Have you ever wondered how credit card companies generate all those account numbers that appear on the face of the credit cards you carry around in your wallet? At first glance the numbers, while neatly arranged, appear to be completely random. But would it surprise you to know that there is indeed meaning and actual mathematical methodology to the way the numbers are sequenced? The process of generating real credit card numbers and validating them based on a proven mathematical formula is not only intriguing on an intellectual level and a hacker’s dream, the carefully calculated way the numbers are ordered is actually quite beautiful and elegant when you come to understand how it works.
Before I get down to explaining the anatomy of credit card numbers and discussing how credit card numbers are generated, I think it’s prudent to remind everyone the intent of this article. The goal of this blog post is not to encourage or get people thinking about how to go out and create fake credit card numbers on their own for improper means. The purpose is to shed some light on the science behind the mathematical sequencing technology of valid credit card numbers and offer some insight into something that many of us frequently see and use everyday, but oftentimes don’t pay much attention to.
Please take in the information provided for purely academic and entertainment reasons. I’m not trying to encourage anyone to create fake credit card numbers and get themselves in trouble with the law. For anyone even thinking about engaging in fake credit card number hacking, keep this in mind – using mathematically generated credit card numbers to purchase products over the Internet or in real life is not only unethical and highly illegal, it’s also not yet technologically possible (yet), based on the sheer probability of long shot odds of 1 in trillions. After reading everything I’m about to say carefully, you’ll also realize that there is no realistic way to generate actual working credit card numbers that could be used for anything but entertainment reasons. The math and science behind generating authentic credit card numbers are only good for validation purposes and not sufficient for creating workable numbers as several highly encrypted numerical components are still needed. So, with that obligatory disclaimer out of the way, here is a short guide on how anyone can generate and verify the authenticity of any credit card number.
Basic Background About Credit Card Numbers and How They Work
Rather than ask you to take out a credit card out of your wallet to examine it, I’ve provided a picture of a prototypical card – in this case, it’s a Visa credit card. While different card types offer different lengths of numerical digits, most major credit card issuers popular in the United States have 16 primary numbers on the front face of the card. Visa, MasterCard, and Discover cards all have 16 digits. American Express is the only major credit card issuer in the U.S. with one less number – at 15 digits. Regardless of the length of numbers, their numerical sequencing is still guided by the same Luhn validation formula, the mathematical check sum equation that makes all valid credit card numbers error free.
As you can see from the picture of the Visa card above, the very first 6 credit card number sequence is known as the issuer identification number (IIN) or bank identification number (BIN). These first 6 numerical digits denote the credit card network and the banking institution the card is a member of. The issuer identifier number also incorporates the card type’s special identifying numerical prefix.
All typical 16 digit Visa account credit card numbers start with a prefix of 4.
All 16 digit MasterCard account numbers start with a prefix of 5.
All 16 digit Discover account numbers start with a prefix of 6011.
All 15 digit American Express credit card numbers start with a prefix of 37.
There is less randomization during this initial set of 6 digits as the numbers are determined purely by the card issuing source. Validation systems that want to go the extra mile in verifying authenticity oftentimes scan this first numerical sequence to match the known bank and issuing location of the card with the provided customer billing address for further validation accuracy.
The lone digit at the very right end of the complete 15 or 16 digit credit card number sequence is known as the “check digit”, which often is the final number that is computer generated to satisfy the mathematical formulations of the Luhn check sum process. Meanwhile, in between the first 6 digits and the last single check digit is the actual personalized account number – the 8 or 9 digit sequence given by the card issuer. For more basic background information about credit card numbers, check out this credit card features brochure for more useful knowledge about the embossed and printed information found on your typical plastic credit card.
What’s The Secret Behind The Luhn Algorithm, Also Known As The “Modulus 10″ Or “Mod-10″ Formula?The Luhn Algorithm is the check sum formula used by payment verification systems and mathematicians to verify the sequential integrity of real credit card numbers. It’s used to help bring order to seemingly random numbers and used to prevent erroneous credit card numbers from being cleared for use. The Luhn Algorithm is not used for straight credit card number generation from scratch, but rather utilized as a simple computational way to distinguish valid credit card numbers from random collections of numbers put together. The validation formula also works with most debit cards as well.
The Luhn formula was created and filed as a patent (now freely in the public domain) in 1954 by Hans Peter Luhn of IBM to detect numerical errors found in pre-existing and newly generated identification numbers. Since then, it’s primary use has been in the area of check sum validation, made popular with its use to verify the validity of important sequences such as credit card numbers. Currently, almost all credit card numbers issued today are generated and verified using the Luhn Algorithm or Modulus, Mod-10 Formula. Needless to say, if you come upon some existing credit card numbers that fail the Luhn algorithm when put to the test, it is safe to assume that they are not valid or genuine numbers.
The one thing to keep in mind is that validity in terms of passing the Luhn test only means that it is mathematically valid for computational compliance purposes. It does not guarantee that the credit card number sequence is indeed a working number that is backed up with a valid credit card account on the card issuer’s end. It is not unremarkable for one to artificially generate a mathematically valid credit card number that passes the Luhn validation check, but still ultimately fails as a fake credit card number with no actual substance. The Luhn algorithm only validates the 15-16 digit credit card number and not the other critical components of a genuine working credit card account such as the expiration date and the commonly used Card Verification Value (CVV) and Card Verification Code (CVC) numbers (used to prove physical possession of the debit or credit card).
