Payment card number

Last updated

A payment card number, primary account number (PAN), or simply a card number, is the card identifier found on payment cards, such as credit cards and debit cards, as well as stored-value cards, gift cards and other similar cards. In some situations the card number is referred to as a bank card number. The card number is primarily a card identifier and may not directly identify the bank account number(s) to which the card is/are linked by the issuing entity. The card number prefix identifies the issuer of the card, and the digits that follow are used by the issuing entity to identify the cardholder as a customer and which is then associated by the issuing entity with the customer's designated bank accounts. In the case of stored-value type cards, the association with a particular customer is only made if the prepaid card is reloadable. Card numbers are allocated in accordance with ISO/IEC 7812. The card number is typically embossed on the front of a payment card, and is encoded on the magnetic stripe and chip, but may also be imprinted on the back of the card.

Contents

The payment card number differs from the Business Identifier Code (BIC/ISO 9362, a normalized code—also known as Business Identifier Code, Bank International Code or SWIFT code). It also differs from Universal Payment Identification Code, another identifier for a bank account in the United States.

Structure

Payment card numbers are composed of 8 to 19 digits, [1] The leading six or eight digits are the issuer identification number (IIN) sometimes referred to as the bank identification number (BIN). [2] :33 [3] The remaining numbers, except the last digit, are the individual account identification number. The last digit is the Luhn check digit. IINs and PANs have a certain level of internal structure and share a common numbering scheme set by ISO/IEC 7812. The parts of the number are as follows:

  1. IIN length has been extended to 8-digits in fifth edition of ISO/IEC 7812 published in 2017 [4] and PAN will continue to remain variable length, ranging from 10 to 19 digits.

Issuer identification number (IIN)

Partial IIN on a credit card (both printed and embossed) Credit card-first 4 digits.jpg
Partial IIN on a credit card (both printed and embossed)

The first six or eight digits of a card number (including the initial MII digit) are known as the issuer identification number (IIN). These identify the card issuing institution that issued the card to the card holder. The rest of the number is allocated by the card issuer. The card number's length is its number of digits. Many card issuers print the entire IIN and account number on their card.

In some circumstances, the issuer identification number (IIN) or bank identification number (BIN) may not be licensed directly from the issuing network (such as Mastercard or Visa). Obtaining an IIN/BIN number can be costly, time consuming and demand intensive operational burdens on in-house regulatory and compliance teams. For this reason, some new card programmes may use a 'BIN sponsor', in which case the IIN/BIN number is effectively sub-licensed from a scheme regulated entity. This is known as BIN sponsorship, and is a popular way for financial institutions to fast-track access to market. [6]

In the United States, IINs are also used in NCPDP pharmacy claims to identify processors, and are printed on all pharmacy insurance cards. IINs are the primary routing mechanism for real-time claims.

The ISO Register of Issuer Identification Numbers database is managed by the American Bankers Association. ABA is the Registration Authority for this standard and is responsible for allocating IINs to issuers.

Online merchants may use IIN lookups to help validate transactions. For example, if a card's IIN indicates a bank in one country, while the customer's billing address is in another, the transaction may call for extra scrutiny.

