How Credit Card Validation Works: The Luhn (Mod 10) Algorithm Explained
Every modern credit and debit card issued worldwide conforms to the strict international formatting standard ISO/IEC 7812. Far from being a random string of numbers, a payment card number is a mathematically structured sequence composed of distinct identifying segments: the Major Industry Identifier (MII), the Bank Identification Number (BIN or IIN), the unique account number, and a final Luhn check digit.
The Luhn Algorithm (also designated as the Modulus 10 or Mod 10 algorithm) was patented in 1954 by IBM scientist Hans Peter Luhn. Designed as a fault-tolerant verification mechanism, it mathematically detects accidental mistypes, transposed digits, and inverted numbers before a payment request is ever submitted to a bank or payment processor.
The Anatomy of a Payment Card Number
Major Industry Identifier (MII)
The first digit identifies the issuer's primary industrial sector. For instance, 4 and 5 signify Banking & Financial institutions; 3 represents Travel & Entertainment (Amex); and 6 represents Merchandising & Banking (Discover).
Issuer Identification Number (IIN/BIN)
The first 6 to 8 digits represent the Bank Identification Number (BIN). This identifies the exact issuing bank (e.g., Chase, Wells Fargo, Barclays, Citibank) and the card level (Classic, Platinum, Signature).
Individual Account Identifier
The middle sequence of numbers (digits 7 through 15 on a standard 16-digit card) represents the customer's unique personal or corporate account number registered with the issuing bank.
The Check Digit (Luhn Digit)
The final digit is calculated using the Luhn formula against all preceding digits. If any digit is mistyped, the checksum calculation immediately fails.
Global Payment Card Specifications & IIN Ranges
| Card Network | Starting Prefix (IIN) | Valid Length(s) | CVV / CVC Length |
|---|---|---|---|
| Visa | 4 |
13, 16, 19 digits | 3 digits |
| MasterCard | 51 – 55 or 2221 – 2720 |
16 digits | 3 digits |
| American Express (Amex) | 34 or 37 |
15 digits | 4 digits (front) |
| Discover | 6011, 622126–622925, 644–649, 65 |
16, 19 digits | 3 digits |
| JCB | 3528 – 3589 |
16 to 19 digits | 3 digits |
| Diners Club | 300 – 305, 36, 38 |
14 to 19 digits | 3 digits |
| UnionPay | 62 |
16 to 19 digits | 3 digits |
| Maestro | 50, 56–58, 6 |
12 to 19 digits | 3 digits |
Developer & QA Sandbox Test Numbers
When building e-commerce checkout forms, billing systems, or integrating payment processors like Stripe, PayPal, Braintree, or Square, developers use dummy card numbers that pass the mathematical Luhn check without charging real money:
| Network | Standard Test Card Number | Expiry | Test CVV | Gateway Usage |
|---|---|---|---|---|
| Visa (Test) | 4000 0000 0000 0002 |
Any Future Date | 123 |
Stripe / PayPal Sandbox |
| MasterCard (Test) | 5555 5555 5555 4444 |
Any Future Date | 123 |
Stripe / Braintree Sandbox |
| Amex (Test) | 3782 822463 10005 |
Any Future Date | 1234 |
Stripe / Authorize.Net |
| Discover (Test) | 6011 0000 0000 0000 |
Any Future Date | 123 |
Universal Sandbox |
Note: Test numbers are for development sandboxes only and will never authorize transactions in live production environments.
How the Luhn Algorithm Calculates Checksums (Manual Math)
Curious how the math actually works? Here is the step-by-step procedure:
- Starting from the rightmost digit (excluding the check digit) and moving left, double the value of every second digit.
- If doubling a digit results in a number greater than 9 (e.g.
7 × 2 = 14), add the individual digits together (1 + 4 = 5) or subtract 9 (14 - 9 = 5). - Sum all the resulting numbers together, including the unchanged digits and the check digit.
- If the total modulo 10 equals 0 (i.e. the total ends in 0), the number is mathematically valid.
Frequently Asked Questions (FAQ)
Is it safe to type my card number into this validator?
Yes. Neksio Credit Card Validator operates 100% on the client side inside your local browser sandbox. No input is ever transmitted across the internet, recorded, or saved to a database. However, for maximum personal security, we recommend testing with dummy sandbox cards or obfuscating the middle digits.
Can this tool check if a card is stolen or blocked?
No. Only a licensed acquiring bank communicating directly with the card network (VisaNet, Mastercard Banknet) through an authorized merchant terminal can verify account standing, fraud flags, or credit limits.
Why do American Express cards have 15 digits instead of 16?
American Express developed its own proprietary account numbering schema prior to the widespread standardization of the 16-digit format. Amex formats card numbers in a 4-6-5 grouping (totaling 15 digits) and uses a 4-digit security code (CID) printed on the front of the card.
What is an IIN / BIN lookup?
An Issuer Identification Number (IIN), commonly referred to as a Bank Identification Number (BIN), comprises the first 6 to 8 digits of a payment card. Payment gateways use BIN tables to identify the issuing institution, card brand, card type (Credit vs Debit vs Prepaid), and issuing country.