Frequently Asked Question
How can I validate if a number is a legitimate credit card number?
The Luhn formula or Modulus 10 is the algorithm most often used to validate Primary Account Numbers (PAN). The algorithm works as follows:
- double the value of alternate digits of the PAN beginning with the second digit from the right (for any resulting value greater than 10, subtract 9),
- add the calculated values as well as the values skipped in step 1 together,
- the total obtained in step 2 must be divisible by 10. Note that this formula tells you whether the payment card number is a possible and valid number, but not whether it's actually been issued and is active.
July 2012
Article Number: 1137
Related
-
Do ASV scans in SAQ A apply to merchants with webpages that redirect to TPSPs or include TPSPs’ embedded iframes?
-
Are authentication values from a 3DS transaction considered sensitive authentication data for PCI DSS purposes?
-
Should entities with enterprise or internal service providers, used to provide internal services to other corporate entities, conduct separate PCI DSS assessments of these service providers or include them as part of each corporate entity’s PCI DSS assessment?
Featured FAQ Articles
Featured
-
Do PCI DSS requirements for keyed cryptographic hashing apply to previously hashed PANs?
-
Is the PCI DSS Attestation of Compliance intended to be shared?
-
How does an entity report the results of a PCI DSS assessment for new requirements that are noted in PCI DSS as best practices until a future date?
-
Where do I direct questions about complying with PCI standards?
-
Can SAQ eligibility criteria be used as a guide for determining applicability of PCI DSS requirements for merchant assessments documented in a Report on Compliance?
Most Popular
-
What are acceptable formats for truncation of primary account numbers?
-
For PCI DSS, why is storage of sensitive authentication data (SAD) after authorization not permitted even when there are no primary account numbers (PANs) in an environment?
-
How does an e-commerce merchant meet the SAQ A eligibility criteria for scripts?
-
If an organization provides software or functionality that runs on a consumer's device (for example, smartphones, tablets, or laptops) and is used to accept payment account data, can the organization store card verification codes for those consumers?
-
Are truncated Primary Account Numbers (PAN) required to be protected in accordance with PCI DSS?
Most Recently Updated
-
Are authentication values from a 3DS transaction considered sensitive authentication data for PCI DSS purposes?
-
Can SAQ eligibility criteria be used as a guide for determining applicability of PCI DSS requirements for merchant assessments documented in a Report on Compliance?
-
Does PCI DSS define which versions of TLS must be used?
-
Do ASV scans in SAQ A apply to merchants with webpages that redirect to TPSPs or include TPSPs’ embedded iframes?
-
Is sampling allowed in PCI DSS v4.x?