Issuing networkIIN rangesActiveLengthValidation
American Express 34, 37 [7] Yes15 [8] Luhn algorithm
Bankcard [9] 5610, 560221–560225No16
China T-Union 31Yes19
China UnionPay 62Yes16–19 [10]
Diners Club enRoute Yes15No Validation
Diners Club International [11] 30, 36, 38, 39Yes14–19 [10] Luhn algorithm
Diners Club United States & Canada [12] 55Yes16
Discover Card 6011, 644-649, 65Yes16–19 [10]
622126–622925 (China UnionPay co-branded)Yes16–19 [10]
UkrCard 60400100–60420099Yes16–19
RuPay 60, 65, 81, 82, 508Yes16
353, 356 (RuPay-JCB co-branded)Yes16
InterPayment 636Yes16–19
InstaPayment 637–639Yes16
JCB 3528–3589Yes16–19 [10]
Laser 6304, 6706, 6771, 6709No16–19
Maestro UK6759, 676770, 676774 [13] Yes12–19
Maestro 5018, 5020, 5038, 5893, 6304, 6759, 6761, 6762, 6763Yes12–19
Dankort 5019Yes16
4571 (Visa co-branded) [14] Yes16
Mir 2200–2204Yes16–19
BORICA (Bulgarian national payment system) 2205Yes16
NPS Pridnestrovie 6054740–6054744No [15] 16
Mastercard 2221–2720 [16] Yes (since 2017) [17] 16
51–55 [16] Yes16
Solo 6334, 6767No16, 18, 19
Switch 4903, 4905, 4911, 4936, 564182, 633110, 6333, 6759No16, 18, 19
Troy 65 (Discover co-branded [18] )Yes16
9792 [19] Yes16
Visa 4Yes13, 16, 19
Visa Electron 4026, 417500, 4508, 4844, 4913, 4917Yes16
UATP 1Yes15
Verve 506099–506198, 650002–650027, 507865–507964Yes16, 18, 19
LankaPay357111Yes16
UzCard 8600, 5614Yes16Unknown
Humo 9860Yes16
GPN 1946 (BNI cards)Yes16, 18, 19 Luhn algorithm
50, 56, 58, 60–63Yes16, 18, 19
Napas 9704Yes16, 19Unknown

On 8 November 2004, Mastercard and Diners Club formed an alliance. Diners Club cards issued in Canada and the United States start with 54 or 55 and are treated as Mastercards worldwide. International cards use the 36 prefix and are treated as Mastercards in Canada and the United States, but are treated as Diners Club cards elsewhere. Diners Club International's website makes no reference to old 38 prefix numbers, and they can be presumed reissued under the 55 or 36 IIN prefix. Effective 16 October 2009, Diners Club cards beginning with 30, 36, 38 or 39 have been processed by Discover Card. [20]

On 3 November 2014, Mastercard announced that they were introducing a new series of BIN ranges that begin with a "2" (222100–272099). The "2" series BINs will be processed the same as the "51–55" series BINs are today. They became active 14 October 2016.

On 23 July 2014 JSC NSPK was established in the Russian Federation. The joint stock company National System of Payment Cards (NSPK) is the operator of the Mir National Payment System. The main initiatives of NSPK are to create the national payment system infrastructure and to issue a national payment card, Mir.

Effective 1 October 2006, Discover began using the entire 65 prefix, not just 650. Also, similar to the Mastercard/Diners agreement, China UnionPay cards are now treated as Discover cards and accepted on the Discover network.

While the vast majority of Visa's account ranges describe 16 digit card numbers there are still a few account ranges (forty as of 11 December 2013) dedicated to 13 digit PANs and several (439 as of 11 December2013) account ranges where the issuer can mix 13 and 16 digit card numbers. Visa's VPay brand can specify PAN lengths from 13 to 19 digits and so card numbers of more than 16 digits are now being seen.

Switch was re-branded as Maestro in mid-2007. [21] In 2011, UK domestic Maestro (formerly Switch) was aligned with the standard international Maestro proposition with the retention of a few residual country specific rules.

EMV Certification requires acceptance of a 19-digit Visa card (ADVT 6.1.1 Test Case 2) and Discover Card (E2E Test Plan v1.3, Test Case 06).

