Credit card trick: Your card number is anything but random

When you enter your credit card details in an online shop, the number often seems like a long and random string of digits. You type in the expiration date, security code and the full card number, and a few seconds later you get a message on the screen that everything is fine or that an error has occurred.

It may look like a sophisticated control system behind the scenes. In practice, the first check of the card number is based on a fairly simple method. The numbers on the card follow certain rules from the start.

For example, Visa cards start with the number 4, while American Express typically starts with 34 or 37. The length is not random either. Some Visa cards have 13 digits, while many Mastercard cards use 16.

Card providers can therefore tell a lot from the first digits. They know which system the card belongs to and what type of number they can expect. Still, that’s not enough. A quick mathematical test is also needed before a system can accept a number as valid.

How the Luhn algorithm works in practice

The most common method is called the Luhn algorithm. It checks whether a card number is logically consistent. The method was developed by the German-American engineer Hans Peter Luhn, and the algorithm is used today across many card types and systems.

An example is the fictional card number “3845 0732 7862 1263”, where the last digit is a kind of check digit. First you take every other digit from the right side, starting just before the check digit. Those digits are multiplied by two. If the result is a two-digit number, you add the digits together so that 14 becomes 1 + 4.

When all these processed digits are ready, you add them together. Then you add the remaining digits to the total sum.

Finally, you add the check digit. According to Chip.de, you can then check whether the total is divisible by ten with no remainder and, if it is, the number is Luhn-approved and therefore formally valid.

It sounds technical, but the whole process can be done in just a few steps. Therefore, an online shop can check an entered number almost instantly.

What the algorithm can’t reveal

Although the Luhn algorithm is effective at catching typos, it has clear limitations. It can’t always tell when two digits have swapped places in a way that still produces a result that adds up to ten.

Errors like 09 becoming 90 can slip through. The same goes for certain swaps between even number pairs like 22 and 55 or 33 and 66.

The algorithm only works with the number sequence itself. It has no access to information about the specific account. Therefore, it cannot determine whether the card is blocked, expired or reported stolen.

The rest of the security lies with the banks, card companies and the systems that monitor suspicious transactions in real time.