Credit Card Number Structure: IIN, BIN, Check Digit and Examples
By SimpleTools24Updated 4 min read
A payment card number, technically the Primary Account Number (PAN), has three parts. The first six to eight digits are the Issuer Identification Number (IIN, often called the BIN), which identifies the card network and issuing institution; the first digit on its own is the Major Industry Identifier. The middle digits are the individual account identifier assigned by the issuer. The final digit is a check digit calculated with the Luhn algorithm. Card numbers are usually 15 or 16 digits, but the standard allows from 8 up to 19.
In this guide
The Parts of a Card Number
4 5 3 9 5 7 8 1 | 2 3 4 5 6 7 8 | 9
|-------------| |-----------| check digit (Luhn)
IIN / BIN account identifier
^ Major Industry Identifier (first digit)(The number above is a made-up example, not a real card.)
Major Industry Identifier
The first digit indicates the industry category under ISO/IEC 7812:
| First digit | Industry |
|---|---|
| 1, 2 | Airlines (2 is also used for some Mastercard ranges) |
| 3 | Travel and entertainment (American Express, Diners Club, JCB) |
| 4, 5 | Banking and financial (Visa, Mastercard) |
| 6 | Merchandising and banking (Discover, UnionPay) |
| 7 | Petroleum |
| 8 | Healthcare, telecommunications |
| 9 | National assignment |
Issuer Identification Number (IIN / BIN)
The leading digits identify the network and the issuing bank or organisation. Historically the IIN was six digits; ISO/IEC 7812-1 was revised to an eight-digit IIN, and card networks moved to eight-digit BINs around 2022. Systems that route or analyse transactions by BIN had to be updated to read eight digits.
Account Identifier
The digits between the IIN and the check digit identify the individual account. They're assigned by the issuer and have no public meaning.
Check Digit
The last digit makes the whole number pass the Luhn check, which catches most typing mistakes. The Luhn algorithm explained shows how it's calculated.
Network Prefixes and Lengths
| Network | Starts with | Typical length | Security code |
|---|---|---|---|
| Visa | 4 | 16 (13 and 19 also exist) | 3 digits |
| Mastercard | 51–55, 2221–2720 | 16 | 3 digits |
| American Express | 34, 37 | 15 | 4 digits (on the front) |
| Discover | 6011, 644–649, 65 | 16–19 | 3 digits |
| JCB | 3528–3589 | 16–19 | 3 digits |
| Diners Club | 36, 38, 300–305 | 14–19 | 3 digits |
| UnionPay | 62 | 16–19 | 3 digits |
Ranges change over time as networks add new ranges, so production code should rely on a maintained library or the payment processor rather than a hard-coded table. Braintree's open-source credit-card-type library is one widely used reference.
Credit Card Number Examples
The sample numbers below are public test numbers that Stripe documents for its sandbox. They follow the real format of each network and pass the Luhn check, but they belong to no account and are declined outside test mode.
| Network | Sample number | Length | What to notice |
|---|---|---|---|
| Visa | 4242 4242 4242 4242 | 16 | Starts with 4 |
| Mastercard | 5555 5555 5555 4444 | 16 | Starts in the 51–55 range |
| American Express | 3782 822463 10005 | 15 | Starts with 37; grouped 4-6-5 |
| Discover | 6011 1111 1111 1117 | 16 | Starts with 6011 |
| JCB | 3566 0020 2036 0505 | 16 | Starts in the 3528–3589 range |
Taking the sample Visa number apart:
- 4 is the Major Industry Identifier (banking and financial) and the Visa prefix.
- 4242 4242 is the eight-digit IIN/BIN.
- 4242 424 is the account identifier.
- 2, the last digit, is the Luhn check digit that makes the whole number valid as a checksum.
Use these only in a provider's test mode. Each provider publishes its own list, so check their documentation for sandbox behaviour such as declines or 3-D Secure prompts.
Why This Matters for Developers
Understanding the structure helps with:
- Card type detection: showing the right logo and security-code length as the user types.
- Formatting: spacing numbers as 4-4-4-4 for most cards, 4-6-5 for American Express.
- Front-end validation: checking length and Luhn before submitting, so users catch typos early.
- Not over-validating: rejecting a 19-digit card or a new BIN range because your rules are outdated is a common bug.
How to test payment forms turns these into a test checklist.
What the Number Doesn't Tell You
The structure says nothing about:
- Whether the account exists or is open
- The cardholder's name or address
- Credit limit or balance
- Whether it's credit, debit or prepaid (this needs a BIN database lookup and isn't always reliable)
Only the issuer, through the payment network's authorisation process, can confirm a card is usable. Why generated card numbers don't work explains this.
Privacy and Security Notes
- PCI DSS limits how much of a card number may be displayed; showing the first six and last four digits is a common maximum, and many systems show only the last four.
- Never log full card numbers in application logs or analytics.
- BIN information is semi-public, but combined with other data it can be sensitive; treat it carefully.
Seeing the Structure With Test Data
The test card generator creates synthetic numbers that follow these rules (the right prefix, length and Luhn check digit) for Visa, Mastercard, American Express, Discover, JCB, Diners Club and UnionPay. It runs in your browser and is meant for testing form formatting and validation, not for payments. For end-to-end tests with a payment provider, use their official sandbox numbers, described in test credit card numbers for developers.
Frequently Asked Questions
What is a BIN number?
The Bank (or Issuer) Identification Number: the first six to eight digits of a card number, identifying the network and issuer.
Why are some card numbers 15 digits?
American Express uses 15 digits. Other networks mostly use 16, with some ranges up to 19.
Is the first digit always the network?
The first digit gives the industry category and narrows the network, but the network is determined by the full prefix range.
Can I find a cardholder from a card number?
No. The number identifies the issuer and account, but cardholder data is held by the issuer and protected.
Summary
A card number is an IIN (network and issuer), an account identifier and a Luhn check digit. Use the structure for formatting and early validation, rely on the processor for everything else, and never log full numbers.
Sources
- credit-card-type: card network patterns, lengths and security codes – Braintree (open source) (opens in a new tab)
- Testing (test card numbers and sandbox guidance) – Stripe Docs (opens in a new tab)
Related articles
- Luhn Algorithm ExplainedHow the Luhn check digit works, a step-by-step example, short code in JavaScript and Python, and what it can't do.
- How to Test Payment FormsA field-by-field QA checklist for checkout forms, from formatting and validation to sandbox payments and accessibility.
- Test Credit Card NumbersSandbox cards from payment providers vs synthetic Luhn-valid numbers, and which kind each test needs.