Bank card number

A bank card number is the primary account number found on credit cards and bank cards. It has a certain amount of internal structure and shares a common numbering scheme. Credit card numbers are a special case of ISO/IEC 7812 bank card numbers.

An ISO/IEC 7812 number is typically 16 digits in length.^[1] It consists of:

• a six-digit Issuer Identification Number (IIN), the first digit of which is the Major Industry Identifier (MII),
• a variable length (up to 12 digits) individual account identifier,
• a single check digit calculated using the Luhn algorithm.^[2]

The term "Issuer Identification Number" (IIN) replaces the previously used "Bank Identification Number" (BIN). See ISO/IEC 7812 for more information.

Major Industry Identifier (MII)

The first digit of a credit card number is the Major Industry Identifier (MII), which represents the category of entity which issued the credit card. Different MII digits represent the following issuer categories:

• 0 – ISO/TC 68 and other future industry assignments
• 1 – Airlines
• 2 – Airlines and other future industry assignments
• 3 – Travel and entertainment and banking/financial
• 4 – Banking and financial
• 5 – Banking and financial
• 6 – Merchandising and banking/financial
• 7 – Petroleum and other future industry assignments
• 8 – Healthcare, telecommunications and other future industry assignments
• 9 – National assignment

For example, American Express, Diner's Club, and Carte Blanche are in the travel and entertainment category, VISA, MasterCard, and Discover are in the banking and financial category (Discover being in the Merchandising and banking/financial category), and Sun Oil and Exxon are in the petroleum category.

Issuer Identification Number (IIN)

Partial IIN on a credit card (both printed and embossed)

The first six digits of the credit card number (including the initial MII digit) are known as the Issuer Identification Number (IIN). These identify the institution that issued the card to the card holder. The rest of the number is allocated by the issuer. Cards are issued by the issuer through an issuing network. The card number's length is its number of digits. Many credit card issuers print the first four digits of the IIN on their card, just beneath where the number is embossed, as an added security measure.

• credit cards
• debit cards
• charge cards
• stored-value cards
• Electronic Benefit Transfer cards

In the United States, IINs are also used in NCPDP pharmacy claims to identify processors, and are printed on all pharmacy insurance cards. IINs are the primary routing mechanism for real-time claims. Each processor has one or more IINs, which it divides into plans by using Group Number and Processor Control Number fields.

The IIN database and membership is managed by the American Bankers Association (ABA) and is updated monthly. The ABA is responsible for allocating IIN ranges to the issuing networks.

Online merchants may use IIN lookups to help validate transactions. For example, if the credit card's IIN indicates a bank in one country, while the customer's billing address is in another, the transaction may call for extra scrutiny.

Issuing network	IIN ranges	Active	Length	Validation
American Express	34, 37[3][dead link]	Yes	15[4]	Luhn algorithm
Bankcard[5]	5610, 560221-560225	No	16	Luhn algorithm
China UnionPay	62[6]	Yes	16-19	unknown
Diners Club Carte Blanche	300-305	Yes	14	Luhn algorithm
Diners Club enRoute	2014, 2149	No	15	no validation
Diners Club International[7]	36	Yes	14	Luhn algorithm
Diners Club United States & Canada[8]	54, 55	Yes	16	Luhn algorithm
Discover Card[9]	6011, 622126-622925, 644-649, 65	Yes	16	Luhn algorithm
InstaPayment	637-639[citation needed]	Yes	16	Luhn algorithm
JCB	3528-3589[10]	Yes	16	Luhn algorithm
Laser	6304, 6706, 6771, 6709	Yes	16-19	Luhn algorithm
Maestro	5018, 5020, 5038, 6304, 6759, 6761, 6762, 6763	Yes	12-19	Luhn algorithm
MasterCard	51-55	Yes	16	Luhn algorithm
Solo	6334, 6767	Yes	16, 18, 19	Luhn algorithm
Switch	4903, 4905, 4911, 4936, 564182, 633110, 6333, 6759	Yes	16, 18, 19	Luhn algorithm
Visa	4	Yes	16[11]	Luhn algorithm
Visa Electron	4026, 417500, 4508, 4844, 4913, 4917	Yes	16	Luhn algorithm

On November 8, 2004, MasterCard and Diner's Club formed an alliance. Cards issued in Canada and the United States start with 54 or 55 and are treated as MasterCards worldwide. International cards use the 36 prefix and are treated as MasterCards in Canada and the United States, but are treated as Diner's Club cards elsewhere. Diner's Club International's web site makes no reference to old 38 prefix numbers, and they can be presumed reissued under the 55 or 36 IIN prefix. Effective October 16, 2009, Diner's Club cards beginning with 30, 36, 38 or 39 have been processed by Discover Card.^[12]

Effective October 1, 2006, Discover began using the entire 65 prefix, not just 650. Also, similar to the Master Card/Diner's agreement, China Union Pay cards are now treated as Discover cards and accepted on the Discover network.

