If you’re curious about business, technology, or how things work in your everyday life, you may enjoy learning how credit card account numbers work. Those numbers ensure easy payments, and they also help prevent payment errors and credit card fraud. Card numbers are evolving, and they may look different in the coming years.
The Parts of an Account Number
Credit card numbers fall under identification card standards set by the International Organization for Standardization and International Electrotechnical Commission. As a result, a straightforward formula dictates the format.
Credit card account numbers, also known as primary account numbers (PANs), consist of three main components:
- Information about the card issuer
- Your account information
- A check digit
The first part of the number on identification cards that follow these standards—including credit cards and debit cards—consists of information about the card’s issuer.
Industry number: The first digit of your card is an industry identifier, which indicates the type of business the issuer of your card is involved in or, in some cases, outright identifies the type of credit card, such as Visa or Mastercard.
|Credit Card Industry Numbers|
|2||Some Mastercard accounts since 2017|
|3||American Express and Diners Club|
Issuer identification number: The next six to eight digits are an issuer identification number (IIN), which is also called a bank identification number (BIN). That number specifies which financial institution issued your card.
Under the direction of the ISO/IEC, all issuers of credit cards are transitioning from a six-digit IIN or BIN to an eight-digit one. This change was made to increase the number of potential IINs/BINs and prevent a shortage of them.
Visa will start assigning eight-digit BINs in April 2022.
Your Account Information
The remaining digits, except for the last digit, are unique to your specific credit card account. They are selected by the issuer.
The last digit of a 16-digit PAN is the check digit—an essential part of a checksum, which helps to ensure that a credit card number is valid. The check digit is not selected by the credit card issuer but is determined mathematically based on the Luhn algorithm. A series of steps provides a quick and easy way to ensure the numbers entered from your card for payment follow an acceptable pattern. Ultimately, the algorithm looks for an output that is divisible by 10, indicating that the card number is potentially valid.
Read the numbers from right to left, skipping over the check digit, which will be used later in the process. Starting with the second digit from the right, double every other number. If a resulting number is two digits, such as 18, you will add the two digits together—in this case, to get 9. Add up all of these numbers. Then add up the digits you skipped when you were doing the doubling. Finally, add those totals together, along with the check digit. The result will be divisible by 10.
The checksum provides basic quality control, but it does not provide robust protection against fraud. The algorithm is publicly available, so anybody can generate card numbers that satisfy the requirement. However, this is a helpful step to catch data entry errors and unsophisticated thieves quickly.
Card Number Lengths
PANs may be eight to 19 digits long, but once the eight-digit IIN expansion is completed, PANs will have to be at least 10 digits. The maximum number of digits will remain 19.
Visa, Mastercard, and Discover cards most often are 16 digits long, and American Express cards typically have 15 digits.
Your credit card account number contains essential information for processing payments, but in many cases, you also need a security code, also called a card verification value (CVV). When ordering online or by phone, you typically need to provide the security code to complete your purchase. That code helps verify that you have possession of the card, and that someone isn't using a stolen credit card number. Your card number may be compromised in data breaches or by card skimmers, but getting the code is an additional hurdle for thieves.
- Visa, Mastercard, and Discover cards display a three-digit CVV on the back of the card.
- American Express cards display a four-digit CCV on the front of the card.
Traditional readers receive your credit card account information directly from a magnetic strip. It’s easy to steal a card number from a magnetic strip, and you potentially expose your account number every time you swipe your card. Some merchants in the U.S. still use magnetic card readers, but those readers are increasingly being replaced with more secure technology.
EMV stands for Europay, Mastercard, and Visa, the three companies that pioneered the chip technology.
NFC mobile payments: When you pay with your mobile phone, your phone sends encrypted payment information to a payment terminal with near-field communication (NFC). You'll need to have entered your card number in your device’s payment app before you can begin making a mobile payment, but your device will not transmit your actual card number.
Tokenization: Instead of providing card information to a merchant’s payment terminal “in the open,” the information can be replaced with a random series of characters known as a token. Hackers are unable to make sense of the stolen data because it wasn't created by an algorithm that could be decrypted.
EMV cards: Credit cards with a smart chip, which are known as EMV cards, also protect your credit card number. Instead of swiping your card and providing an unencrypted account number, you insert your card’s chip into a chip reader.
The chip contains a processor that is able to encrypt your information as well as generate a code that is unique for a single transaction. That interactive process and the chip that's crucial to it are hard for would-be thieves to duplicate.