Reading a Card Number
A payment card number (PAN) is structured into fields: MII, BIN/IIN, account number and check digit. This guide explains each field.
By Daniel Cross, Senior Payment Systems Analyst · Last updated: 2026-10-20
The fields of a card number
A payment card number is a Primary Account Number, and it is not a random string. It is laid out in defined fields, each with a fixed width, and knowing the layout tells you a surprising amount: which network the card belongs to, which issuer issued it, which product type it is, and whether the number could be valid at all. The structure is defined in ISO/IEC 7812.
- MII: the major industry identifier, one to two digits
- BIN or IIN: the issuer identifier, six digits
- Account number: the issuer's own identifier for the cardholder
- Check digit: one digit, computed with the Luhn algorithm
Field by field
Reading a number is easiest once the widths are known. The table below gives the field widths for a 16-digit number; a 19-digit Visa simply has a three-digit account number instead of a seven-digit one.
| Field | Digits | Position in a 16-digit number | What it identifies |
|---|---|---|---|
| MII | 1-2 | 1 | The major industry identifier, which narrows the network |
| BIN / IIN | 6 | 2-7 | The issuer, and by extension the brand, type and country |
| Account number | 7-12 | 8-15 or 8-19 | The issuer's identifier for this cardholder |
| Check digit | 1 | 16 or 19 | A Luhn checksum over everything before it |
The major industry identifier
The MII is the first digit or two and it is the broadest signal you have. It narrows the card to a family of networks before you have read a single further digit. It is why a number starting 4 is a Visa and a number starting 5 is a Mastercard, and it is the reason the length check is useful as a quick first pass.
| MII | Family |
|---|---|
| 1, 9 | Legacy Visa and Mastercard ranges, plus some national schemes |
| 2 | Mastercard, the 2-series range |
| 3 | American Express and Diners Club |
| 4 | Visa |
| 5 | Mastercard |
| 6 | A union of issuers, including Union Pay, Discover and RuPay |
| 7 | A mix of local and national schemes |
| 8 | Mostly national schemes |
The check digit
The last digit is not random. It is the Luhn checksum of every digit before it, computed with a doubling and summing rule described in ISO/IEC 7812. This catches every single-digit error and most transpositions of adjacent digits, which makes it a cheap and effective first validation. It says nothing about whether the account exists, and a number can be perfectly Luhn-valid and still be worthless.
- Doubles every second digit from the right, including the check digit's neighbour
- Subtracts 9 from any doubled result above 9
- Sums the resulting digits
- A valid number sums to a multiple of 10
- It proves internal consistency, never existence or funds
Reading a number you were given
The practical procedure is short. Take the first digit or two and identify the network family. Take the first six and look the issuer up. Check the total length against the network's rules, because a 17-digit number starting 4 is not a valid Visa. Then run the Luhn check. Anything that fails the Luhn check is a transcription error and is worth re-reading rather than investigating.
- First digit or two: the network family
- First six digits: the issuer, brand, type and country
- Total length: must match the brand's rules
- Final digit: the Luhn checksum
- Only after all four pass is the number structurally sound
Why this matters for a system
Validation belongs in layers, and each layer answers a different question. Length and MII are free. The Luhn check is free and catches most real-world errors. A BIN lookup costs a lookup and tells you whether the issuer and the product type are what you expected. Only a live authorisation tells you whether the account exists and has funds, and that is a transaction rather than a validation.
| Layer | Question | Cost | Proves |
|---|---|---|---|
| Length and MII | Is the shape right? | Free | Which network family |
| Luhn | Is it internally consistent? | Free | It was not mistyped |
| BIN lookup | Who issued it, for what? | A lookup | Issuer, brand, type, country |
| Authorisation | Will it be approved? | A transaction | The account and its funds |
Frequently Asked Questions
What is a PAN?
Primary Account Number: the number embossed or printed on a payment card that identifies the account. It is the field that carries the issuer identifier, the account number and the check digit.
How is a card number split into parts?
Into a major industry identifier of one or two digits, a six-digit BIN or IIN, the issuer's account number, and a single Luhn check digit.
What does the first digit of a card number mean?
It narrows the network family. A 4 is a Visa, a 5 is a Mastercard, a 3 is usually American Express, and 6 covers a union of issuers including Union Pay and Discover.
Why do some card numbers have 13 digits and others 19?
Both are valid Visa lengths. Visa extended its allocation and length over time, so older cards are 13 and newer ones 16 or 19. Mastercard is always 16 and American Express always 15.
What is the check digit?
The last digit. It is a Luhn checksum over all the preceding digits, and it catches every single-digit error and most transpositions. It does not indicate that the account exists.
Does a Luhn-valid card number mean the card works?
No. It means the number is internally consistent. Whether the account exists, is active or has funds is only knowable from the issuer.
How do I check whether a card number is real without transacting?
Check the length and the MII, run the Luhn check, then look the first six digits up in the BIN data. That gives you the issuer, the brand, the product type and the country without contacting anybody.