A search on Visa's web site results in many references to card numbers being 16 digits long. However, searching for references to 13-digit cards will turn up no results. All 13-digit account numbers have since been migrated to 16-digit account numbers. At least two different schemes were devised for this that included appending three digits to the account number, and, in more rare cases, inserting three digits after the twelfth digit of the old 13-digit number.

Switch was re-branded as Maestro in mid-2007.^[13]

Other codes

The Card Security Code is typically the last three digits printed on the signature strip on the back of the card. On American Express cards, the Card Security Code is a printed (not embossed) group of four digits on the front towards the right.

The Card Security Code (CSC), sometimes called Card Verification Value (CVV or CV2), Card Verification Value Code (CVVC), Card Verification Code (CVC), Verification Code (V-Code or V Code), or Card Code Verification (CCV) is a security feature for credit or debit card transactions, giving increased protection against credit card fraud.

There are actually several types of security codes:

• The first code, called CVC1 or CVV1, is encoded on the magnetic stripe of the card and used for transactions in person.
• The second code, and the most cited, is CVV2 or CVC2. This CSC (also known as a CCID or Credit Card ID) is often asked for by merchants for them to secure "card not present" transactions occurring over the Internet, by mail, fax or over the phone. In many countries in Western Europe, due to increased attempts at card fraud, it is now mandatory to provide this code when the cardholder is not present in person.
• Contactless card and chip cards may supply their own codes generated electronically, such as iCVV or Dynamic CVV.

Security

Due to risk of credit card fraud if a number (PAN) is known, various techniques are used to prevent these from being widely disseminated. These include:

• PAN truncation – only printing some of the digits on receipts
• Tokenization – only using some of the digits during communication and storage of the transaction

See also

• Bank account
• International Bank Account Number
• List of Bank Identification Numbers
• Routing transit number

References

1. ^ "What your credit card numbers mean". http://www.hackerten.com/other-computer-hacking-tips/what-your-credit-card-numbers-mean/. Retrieved 2010-12-07. 
2. ^ ISO/IEC 7812-1:2006 Identification cards — Identification of issuers — Part 1: Numbering system
3. ^ "Card Security Features" (PDF). American Express. January 2001. http://www125.americanexpress.com/merchant/oam/resources/POS499.pdf. Retrieved 2006-04-05. ^{[dead link]}
4. ^ "American Express Fraud Prevention Handbook" (PDF). p. 13. http://www.umsbanking.com/pdfs/AmericanExpress_AcceptanceProcedures.pdf. Retrieved 2006-04-05. 
5. ^ "Bankcard Association of Australia". http://bankcard.com.au/. Retrieved 2006-04-05. 
6. ^ "China UnionPay Cards". http://en.chinaunionpay.com/comInstr/product/file_2649109.html. Retrieved 2010-11-26. 
7. ^ "MasterCard Diner's Club Alliance". http://www.mastercard.com/in/merchant/en/solutions_resources/dinersclub.html. Retrieved 2006-04-05. 
8. ^ "Diner's Club - Fraud Management". http://www.dinersclubus.com/dce_content/us/merchants. Retrieved 2007-01-26. 
9. ^ "Discover Network - IIN Range Update, 8.2" (PDF). September 2008. https://www.discovernetworkvar.com/common/pdf/var/VAR_Alert_Release_8.2_Expanded_Ranges_9-08.pdf. Retrieved 2008-10-23. 
10. ^ "Discover Network IIN Range Update, 9.2" (PDF). September 2009. https://www.discovernetworkvar.com/common/pdf/var/9-2_VAR_ALERT_Sep_2009.pdf. 
11. ^ "What To Do If Compromised: Visa Fraud Control and Investigations Procedures" (PDF). December 2008. p. 36. http://usa.visa.com/download/merchants/cisp_what_to_do_if_compromised.pdf. Retrieved 2010-01-09. 
12. ^ "Discover Network - IIN Range Update, 9.1" (PDF). October 2008. https://www.discovernetworkvar.com/common/pdf/var/VAR_Alert_Release_9.1_Expanded_Ranges_10-08.pdf. Retrieved 2009-01-28. 
13. ^ "Switch to Maestro". http://www.maestrocard.com/uk/about/switch_to_maestro.html. Retrieved 2010-08-20. 

External links

• H.P. Luhn and Automatic Indexing
• What your credit card numbers mean
• Issuer Identification Number Search