How does a website instantly know if a certain credit card number is wrong?

Question

I was renewing my Internet subscription through the online portal of my ISP. What struck me was when I was entering my credit card details, I entered the type of my credit card (MasterCard, Visa, AA, etc), and when I entered the numbers, there was one number that I entered wrong. When I pressed the submit button, the website automatically gave me an error that the card number I entered was invalid. I sense this was done locally in the browser and no data was pushed and checked on a server and a reply sent back.

Is there any sequence of numbers each vendor has? Otherwise, how would the website (locally) know about the wrong number?

Answer 1

Checksums

CC numbers, as well as pretty much any other well designed important numbers (e.g. account numbers in banks) tend to include a checksum to verify integrity of the number. While not a security feature (since it's trivial to calculate), a decent checksum algorithm can guarantee to always fail if (a) a single typo was made or (b) two neighbouring digits are swapped, which are the two most common errors when manually entering long numbers.

http://rosettacode.org/wiki/Luhn_test_of_credit_card_numbers is an example of such a test.

Issuer

If a CC number is technically correct, it may still be not a real CC number. The method for verifying that is simple and complicated at the same time - generally, if you have appropriate access you are able to the look up the issuer institution for each range of card numbers, and then you ask the issuer[s card systems] if they think that this is a valid card. Well, the second part generally happens as a part of making a CC payment, but verifying the issuer is sometimes done before that as an extended test; but not on the client browser.

Answer 2

In the United States, they use the Luhn algorithm:

http://en.wikipedia.org/wiki/Luhn_algorithm

How the algorithm verifies a number:

1. From the rightmost digit, which is the check digit, moving left, double the value of every second digit; if the product of this doubling operation is greater than 9 (e.g., 8 × 2 = 16), then sum the digits of the products (e.g., 16: 1 + 6 = 7, 18: 1 + 8 = 9).
2. Take the sum of all the digits.
3. If the total modulo 10 is equal to 0 (if the total ends in zero) then the number is valid according to the Luhn formula; else it is not valid.

How to calculate the check digit:

The check digit is obtained by computing the sum of digits then computing 9 times that value modulo 10. In algorithm form:

1. Compute the sum of the digits (after doubling every second digit).
2. Multiply by 9.
3. The last digit is the check digit.

Example:

Number: 4321-5678-7531-456x (where x is the check digit).

1. Number:              4   3   2   1   5   6   7   8   7   5   3   1   4   5   6   X
2. Double every second: 8       4      10      14      14       6       8      12
3. Sum digits >9:       8   3   4   1   1   6   5   8   5   5   6   1   8   5   3
4. Sum all digits:      8 + 3 + 4 + 1 + 1 + 6 + 5 + 8 + 5 + 5 + 6 + 1 + 8 + 5 + 3 = 69

5. Multiply sum by 9:   69 x 9 = 621
6. Take value mod 10:   621 mod 10 = 1  =>  x = 1

The check digit is 1 and the comnplete valid number is 4321-5678-7531-4561.

If you were to run through the algorithm again to verify the number, then the sum of all digits in Step 4 would be 69 + 1 = 70. Then, 70 mod 10 = 0, so the number is valid according to the algorithm.

Answer 3

1. A lot of sites have client side checks on the CC #. All credit card numbers are about the same length. (As commenters point out, there are several lengths. In general, the lengths are known by the implementor and there is a small set.) There are strings of numbers that relate to each vendor.
2. From a security standpoint there better be some server side checks too. If you're a pen tester that would be something to check. If you're not, then stay off it because you could get in some big trouble.

https://www.mint.com/blog/trends/credit-card-code-01202011/

Answer 4

Checksums, Card Range Recognition and Length Checks

Most (but not all) card schemes use the Checksum (Luhn) testing described in other answers. However, in addition some algorithms also use (fairly basic) Card Range Recognition (CRR) based on the beginning of the card number (AKA the range). Some also check the card length.

See for example the similarities in many of the various algorithms described at:- https://stackoverflow.com/questions/72768/how-do-you-detect-credit-card-type-based-on-number

Answer 5

Just for completeness: The Luhn algorithm does have one minor flaw.

TL;DR: "the Luhn algorithm detects the transposition of adjacent digits if they are not 09 or 90"

If d1 and d2 are adjacent digits in the credit card number (d1 != d2), then their contribution to the checksum is either f(d1) + d2 or f(d2) + d1, and if transposed they are either f(d2) + d1 or f(d1) + d2. If these two sums are the same or their difference is a multiple of 10, then the checksum does not distinguish between their transposition.

"Credit Cards" 2007, in An Introduction to the Mathematics of Money, Springer New York, NY, pp. 101-112.

The function f(d) is the doubling and sum of digits that might be defined as follows in python for integers d: def f(d): return sum([int(x) for x in str(2 * d)])

There are no two digits that will be zero mod 10 in the above scenario. The proof is tedious, but it can be found in full in the following resource from which I have taken the above block quote.