When you are asked to input your card information online, how is it that some websites can automatically know if you input an invalid number and others cannot, before payment is processed?Example: as soon as I typed the last number of my card wrong, it went red and would not allow me to continue before I corrected it.
In: 340
This is a security constraint built into the numbers.
Credit card numbers are not just randomly generated. The numbers encode information such as the card issuer.
They also stick the first 15 numbers into an algorithm that spits out a single digit. That digit is the 16th number on your card.
A website can check these things. Does the 16th digit match the result of the algorithm applied to the first 15? Do the numbers that map to the issuer map correctly (does your discover card number start with a 6?).
The last digit in the credit card number is a check digit. It is calculated based on the other digits. So if you know all but the last digit you can calculate the last digit, and similarly if you know all the digits you can check if they are typed inn wrong. If the check digit is right it does not mean that the credit card number actually belongs to the payee or even anyone. But it makes it harder to make simple mistakes like typing inn the wrong digit or swapping two digits around.
TMI About Credit Card Numbers
There’s actually a ton of information contained in a credit card number. This information isn’t really necessary for understanding how to use a credit card, it’s just here so you can learn for fun. The ISO or the International Organization for Standardization categorizes the numbers like so:
Digits 1 – 6: Issuer identifier numbers
First digit: Represents the network that produced the credit card. It is called the Major Industry Identifier (MII). Each digit represents a different industry.
0: ISO/TC 68 and other industry assignments
1: Airlines
2: Airlines, financial and other future industry assignments
3: Travel and entertainment
4: Banking and financial
5: Banking and financial
6: Merchandising and banking/financial
7: Petroleum and other future industry assignments
8: Healthcare, telecommunications and other future industry assignments
9: For assignment by national standards bodies
The first digit is different for each card network:
Visa cards begin with a 4 and have 13 or 16 digits
Mastercard cards begin with a 5 and has 16 digits
American Express cards begin with a 3, followed by a 4 or a 7 has 15 digits
Discover cards begin with a 6 and have 16 digits
Diners Club and Carte Blanche cards begin with a 3, followed by a 0, 6, or 8 and have 14 digits
Digits 2 – 6: Provide an identifier for a particular institution
Digits 7 – 15: Unique personal identifiers
Identify the cardholder name
Unique to the issuer
Digit 16: Check digit
This last digit verifies card numbers for accuracy to make sure that they weren’t input incorrectly
The rest of the digits are also different for each card network:
Visa cards:
Digits 2 – 6: Make up the bank number
Digits 7 – 12 or 7 – 15: Represent the account number
Digits 13 or 16: Is a check digit
Mastercard cards:
Digits 2 & 3, 2 – 4, 2 – 5, or 2 – 6: Make up the bank number; depends on whether digit two is a 1, 2, 3 or other digit
Digits after the bank number, up to digit 15: Represent the account number
Digit 16: Is a check digit
American Express cards:
Digits 3 & 4: Are type and currency
Digits 5 – 11: Represent the account number
Digits 12 – 14: Represent the card number within the account
Digit 15: Is a check digit
A lot of answers here are talking about it, but none specifically mentioning the actual algorithm and how it works. It’s called the Luhn algorithm, and credit cards must use it. It is a very simple algorithm to run it and see if the number you input passes. If it doesn’t, it’s not a real number. That said, there are plenty of numbers that CAN pass which aren’t valid, 4444333322221111 just as a simple example. So passing the Luhn check does not guarantee it is a good number, it just means it passes a basic test so they can then send it on for actual processing.
https://en.m.wikipedia.org/wiki/Luhn_algorithm
Because cards from different banks have set prefix numbers like every debit card at academy bank has the exact same first 8 numbers and all armed forces debit cards have the exact same first 8 digits. and different cards types start with different numbers and it’s set for all cards of that type, like all visas start with a 4 and all Mastercards start with 5. Card numbers can even tell you if it’s debit or credit or prepaid. They’re not random at all, there a system to it.
Eli5: the first couple of digits and the last digit are important, and can be compared with the other digits you entered to do a quick check to see if your card number is definitely invalid.
The first digit or two determine what type of card you have (visa, amex, MasterCard etc), which says how many digits you should have in total, and what the CVV should be like.
The last digit is a “check digit”. It’s calculated using a special formula that will add up to the wrong number if you make one of the most common mistakes people make when copying data (ie. Swapped digits, one number wrong, one number skipped etc.). There’s actually a lot of science and testing that went into that algorithm/calculation – which uses a single digit to check all the other digits in your input.
These checks are done by your web browser (not the server), before your data is submitted. Once you submit the data the web server either checks with the bank, or does a few extra checks before storing your data for future sending to the bank (these are called MOTO transactions in the industry, originally meaning Mail Order / Telephone Order transactions).
(This is a ELI5. Other top level replies have more detail if you’re curious)
Every card number is issued following a mathematical formula called “Luhn algorithm”.
From each card number a checksum can be calculated by adding some together, multiplying others withing a set of rules.
This is easy for a computer and even a browser can do it instantly.
This prevents just putting in a random number by hand.
There’s a pretty simple calculation you can do on a cc number to check if it’s an allowable number within the cc numbering system, and it doesn’t require access to the cc company to look anything up.
The rightmost digit is what’s known as a ‘checksum’. It’s the result of a calculation on the other digits as described [here](https://www.creditcardvalidator.org/articles/luhn-algorithm). Just google ‘credit card checksum’ for more sources.
Basically, you double every 2nd digit in the cc number starting from the end, subtract 9 from each if it’s greater than 9, add them all up, multiply the total by 9 and the last digit of the result is what was originally appended to the end of the cc number as the last digit on the right.
Different cc companies may use variation of this rule but this is the most common method. All cc numbers use some kind of checksum system when creating new account numbers.
If a customer gives you a cc number and it doesn’t pass the checksum test then you don’t have to bother checking any further. It’s invalid.
Latest Answers