I was putting in my cc number and and as soon as I had finished inputting 16 digits it highlighted it in red. I looked it over and realized one digit was wrong. Corrected it, it became black. How did the website know it was wrong?
8
-
12That is called a checksum - credit cards use them. This is not a security question, tho.– Tobi NaryJul 5, 2019 at 10:27
-
16@Tobi Nary How information is validated is a legitimate security question.– PatriotJul 5, 2019 at 22:22
-
4@TobiNary that's an answer, already.– CriggieJul 5, 2019 at 22:43
-
6en.wikipedia.org/wiki/Payment_card_number - 12 digits per issuer => 10^12 cards. I think we'll run out of people first, not to mention plastic.– RichJul 6, 2019 at 5:49
-
1This is a duplicate, but I don't believe it's off-topic unless we also close the suggested duplicate.– forestJul 8, 2019 at 0:47
|
Show 3 more comments
2 Answers
Credit card numbers can verified by calculating a checksum.
Every credit card number created is assigned a number following an algorithm.
Ross Millikan: The checksum specifies the last digit, so there are 15 digits left. That should mean there are 10^15 numbers available, but there are other restrictions. The first digit is the card type (4=Visa, 5=MasterCard, etc.) and the next several have to do with the issuer.
Following that, if this a credit card number does not comply with the algorithm, the checksum is incorrect so the number must be invalid.
The algorithm is called the “Luhn algorithm”, check this Wikipage for more Info.
TripeHound: Note: if a given number fails the check, it is definitely not a real CC number. However, if it passes the check, it only proves that it is a potential CC number: it does not prove that it has actually been issued. The next stage of verification (talking to a card-processor) should verify that. Similar checks can be made on UK sort-code/account-number pairs (and probably something similar in other countries) and on International Bank Account Numbers (IBANs)
Edit: Added some of the information given in the Comments to the Answer. Pleas go and give them an Upvote too, its great information.
-
40Note: if a given number fails the check, it is definitely not a real CC number. However, if it passes the check, it only proves that it is a potential CC number: it does not prove that it has actually been issued. The next stage of verification (talking to a card-processor) should verify that. Similar checks can be made on UK sort-code/account-number pairs (and probably something similar in other countries) and on International Bank Account Numbers (IBANs) Jul 5, 2019 at 12:40
-
2And EAN barcode numbers. And personal ID numbers in most countries. And railway car markings. And... it goes on and on. Practically everything that has a long numeric identifier these days and back a few decades.– GáborJul 5, 2019 at 23:28
-
3@larry909: The checksum specifies the last digit, so there are 15 digits left. That should mean there are 10^15 numbers available, but there are other restrictions. The first digit is the card type (4=Visa, 5=MasterCard, etc.) and the next several have to do with the issuer. Jul 6, 2019 at 0:34
-
2There are 2 trillion numbers available for American Express cards. The size of the numbers was obviously chosen so that they wouldn't run out soon. If they did somehow run out, they can just add an extra digit.– RobynJul 6, 2019 at 1:37
-
12The algorithm is called “Luhn algorithm”, perhaps you could mention its name in the answer? Jul 6, 2019 at 15:54
Most credit card providers use a form of checksum for their credit card numbers, generally the Luhn Algorithm. Verifying the Luhn Algorithm is as simple as executing it on a number and obtaining 0 as a result. If a different result is obtained, then the checksum fails.
You can see on the Payment card number page in Wikipedia that credit card number issuers can be recognized by their prefix and number of digits, and that to this day a single issuer (Diners Club enRoute) does not use the Luhn Check.
It is customary to use the Luhn Check as early as possible when validating inputs, so as to provide quicker feedback to the user, and reduce processing costs.
The algorithm is used by many other types of numbers, as you can see in the Wikipedia article. It is a rather simple way to protect against many kinds of typos or transmission errors. It is not fool-proof, though, and most notably certain easy mistakes, such as inverting the order of two consecutive digits, are not detected.