The Nerdy Process Of Applying The Luhn Algorithm To The Creation and Validation Of Credit Card Number SequencesFor those who hate math or get scared when they encounter a bunch of scary looking mathematical formulas and numerically inspired descriptions, you are not alone. I personally hate math as an academic subject and was rather terrible at it back in high school and college, but if you like visual, thinking puzzles like Sudoku, you’ll like working with the Luhn Algorithm. It’s pretty clever and remarkably well put together. It’s also pretty easy to explain.
- First, you’ll need to lay out all 15 or 16 numerical digits of the credit or debit card number. The Luhn Algorithm always starts from right to left, beginning with the rightmost digit on the credit card face (the check digit). Starting with the check digit and moving left, double the value of every alternate digit. Non-doubled digits will remain the same. Remember that the check digit is never doubled. For example, if the credit card is a 16 digit Visa card, the check digit would be the rightmost 16th digit. Thus you would double the value of the 15th, 13th, 11th, 9th digits, and so on until all odd digits have been doubled. The even digits would be left the same.
- For any digit that becomes a two digit number of 10 or more when doubled, add the two digits together. For example, the digit 5 when doubled will become 10, which turns into a 1 (when 1 and 0 are added together). Likewise, the digit 9 when doubled will become 18, which becomes 9 (as 1 and 8 are added together). Obviously, 0 when doubled will remain 0.
- Now, lay out the new sequence of numbers. The new doubled digits will replace the old digits. Non-doubled digits will remain the same. Thus, you should be able to come up with a new sequence of 15 or 16 numerical digits depending on card type.
- Add up the new sequence of numbers together to get a sum total. If the combined tally is perfectly divisible by ten (ends in 0, like 60 for example), then the account number is mathematically valid according to the Luhn formula. If not, the credit card number provided is not valid and thus fake or improperly generated.
An Example Of the Luhn Validation Technique In Action – Using Homemade Graphics
For the visual types like myself, let’s use the American Express credit card on the right to better demonstrate the doubling and addition mathematics of the Luhn Algorithm. Follow the numbers and you’ll realize that it’s not as difficult as it may first appear. It’s actually very easy once you get the hang of it. You won’t look at credit card numbers the same way ever again after you get a good grip of it – I assure you. You’ll find yourself testing credit card numbers for fun!
Ignoring the obvious Amex logo on the card, right of the bat it’s clear the account number is that of an American Express number – denoted by the numerical prefix – “37″. Now let’s crunch the numbers through the Luhn Algorithm using the following displayed Amex credit card number: 3759-876543-21001. It doesn’t matter if the credit card number sequence has 15 numbers like the American Express or 16 numbers like Visa, MasterCard, or Discover, the Luhn validation check should be able to verify whether this card number is a mathematically authentic credit card number regardless. Follow the Luhn steps from #1 to #4 below, starting with the rightmost check digit.
In this case, the total calculated sum was 57, which is not divisible by 10 (the added up sum does not end with zero). Thus the number fails the Luhn Algorithm validation check. According to the Luhn test, this particular Amex credit card number is completely bogus and fake. The numbers were likely randomly slapped together. To make this particular set of numbers Luhn compliant and error free, all we would have to do is change the all important “check digit” number from 1 to a 4, which would result in a total sum of 60, thereby becoming Luhn compliant.
If you want to test this mathematical theory out in real life, I recommend pulling out your own credit cards and spending a few seconds to run a quick Luhn screening on them just for your own amusement and education. Pretty neat isn’t it? If you want another credit card number to test on, try using the credit card number that is displayed on the cartoon “VIZA Card” [sic] that Bart Simpson is holding up in the graphic at the top right of this article – the card is in the name of “Rod Flanders”, and the credit card number is: 8525-4941-2525-4158. Tip: Just by looking at the prefix numbers you probably should already be able to tell that the account number’s completely random and fake.
Use The Luhn Formula To Validate Existing Accounts But Don’t Attempt To Create and Use Fake Credit Card Numbers
Now with this new found knowledge, keep in mind you still won’t be able to randomly generate genuine workable credit card numbers. The Luhn theory only allows you to generate mathematically compliant credit card test numbers, not hack workable ones. Besides, without valid expiration dates, and valid CVV2, CVC2, or CID numbers (the special security codes printed on the back or front of credit cards as additional authentication measures), you still wouldn’t be able to legitimately use your self generated numbers to run credit transactions anyway.
Cracking and hacking the security codes found on credit cards is currently impossible. To calculate a workable 3 digit CVV2 security code, the algorithm requires a primary account number (PAN), the 4 digit expiration date, a special 3 digit service code, and a pair of DES keys. With such heavy encryption and billions to trillions of numerical possibilities, unless you have God-like mental processing power and a fleet of super computers at your disposal, you won’t be able to use brute force guessing attempts to crack the codes.
While it’s good to use this type of information to education yourself on the inner workings of credit cards and mathematical validation theory, it’s best to stay away from trying to further crack the secret of credit card codes to come up with free workable account numbers. Don’t use the Luhn Algorithm for anything else but personal entertainment and amusement. Please don’t go around trying to generate a list of fake credit card numbers on your own and trying to buy stuff with them. I know some of you out there may be tempted to try, but you’ll just get yourself in trouble.
