How Credit Card Numbers Work — The Luhn Algorithm Explained

Every credit card number follows a precise structure that encodes the card network, issuing bank, account identifier, and a self-checking digit. Understanding this structure helps developers build better payment forms, testers validate input handling, and curious minds appreciate the engineering behind everyday finance.

Anatomy of a Credit Card Number

A credit card number is not a random string of digits. It is a carefully structured identifier made up of three distinct parts:

1. Issuer Identification Number (IIN/BIN) — First 6-8 Digits

The first six to eight digits are called the Issuer Identification Number (IIN), formerly known as the Bank Identification Number (BIN). These digits identify two things: the card network (Visa, Mastercard, etc.) and the specific bank or financial institution that issued the card.

The very first digit is called the Major Industry Identifier (MII) and indicates the broad category of the issuer:

• 1, 2 — Airlines
• 3 — Travel and entertainment (American Express, Diners Club)
• 4 — Banking and financial (Visa)
• 5 — Banking and financial (Mastercard)
• 6 — Merchandising and banking (Discover)
• 7 — Petroleum
• 8 — Healthcare, telecommunications
• 9 — National assignment

2. Account Number — Middle Digits

The digits between the IIN and the check digit form the individual account number. This portion is assigned by the issuing bank and uniquely identifies the cardholder's account. For a typical 16-digit Visa card with a 6-digit IIN, this means digits 7 through 15 (nine digits) represent the account number, allowing up to 1 billion unique accounts per IIN range.

3. Check Digit — Last Digit

The final digit is a check digit calculated using the Luhn algorithm. It serves as a quick error-detection mechanism — if someone mistypes a single digit when entering their card number, the Luhn check will catch it immediately without needing to contact the bank.

Major Card Networks

Each card network has its own IIN ranges and card number lengths:

The Luhn Algorithm — Step by Step

The Luhn algorithm (also called the "modulus 10" or "mod 10" algorithm) was created by IBM scientist Hans Peter Luhn in 1954. It detects any single-digit error and most transpositions of adjacent digits. Here is how it works:

How to Validate a Card Number

1. Start from the rightmost digit (the check digit) and move left
2. Double every second digit (i.e., the second-to-last, fourth-to-last, etc.)
3. If doubling results in a number greater than 9, subtract 9 from it
4. Sum all the digits
5. If the total modulo 10 equals 0, the number is valid

Worked Example

Let's validate the number 4539 1488 0343 6467:

Why Fake Card Numbers Pass Validation but Cannot Make Purchases

When a generator creates a fake credit card number, it constructs the number to pass the Luhn checksum. This means the number has a valid format — the correct prefix for the card network, the right number of digits, and a mathematically correct check digit.

However, passing Luhn validation is just the first of many checks a card must clear to complete a transaction:

1. Luhn validation — format check (fake numbers pass this)
2. BIN lookup — the issuer verifies the IIN range is assigned to them
3. Account lookup — the issuer checks if the account number exists in their database
4. Authorization — the issuer verifies available credit, card status, fraud flags, and more
5. CVV/CVC verification — a cryptographic check against the card's security code
6. AVS (Address Verification) — the billing address is matched

A generated number will fail at step 2 or 3 because the account number does not exist in any bank's database. This is why fake card numbers are useful for testing form validation but cannot be used for fraud.

CVV/CVC Explained

The Card Verification Value (CVV) or Card Verification Code (CVC) is a 3- or 4-digit security code printed on the physical card but not encoded in the magnetic stripe or card number itself.

• Visa, Mastercard, Discover: 3-digit code on the back (called CVV2 or CVC2)
• American Express: 4-digit code on the front (called CID)

The CVV is generated using a cryptographic algorithm that takes the card number, expiration date, and a secret key held only by the issuer. This means it is impossible to calculate a valid CVV from just the card number — you need the issuer's secret key.

Expiration Dates

Credit card expiration dates are formatted as MM/YY and serve several purposes:

• Security rotation — forces periodic card replacement, which updates the CVV
• Card-not-present verification — merchants require the expiration date for online transactions
• Physical wear — cards degrade over time, especially magnetic stripes

Most cards are issued with a 3-5 year validity period. The card expires at the end of the printed month — a card showing 03/27 is valid through March 31, 2027.

How to Identify Card Type from the First Digits

You can determine the card network with just the first one or two digits. This is how payment forms auto-detect the card type and show the appropriate logo as you type:

Frequently Asked Questions