Type a credit card number into any checkout form and something checks it before the page even talks to the bank. That instant "invalid card number" message — appearing the moment you finish typing — comes from a checksum formula invented in 1954 by IBM scientist Hans Peter Luhn. It catches typos, transposed digits, and made-up numbers with remarkable efficiency, all without knowing anything about your account. Want to see it in action? Run any number through our free credit card validator.
This guide explains what happens when you type a card number, walks through the Luhn algorithm step by step with a worked example, shows how the first digits identify the card brand (Visa, Mastercard, Amex, Discover), and clarifies what validation proves — and what it does not.
A checkout form validates your card number in layers, fastest first:
Steps 1–3 happen in milliseconds in your browser. They exist to catch user error early, not to detect fraud — a subtle but important distinction we will return to.
The algorithm is beautifully simple. To validate a number:
Worked example with 4539 1488 0343 6467 (a test Visa number):
Original: 4 5 3 9 1 4 8 8 0 3 4 3 6 4 6 7
Double every
2nd from right: 8 6 2 8 0 8 12 12
(12 > 9, so subtract 9 → 3 and 3)
Adjusted: 8 5 3 9 2 4 3 8 0 3 8 3 3 4 3 7
Sum: 8+5+3+9+2+4+3+8+0+3+8+3+3+4+3+7 = 80
80 mod 10 = 0 → VALID ✓Now watch what happens with a single typo — change the last digit from 7 to 8:
Sum becomes 81 → 81 mod 10 = 1 → INVALIDOne wrong digit breaks the checksum. The algorithm catches 100% of single-digit errors and nearly all transpositions of adjacent digits (the two most common typing mistakes), which is exactly what it was designed for — it was invented to validate punched-card serial numbers, where miskeying was the enemy.
The first 6–8 digits of a card number are the Issuer Identification Number (IIN, formerly BIN). They identify the network and often the issuing institution:
This is why checkout forms can display the Visa logo after you type a single "4" — brand detection needs only the prefix. Combined with the expected length per brand, the form can also flag a 15-digit "Visa" as suspicious before Luhn even runs. Try it yourself with our credit card validator, which reports both the brand and the checksum result.
The last digit is not random — it is computed to make the whole number pass Luhn. To generate it: run the algorithm on the number without the final digit (doubling starts from what will be the second-to-last position), sum the results, and choose the check digit that brings the total to the next multiple of 10.
This is how test card numbers from payment processors (Stripe, PayPal, and others publish them) are constructed, and how "valid-looking" fake numbers in movies are generated. Anyone can produce a Luhn-valid number in seconds — which brings us to the critical limitation.
This is the part people misunderstand most. A number passing Luhn validation means exactly one thing: the digits are internally consistent. It does not mean:
For developers, the takeaway: Luhn validation is UX, not security. It belongs in the form to give instant feedback on typos. Real authorization always happens server-side through a payment processor, and card data must never touch your own servers unless you are PCI DSS compliant — which is why tokenizing processors like Stripe exist.
The Luhn algorithm is a 70-year-old piece of elegant engineering: double every second digit from the right, subtract 9 over 9, sum, check for a multiple of 10. It catches virtually every typo at zero cost, and the IIN prefix system layers brand detection on top. Just remember its boundary — it proves a number is well-formed, nothing more. The bank always has the final word.
Curious about a number? Test the checksum and brand detection instantly with our free credit card validator.
A checksum formula that validates identification numbers. Starting from the rightmost digit, double every second digit (subtracting 9 from results over 9), sum all digits, and the number is valid if the total is a multiple of 10. It catches all single-digit errors and most transpositions.
Yes, easily. Luhn only checks internal consistency of the digits, not whether the card exists or is active. Valid-looking test numbers are generated this way deliberately. Only bank authorization confirms a real card.
The first 6–8 digits (the Issuer Identification Number) identify the network: 4 for Visa, 51–55 or 2221–2720 for Mastercard, 34/37 for Amex, and so on. The prefix alone is enough to show the brand logo.
No — it is a user-experience feature. It gives instant feedback on typos before the form submits. Real security comes from CVV checks, address verification, 3-D Secure, and server-side authorization through a PCI-compliant payment processor.