Canadian bank card numbering

Bank card numbers issued by Canadian banks also follow a pattern for their systems:

Issuing networkRangesLength
Canadian Imperial Bank of Commerce Advantage Debit Card4506 (Interac and Visa Debit)16 digits
Royal Bank of Canada Client Card451916 digits
TD Canada Trust Access Card4724 (Interac and Visa Debit)16 digits
Scotiabank Scotia Card453616 digits
BMO ABM Card500, 551016 digits
HSBC Bank Canada Card5616 digits
Conexus Credit Union Member Card62944916 digits

Security measures

To reduce the risk of credit card fraud, various techniques are used to prevent the dissemination of bank card numbers. These include:

Related Research Articles

<span class="mw-page-title-main">Debit card</span> Card used for financial transactions, usually without a credit line

A debit card, also known as a check card or bank card, is a payment card that can be used in place of cash to make purchases. The card usually consists of the bank's name, a card number, the cardholder's name, and an expiration date, on either the front or the back. Many new cards now have a chip on them, which allows people to use their card by touch (contactless), or by inserting the card and keying in a PIN as with swiping the magnetic stripe. Debit cards are similar to a credit card, but the money for the purchase must be in the cardholder's bank account at the time of the purchase and is immediately transferred directly from that account to the merchant's account to pay for the purchase.

<span class="mw-page-title-main">EFTPOS</span> Type of Electronic Funds Transfer system

Electronic Funds Transfer at Point Of Sale, abbreviated as EFTPOS, is the technical term referring to a type of payment transaction where electronic funds transfers (EFT) are processed at a point of sale (POS) system or payment terminal usually via payment methods such as payment cards. EFTPOS technology was developed during the 1980s.

<span class="mw-page-title-main">Smart card</span> Pocket-sized card with authentication circuitry

A smart card (SC), chip card, or integrated circuit card, is a card used to control access to a resource. It is typically a plastic credit card-sized card with an embedded integrated circuit (IC) chip. Many smart cards include a pattern of metal contacts to electrically connect to the internal chip. Others are contactless, and some are both. Smart cards can provide personal identification, authentication, data storage, and application processing. Applications include identification, financial, public transit, computer security, schools, and healthcare. Smart cards may provide strong security authentication for single sign-on (SSO) within organizations. Numerous nations have deployed smart cards throughout their populations.

<span class="mw-page-title-main">SIM card</span> Integrated circuit card for a mobile devices

A SIMcard is an integrated circuit (IC) intended to securely store an international mobile subscriber identity (IMSI) number and its related key, which are used to identify and authenticate subscribers on mobile telephone devices. SIMs are also able to store address book contacts information, and may be protected using a PIN code to prevent unauthorized use.

<span class="mw-page-title-main">Charge card</span> Credit card which must be paid in full

A charge card is a type of credit card that enables the cardholder to make purchases which are paid for by the card issuer, to whom the cardholder becomes indebted. The cardholder is obliged to repay the debt to the card issuer in full by the due date, usually on a monthly basis, or be subject to late fees and restrictions on further card use. Charge cards are distinct from traditional credit cards, which are revolving credit instruments that do not need to be paid in full every month and a balance may be carried over, on which interest is paid. Charge cards are typically issued without spending limits, whereas credit cards usually have a specified credit limit that the cardholder may not exceed. Most charge cards are held by businesses, corporations or executives thereof, and are issued to customers with a good or excellent credit score.

<span class="mw-page-title-main">EMV</span> Smart payment card standard

EMV is a payment method based on a technical standard for smart payment cards and for payment terminals and automated teller machines which can accept them. EMV stands for "Europay, Mastercard, and Visa", the three companies that created the standard.

The Luhn algorithm or Luhn formula, also known as the "modulus 10" or "mod 10" algorithm, named after its creator, IBM scientist Hans Peter Luhn, is a simple check digit formula used to validate a variety of identification numbers. It is described in US patent 2950048A, granted on 23 August 1960.

ISO/IEC 7812Identification cards – Identification of issuers is an international standard published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It specifies "a numbering system for the identification of the card issuers, the format of the issuer identification number (IIN) and the primary account number (PAN)", and procedures for registering IINs. It was first published in 1989.

<span class="mw-page-title-main">Maestro (debit card)</span> Debit card from Mastercard

Mastercard Maestro is a brand of debit cards and prepaid cards owned by Mastercard that was introduced in 1991. Maestro is accepted at around fifteen million point of sale outlets in 93 countries.

