https://www.experian.com/blogs/ask-experian/the-history-of-credit-cards/
  9. https://www.consumerfinance.gov/ask-cfpb/how-are-prepaid-cards-debit-cards-and-credit-cards-different-en-433/
  10. https://www.forbes.com/advisor/credit-cards/charge-card-vs-credit-card/
  11. https://www.experian.com/blogs/ask-experian/how-many-numbers-are-on-a-credit-card/
  12. https://pcidssguide.com/what-do-the-credit-card-numbers-mean/
  13. https://docs.trellix.com/bundle/data-loss-prevention-11.10.x-classification-definitions-reference-guide/page/UUID-e5de14e5-ccb3-fb32-6eed-301395e1b515.html
  14. https://www.americanexpress.com/content/dam/amex/hk/en/staticassets/merchant/pdf/support-and-services/useful-information-and-downloads/GuidetoCheckingCardFaces.pdf
  15. http://support.worldpay.com/support/CNP-API/content/appendbcredit.htm
  16. https://www.privacy.com/blog/how-to-tell-credit-card-type-by-first-4-digits
  17. https://baymard.com/blog/credit-card-field-auto-format-spaces
  18. https://monei.com/blog/pan-number/
  19. https://www.investopedia.com/terms/b/bank-identification-number.asp
  20. https://www.paiementor.com/anatomy-of-a-bank-card/
  21. https://www.wearepay.uk/wp-content/uploads/2018/10/8uk-international-iin-current-iso-procedures-for-card-issuers.pdf
  22. https://www.idemia.com/insights/new-iso-standard-card-issuance
  23. https://www.investopedia.com/terms/p/primary-account-number-pan.asp
  24. https://www.lithic.com/blog/bank-identification-numbers
  25. https://blog.pcisecuritystandards.org/8-digit-bins-and-pci-dss-what-you-need-to-know
  26. https://blog.pcisecuritystandards.org/beware-of-account-testing-attack
  27. https://stripe.com/resources/more/how-to-use-the-luhn-algorithm-a-guide-in-applications-for-businesses
  28. https://www.scientificamerican.com/article/what-is-the-luhn-algorithm-the-math-behind-secure-credit-card-numbers/
  29. https://www.groundlabs.com/blog/anatomy-of-a-credit-card
  30. https://x9.org/history-of-x9/
  31. https://www.aba.com/about-us/our-story/issuer-identification-numbers
  32. https://www.ansi.org/about/roles/registration-program/iin
  33. https://www.iso.org/news/2016/11/Ref2146.html
  34. https://bincheck.io/details/411111
  35. https://www.bincodes.com/bin-list/
  36. https://www.globenewswire.com/news-release/2024/02/07/2825196/0/en/CUSIP-Global-Services-Assumes-Administration-of-Card-Issuer-Identification-Numbering-System.html
  37. https://www.interac.ca/en/payments/business/accept-interac-debit-payments/
  38. https://patents.google.com/patent/US2950048A/en
  39. https://www.ithistory.org/honor-roll/mr-hans-peter-luhn
  40. https://www.geeksforgeeks.org/dsa/luhn-algorithm/
  41. https://www.imei.info/luhn-algorithm/
  42. https://stripe.com/resources/more/what-is-carding-how-this-type-of-fraud-works-and-how-businesses-can-prevent-it
  43. https://e-complish.com/blog/eight-digit-bin-standard-goes-live-brings-changes-to-merchants-tables/
  44. https://kount.com/blog/bank-identification-numbers-bin-complete-guide
  45. https://usa.visa.com/products/visa-bin-attribute-sharing-service.html
  46. https://developer.mastercard.com/bin-lookup/documentation/
  47. https://www.fraudlabspro.com/resources/tutorials/how-to-detect-if-credit-card-issuing-country-is-not-the-same-as-billing-country/
  48. https://www.serviceobjects.com/blog/online-fraud-prevention/
  49. https://chargebacks911.com/velocity-checks/
  50. https://seon.io/resources/how-to-use-bin-lookup-for-fraud-detection/
  51. https://neapay.com/post/read-smart-card-chip-data-with-apdu-commands-iso-7816_76.html
  52. https://secureframe.com/blog/pci-history
  53. https://www.pcisecuritystandards.org/document_library?category=pcidss&document=pci_dss
  54. https://www.globalpaymentsintegrated.com/en-us/blog/2019/11/25/pci-rules-for-storing-credit-card-numbers-in-a-database
  55. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf
  56. https://www.pcisecuritystandards.org/documents/Tokenization_Guidelines_Info_Supplement.pdf
  57. https://www.pcisecuritystandards.org/documents/pci_glossary_v20.pdf
  58. https://www.thoropass.com/blog/pci-dss-encryption-requirements
  59. https://www.worldpay.com/en/insights/articles/why-emv-chip-cards-are-replacing-magnetic-stripes
  60. https://usa.visa.com/dam/VCOM/download/corporate/media/visanet-technology/visa-net-booklet.pdf
  61. https://www.emvco.com/news/emvco-reports-12-billion-emv-chip-cards-in-global-circulation/
  62. https://standards.iteh.ai/catalog/standards/iso/395083c3-fb0c-476b-983b-49e71c7eeb2d/iso-iec-7812-1-2000
  63. https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml
  64. https://cybriant.com/2022/11/22/payment-card-industry-data-security-standard/
  65. https://www.emvco.com/why-emv/
  66. https://www.americanbanker.com/payments/news/here-comes-emv
  67. https://www.emvco.com/knowledge-hub/whats-next-in-payments-highlights-from-the-2025-emv-user-meeting/
  68. https://blog.ansi.org/ansi/ansi-asc-x9-financial-services-industry-standards/
  69. https://www.bankofcanada.ca/wp-content/uploads/2010/09/psac1.pdf
  70. https://www.payments.ca/sites/default/files/PaymentsCanada_Canadian_Payment_Methods_and_Trends_Report_2023_En.pdf
  71. https://europa.eu/rapid/press-release_MEMO-11-936_en.htm
  72. https://www.ecb.europa.eu/pub/pdf/other/cardpaymineu_renfoconsepaforcards201404en.pdf
  73. https://docs.trellix.com/bundle/data-loss-prevention-11.10.x-classification-definitions-reference-guide/page/UUID-66dc7dfe-d19d-efb0-2fcf-5c5f564c00d6.html
  74. https://docs.trellix.com/bundle/data-loss-prevention-11.10.x-classification-definitions-reference-guide/page/UUID-4aed074e-5672-938f-622a-e7613ce82f73.html
Add your contribution
Related Hubs
User Avatar
No comments yet.