Credit card number hyperfixation notes

Why are AmEx card numbers shorter?

Amex is its own payment network. Most card numbers are 16 digits because they’re issued either by Visa or Mastercard - both of which decided on 16 digit numbers for most cards.

Amex has far fewer customers than Visa and Mastercard, so they can get away with shorter numbers; changing the number format would also be a HUGE, complicated operation.

Want more info? Read on!

Overview

We call them card numbers, but the payment industry knows them as primary account numbers or PANs. They aren’t random - they’re generated in accordance with an international standard[1] and follow a very specific format. The short version is:

• They can be 8 to 19 digits long. The payment network decides on the length.
• The format has to be verifiable using the Luhn algorithm
• They have to contain the following components:
  • Major Industry Identifier (MII)
  • Issuer Identification Number (IIN)
  • Account number
  • Check digit

Issuer Identification Number

Example card number: 5108 7505 8801 0231

• 6-8 digits long
• First digit is the MII. Sometimes the MII makes sense, sometimes it does not.
  • 3 = Travel and Entertainment
  • 4/5 = Banking and Financial
  • 6 = Merchandising and Banking/Financial
• MII + next 5-7 digits is the IIN - unique to a product line per issuer
  • 5 = Banking and Financial
  • 10875 = Capital One World Mastercard (BJ’s Club Platinum co-brand)
• Account number: everything from the end of the IIN to the second-last digit
  • 058801023 = account number
• Check digit: last number
  • 1 = check digit

Luhn Algorithm

Doesn’t tell you if a card number is valid and associated to a bank account or line of credit. For this you need the card number + expiry date + optionally the CVV[2]. It just tells you if it’s formatted correctly and matches the specification of the standard.

The check digit is computed as follows:

1. Drop the check digit from the number (if it’s already present). This leaves the payload.
2. Start with the payload digits. Moving from right to left, double every second digit, starting from the second-to-last digit (not the last digit of the payload). If doubling a digit results in a value > 9, subtract 9 from it (or sum its digits).
3. Sum all the resulting digits (including the ones that were not doubled). Let this equal s.
4. The check digit is calculated as follows: (10 - (s % 10)) % 10.

[1]: ISO/IEC 7812 [2]: these are generated by a whole-ass other process which I can explain separately. cryptography is involved.