Learning Where The Numbers Come From
Credit card numbers are not random. There's a special set of numbers to show information about the card issuer and another set to show information about the card holder. One other number is also important, but we'll come to that later.
The very first number is the Major Industry Identifier (MII) and it tells you what sort of institution issued the card.
- 1 and 2 are issued by airlines.
- 3 is issued by travel and entertainment.
- 4 and 5 are issued by banking and financial institutions.
- 6 is issued by merchandising and banking.
- 7 is issued by petroleum companies.
- 8 is issued by telecommunications companies.
- 9 is issued by national assignment.
The first six digits are the Issuer Identification Number (IIN). These can be used to look up where the card originated from. If you have access to a list that details who owns each IIN, such as this list of popular IINs on Wikipedia, you can see who issued the card just by reading the card number.
Here's a few you might recognise:
- Visa: 4*****
- American Express (AMEX): 34**** or 37****
- Diner's Club International: 36****
- Mastercard: 51**** to 55****
The seventh digit to the second-to-last digit is the customer account number. Most companies use just 9 digits for the account numbers, but it's possible to use up to 12. This means that using the current algorithm for credit cards, the world can issue about a trillion cards before needing to change the system.
We often see 16-digit credit card numbers today, but it's possible for a card issuer to issue a card with up to 19 digits using the current system. In the future, we may see longer numbers becoming more common.
The very last digit of each credit card is the check digit, or checksum. It is used to validate the credit card number using the Luhn algorithm, which we will now explain in detail.
The Luhn Algorithm Validation Check
The Luhn Algorithm is used to validate all sorts of numbers, including credit cards, IMEI numbers and some social security numbers. It's not designed to be a cryptographically secure hash function, but merely a way to check errors are not made when recording numbers. It is not foolproof, but is generally considered to be useful.
Take the credit card number and read the digits from the right. Double every other number and write them down – if you do it in the same order as your card is written it will help with clarity. Now, wherever you have calculated a double-digit number, change it so that it reads as "first digit + second digit" (in other words, sum the digits of the products). Finally, take your calculations and add those numbers to the numbers remaining on your card that you didn't double. A legitimate credit card number will give you a result that is divisible by 10.
For instance, let's use a number I've just made up: 4634 8932 1298 2767. I'll enter it into a table to make it easier to understand the steps.
Try it yourself using the card from the picture earlier in this article. What can you learn from it?
