What a card number test checks
A card number test runs a payment card number through format rules and a checksum. The checksum is the Luhn algorithm, a mod-10 formula. A number that passes Luhn has correct digit structure. It does not prove the account exists, holds funds, or matches a CVV.
The Luhn algorithm
Luhn was published in 1960 by Hans Peter Luhn at IBM. It reads the digits from right to left and doubles every second digit. If a doubled digit is above 9, subtract 9. Add all digits. The number passes when the total ends in 0.
The check catches every single-digit typo and adjacent transpositions, with one exception: 09 swapped to 90. A random string of digits passes about 1 time in 10. Luhn alone is a weak filter.
Card number structure
ISO/IEC 7812 sets the layout. The first 8 digits are the issuer identification number, also called the BIN. The last digit is the check digit. Length runs from 8 to 19 digits. Most consumer cards use 16. American Express uses 15 digits and a 4-digit security code. Visa and Mastercard use 3.
Test card numbers in development
Payment processors publish test card numbers for sandbox use. Stripe lists 4242 4242 4242 4242 as a Visa test number. These numbers pass Luhn and work in test mode. A live gateway declines them.
What a test does not cover
- Expiry date validity
- CVV or CVC match
- Account status and balance
- 3-D Secure challenges
- Issuer fraud rules
Legal limits
Using a card number you do not own against a live payment system is card fraud. In the US, 18 U.S.C. § 1029 covers access devices and carries prison terms. Developers use sandbox keys and published test numbers. Merchants who store card numbers must follow PCI DSS.