Card number inspection is the process of checking a payment card number's length, prefix, Luhn check digit, BIN range, and expiry format to confirm the number is structurally well formed. It answers one narrow question: could this string be a real card number? It does not confirm that the account exists, is open, or holds funds.
What does card number inspection verify?
A standard inspection pass runs five checks, all of which are arithmetic or format based. None of them contact the issuing bank.
Card Number Authentication Process: How It Works
- Length and prefix: 13 to 19 digits, with the leading digit mapping to a network such as 4 for Visa or 5 for Mastercard.
- Luhn check digit: the final digit, recomputed from the preceding digits.
- BIN or IIN range: the first 6 to 8 digits, which identify the issuer and card product.
- Expiry format: a valid MM/YY value that falls after the current date.
- Character set: digits only, with no spaces or punctuation.
How does the Luhn algorithm work?
Luhn validation doubles every second digit starting from the right, subtracts 9 from any result above 9, and sums the total. If the sum is divisible by 10, the number passes. The check catches single-digit typos and most adjacent-digit swaps, which are the most common data-entry errors.
card number authentication process
What card number inspection cannot tell you
Inspection cannot reveal whether an account is open, has available credit, or is authorized for a charge. A number that passes Luhn is only arithmetic-consistent, and roughly one in ten randomized digit strings passes the same test. Only the issuer's authorization response confirms that a card is live.
card number verification method
Why do merchants inspect card numbers before authorization?
Format checks reject obvious typos at checkout, before a request ever reaches the gateway. That reduces failed authorization fees, cuts decline noise in fraud queues, and keeps the customer on the page. Inspection is a filter, not a fraud decision.
What is a BIN attack?
A BIN attack, also called card testing, uses bots to submit large volumes of generated numbers against a checkout in order to discover live accounts. Attackers exploit merchants with weak rate limiting because a successful charge confirms the card. Layered defenses include velocity limits, CAPTCHA, address verification, and requiring the security code on every attempt.
How does PCI DSS affect stored card numbers?
The PCI Data Security Standard prohibits storing the full PAN unless there is a documented business need, and it never permits retaining the security code after authorization. Stored account data must be rendered unreadable through encryption, truncation, or tokenization. Inspection at checkout should happen in memory, not in a log file or database column.
Frequently asked questions
Is a card number that passes Luhn valid?
No. Passing Luhn means the digits are internally consistent, nothing more. Validity is determined only by the issuer during authorization.
Should you ever store full card numbers in a database?
Rarely and only with a documented need, strong encryption, and full PCI DSS scope. Tokenization removes the need in almost every case.
What is the difference between card number validation and authorization?
Validation is a local format check that costs nothing and contacts no one. Authorization is a live request to the issuer that returns an approve or decline decision.