Short answer
A card number generator test produces digit strings that pass the Luhn checksum with a valid length and a valid check digit. The strings are not tied to a bank account. Payment processors accept them in sandbox mode and reject them at live endpoints.
What the test checks
- Length. ISO/IEC 7812 sets the primary account number at 8 to 19 digits.
- Check digit. The Luhn formula, from IBM engineer Hans Peter Luhn in 1960, doubles every second digit from the right and subtracts 9 from each result above 9. The total must divide by 10.
- Prefix. The first 6 to 8 digits form the issuer identification number. The leading digit marks the network: 4 for Visa, 51 to 55 and 2221 to 2720 for Mastercard, 34 and 37 for American Express.
Sandbox numbers
Stripe, PayPal, and Adyen publish fixed test PANs. 4242 4242 4242 4242 is the Stripe Visa value. It returns an approval in test mode. The same digits fail a live authorization request.
What a generator cannot do
A generator has no access to issuer records. It cannot confirm that a number maps to an open account, that the expiry date is current, or that the CVV matches. It cannot pass 3-D Secure or an address verification check. Published test values are flagged and blocked by live acquirers.
Legal status
Running generated numbers against a live merchant is carding. In the United States, 18 U.S.C. 1029 covers access device fraud. A first offense carries up to 10 years, a second up to 20 years. Test PANs belong in a sandbox with test credentials.
PCI scope
PCI DSS governs real account data. Test values in a development environment sit outside the cardholder data environment when no real account produced them.