<span class="mw-page-title-main">Visa Debit</span> Debit card

Visa Debit is a brand of debit card issued by Visa in many countries. Numerous banks and financial institutions issue Visa Debit cards to their customers for access to their bank accounts. In many countries the Visa Debit functionality is often incorporated on the same plastic card that allows access to ATM and any domestic networks like EFTPOS or Interac.

ISO/IEC 7813 is an international standard codified by the International Organization for Standardization and International Electrotechnical Commission that defines properties of financial transaction cards, such as ATM or credit cards.

<span class="mw-page-title-main">Payment card</span> Card issued by a financial institution that can be used to make a payment

Payment cards are part of a payment system issued by financial institutions, such as a bank, to a customer that enables its owner to access the funds in the customer's designated bank accounts, or through a credit account and make payments by electronic transfer with a payment terminal and access automated teller machines (ATMs). Such cards are known by a variety of names, including bank cards, ATM cards, client cards, key cards or cash cards.

<span class="mw-page-title-main">ATM card</span> Type of bank card providing access to Automatic Teller Machines

An ATM card is a dedicated payment card card issued by a financial institution which enables a customer to access their financial accounts via its and others' automated teller machines (ATMs) and, in some countries, to make approved point of purchase retail transactions. ATM cards are not credit cards or debit cards, however most credit and debit cards can also act as ATM cards and that is the most common way that banks issue cards since the 2010s.

<span class="mw-page-title-main">Contactless payment</span> Technology enabling payment without physical contact

Contactless payment systems are credit cards and debit cards, key fobs, smart cards, or other devices, including smartphones and other mobile devices, that use radio-frequency identification (RFID) or near-field communication (NFC) for making secure payments. The embedded integrated circuit chip and antenna enable consumers to wave their card, fob, or handheld device over a reader at the point-of-sale terminal. Contactless payments are made in close physical proximity, unlike other types of mobile payments which use broad-area cellular or Wi-Fi networks and do not involve close physical proximity.

<span class="mw-page-title-main">Credit card</span> Card for financial transactions on credit

A credit card is a payment card, usually issued by a bank, allowing its users to purchase goods or services, or withdraw cash, on credit. Using the card thus accrues debt that has to be repaid later. Credit cards are one of the most widely used forms of payment across the world.

girocard Interbank network and debit card service

girocard is an interbank network and debit card service connecting virtually all automated teller machines (ATMs) and banks. It is based on standards and agreements developed by the German Banking Industry Committee.

<span class="mw-page-title-main">Card security code</span> Security feature on payment cards

A card security code is a series of numbers that, in addition to the bank card number, is printed on a credit or debit card. The CSC is used as a security feature for card not present transactions, where a personal identification number (PIN) cannot be manually entered by the cardholder. It was instituted to reduce the incidence of credit card fraud. Unlike the card number, the CSC is deliberately not embossed, so that it is not read when using a mechanical credit card imprinter which will only pick up embossed numbers.

The term digital card can refer to a physical item, such as a memory card on a camera, or, increasingly since 2017, to the digital content hosted as a virtual card or cloud card, as a digital virtual representation of a physical card. They share a common purpose: identity management, credit card, debit card or driver's license. A non-physical digital card, unlike a magnetic stripe card, can emulate (imitate) any kind of card.

<span class="mw-page-title-main">Mir (payment system)</span> Russian payment system

Mir is a Russian card payment system for electronic fund transfers established by the Central Bank of Russia under a law adopted on 1 May 2017. The system was developed by Belgian digital payments company OpenWay and is operated by the Russian National Card Payment System, a wholly-owned subsidiary of the Central Bank of Russia. Mir does not itself issue cards, extend credit or set rates and fees for consumers; rather, Mir provides financial institutions with Mir-branded payment products that they use to offer credit, debit, or other programs to their customers. The development and implementation of Mir was spurred by the imposition of international sanctions against Russia in 2014 to circumnavigate the reliance on the likes of Visa and Mastercard, which were blocked in Russia at the time. Mir created its own digital wallet for contactless payments.

