Technology Update: Understanding your Credit Card Number

Bank cards: just a small (85.60 × 53.98 mm) piece of plastic that we keep in our wallets, carry around with us and use every day.  They are an important part of our lives, but we just take them for granted. They may look mundane, but those insignificant bits of plastic are responsible for many millions of financial transactions globally every day, in which billions of dollars are exchanged.  Spare a thought for that seemingly humble scrap of plastic: it may be small but it has a huge amount of technology crammed into it.  There may be a magnetic stripe or a computer chip, a security hologram, the CVV security code (aka Card Verification Value or Card Security Code), and, in some cases, embedded circuits containing information for contactless processing.

The Primary Account Number

A major component of the whole process is the card number, often referred to as the Primary Account Number, or PAN. This is that long number on the front of your bank card: do you know what it means and how it works? It has meaning and structure, and is certainly not just a random string of unrelated digits!  The string of  sixteen digits on a credit or debit card conforms to an internationally recognised standard and plays an important role in the technology that enables us to make cash-free transactions instantly, accurately, and internationally.

International Standards

Over decades of development of payment systems technology international standards have been established and agreed between card issuing banks and other institutions, including a network of national standards bodies, like ANSI, the American National Standards Institute, and ISO, the International Standards Organization.  

The first six digits of the PAN are defined by the card issuer (eg, Visa, Amex, MasterCard), and are known as the Issuer Identification Number, or IIN*. The first component of the IIN, Digit 1, gives an indication of the source of your card, and is known as the Major Industry Identifier, or MII. Bank cards will always start with 4, 5 or 6, which relate to the banking and finance sectors. See my footnote for a complete list of IINs. ANSI is responsible for maintaining and administering a database of IINs.

Check Digit Validation

The last digit of the PAN is the check digit; the most interesting and important component of the entire account number.  It is used to ensure the validity and security of the card number, by using a simple arithmetical check known as the Luhn Algorithm, sometimes also known as a modulus 10 check.   For those of you who are not natural mathematicians or who have long since forgotten everything you learned in mathematics class at school: don’t panic. It really is a simple procedure.

For example, look at this PAN: 4012 8888 8888 1881.

To carry out a manual check digit test on this number, work through the entire sixteen digits from right to left, starting with the character next to the check digit, multiplying every other digit by two like this:-                     

4	0	1	2	8	8	8	8	8	8	8	8	1	8	8	1
x 2		x 2		x 2		x 2		x 2		x 2		x 2		x 2
8		2		16		16		16		16		2		16

If the result of any of the multiplication is a two-digit number, add each two-digit number to achieve a single character, like this:-

4	0	1	2	8	8	8	8	8	8	8	8	1	8	8	1
8		2		16		16		16		16		2		16
8		2		7		7		7		7		2		7

Now add in the odd digits which were not multiplied by two:-

4	0	1	2	8	8	8	8	8	8	8	8	1	8	8	1
8	0	2	2	7	8	7	8	7	8	7	8	2	8	7	1

Add this row of numbers up:-
             8+0+2+2+7+8+7+8+7+8+7+8+2+8+7+1= 90.
If this final number is divisible by 10, then, as far as the check digit routine is concerned, the card number is valid. In this case, the result is 90, so success! Our PAN has passed the check digit validation.

Bank Number Security

How does check digit validation help to make my credit or debit card more secure? Well, it is just one part of a set of computer checks carried out for every credit or debit card transaction. It does ensure, however, that any sixteen digits entered into a transaction processing system are at least in the correct sequence and constitute a potentially valid bank card number.  For additional security, a whole range of further tests are in place, including Chip & PIN or magnetic stripe validation, CVV checking, and customer passwords such as ‘Verified by Visa’ or ‘MasterCard SecureCode’.

* Footnote: Full list of IIN Allocations

      0 – ISO/TC 68 and other future industry assignments

      1 – Airlines

      2 – Airlines and other future industry assignments

      3 – Travel and entertainment and banking/financial

      4 – Banking and financial

      5 – Banking and financial

      6 – Merchandising and banking/financial

      7 – Petroleum and other future industry assignments

      8 – Healthcare, telecommunications and other future industry assignments

      9 – National assignment