Answer first

A card number examination has three parts: check the digit structure, run the mod-10 checksum, then look up the first digits in an issuer database. Each part is a filter. Together they show the number is well formed and which bank issued it. They do not show the account is open or that funds exist.

card number authentication process

Step 1: Check the digit structure

ISO/IEC 7812-1 sets the layout. A number holds 8 to 19 digits in four fields.

more on this topic

  • Major industry identifier: digit one. Values 4 and 5 mark banking and financial.
  • Issuer identification number: digits two through seven, or two through nine. Six digits is the common length. Eight digits since 2016.
  • Individual account number: the middle block.
  • Check digit: the final digit.

A string below 8 digits or above 19 fails the format test before any math runs.

Card Number Authentication Process: How It Works

Step 2: Run the Luhn formula

Hans Peter Luhn filed the mod-10 check formula at IBM in 1954. US Patent 2,950,048 issued in 1960. The formula catches single-digit typos and most adjacent digit swaps.

Card Number Inspection: How Card Validation Works

  1. Start at the rightmost digit and move left.
  2. Double every second digit. If a doubled value reaches 10 or more, subtract 9.
  3. Add all digits together.
  4. If the total divides by 10 with no remainder, the number passes.

Example: 4111 1111 1111 1111. The doubled digits sum with the rest to 30. 30 mod 10 is 0, so the string passes. This value appears in gateway test documentation. It is not a live account.

The limit matters: one in ten random digit strings passes Luhn. The formula is a typo filter. It is not an authenticity test.

Step 3: Look up the issuer

The issuer identification number maps to a bank, a country, and a card product. Card networks publish these ranges. A lookup returns brand, issuing country, and card type: credit, debit, prepaid, or commercial. It does not return the cardholder name.

What an examination cannot show

  • Account status. A closed account keeps a valid number.
  • Credit limit or balance.
  • Expiry date. That is printed on the card face.
  • CVV2 or CVC2. The three-digit code is generated at issue and is not derived from the number.
  • Billing address match. That needs an authorization request.

Only an authorization message to the issuing bank returns an approval or a decline. PCI DSS bars merchants from keeping the CVV2 or full track data after authorization, so those values are not recoverable from a stored record.

Trafficking in card numbers is a federal offense under 18 U.S.C. § 1029.