<span class="mw-page-title-main">E.118</span> ITU-T Recommendation

E.118 is an international standard that defines the international telecommunication charge card, for use in payphones. It also defines the Integrated Circuit Card Identifier (ICCID), which is used in Subscriber Identity Modules (SIMs, including SIM cards and eSIMs. The standard was first developed in 1988 by what became the Standardization Sector of the International Telecommunication Union with several revisions having been published since then.

References

  1. "Announcing Major Changes to the Issuer Identification Number (IIN) Standard". www.ansi.org.
  2. R. Shirey (August 2007). Internet Security Glossary, Version 2. Network Working Group. doi: 10.17487/RFC4949 . RFC 4949.Informational.
  3. "ISO/IEC 7812-1:2017 Identification cards – Identification of issuers – Part 1: Numbering system". ISO.org. January 2017. Retrieved 12 June 2017.
  4. "ISO/IEC 7812-1:2017".
  5. "ISO/IEC 7812-1:2006". ISO.
  6. "What is issuing BIN sponsorship?". Monavate.com. 29 March 2021. Retrieved 2 July 2021.
  7. "Card Security Features" (PDF). American Express. January 2001. Archived from the original (PDF) on 5 March 2006. Retrieved 5 April 2006.
  8. "American Express Card security features" (PDF). Archived from the original (PDF) on 4 May 2021. Retrieved 25 October 2021.
  9. "Bankcard Association of Australia". Archived from the original on 6 April 2006. Retrieved 3 February 2017.
  10. 1 2 3 4 5 "February 2017 Compliance Update" (PDF). Archived from the original (PDF) on 22 August 2017. Retrieved 22 August 2017.
  11. "Mastercard Diners Club Alliance". Archived from the original on 4 December 2008. Retrieved 11 August 2022.{{cite web}}: CS1 maint: unfit URL (link)
  12. "Diners Club - Fraud Management". Archived from the original on 29 December 2007. Retrieved 11 August 2022.{{cite web}}: CS1 maint: unfit URL (link)
  13. "Barclaycard BIN Ranges and Rules - UK" (PDF). Archived from the original on 17 February 2019. Retrieved 11 August 2022.{{cite web}}: CS1 maint: unfit URL (link)
  14. "Nets Technical Reference Guide" (PDF). 1-14.3.2 Building the MSC Selection Table.
  15. "Об отмене Указа Президента Приднестровской Молдавской Республики от 22 мая 2015 года № 202 «Об общих условиях организации и функционирования в Приднестровской Молдавской Республике Национальной платежной системы»" [On the cancellation of the Decree of the President of the Pridnestrovian Moldavian Republic dated 22 May 2015 No. 202 "On the general conditions for the organization and functioning of the National Payment System in the Pridnestrovian Moldavian Republic"].
  16. 1 2 "Mastercard Rules" (PDF). Mastercard. 21 December 2017. Archived from the original (PDF) on 14 May 2018.
  17. "Mastercard 2-Series BIN Implementation for Merchants" (PDF). www.mastercard.us.
  18. "Turkey's Troy moves overseas with Discover deal". No. 9 November 2017. 9 November 2017. Retrieved 19 February 2022.
  19. Elçiboğa, Ibrahim Kudret. "TROY Bin Listesi". Fraud and Chargeback (in Turkish). Retrieved 31 August 2020.
  20. "Diners Club International Ranges Available for Development Purposes Only" (PDF). October 2008. Archived from the original on 6 October 2011. Retrieved 27 August 2023.{{cite web}}: CS1 maint: unfit URL (link)
  21. "Switch to Maestro". Archived from the original on 8 August 2010. Retrieved 20 August 2010.