A card number checker runs one math test on a string of digits. That's the whole job. It confirms the number follows the numbering standard the card networks use, a checksum called the Luhn algorithm, or mod 10. It does not call a bank. It does not look up an account. It cannot tell you if a card is open, funded, frozen, or stolen. Anyone who claims otherwise is selling you something.

related article

How the Luhn check actually works

Hans Peter Luhn, an IBM engineer, patented the formula in the 1950s, and it ended up in ISO/IEC 7812 as the check digit rule for payment cards. The steps are simple enough to do by hand:

card checker software

1. Start from the rightmost digit and move left.
2. Double every second digit.
3. If a doubled digit lands above 9, subtract 9 from it.
4. Add everything together.
5. If the total is divisible by 10, the number passes.

That's it. The last digit of a card number is calculated from the digits before it, so a single mistyped digit usually breaks the sum.

cvv verification tool

What the individual digits mean

ISO/IEC 7812 also lays out the structure. The first digit is the major industry identifier: 4 for Visa, 5 and the 2 series for Mastercard, 3 for American Express and Diners Club, 6 for Discover. The next several digits form the issuer identification number, which points at a bank and a card product. The rest is the account number, and the final digit is the checksum.

more on this topic

The CVV sits outside all of this. It is a separate 3 or 4 digit value derived from the card data and the magnetic stripe or chip, and no public checker can validate it. Same for the expiration date and the cardholder name. A site that says it verified all three is guessing.

Why "valid" means almost nothing

Roughly one in ten random 16 digit strings passes the Luhn test by chance. That's the entire bar. So when a listing or a forum post says a number was "checked," it means someone typed digits into a script and the script returned true. It says nothing about whether an account exists behind it or whether a charge would go through. In my experience reading fraud reports, the numbers sold in these channels are a mix of dead accounts, test numbers pulled from public developer docs, and outright bait designed to collect a payment and disappear.

There's also the legal side. Buying, selling, or possessing someone else's card credentials is a federal crime in the US, and the FTC treats card data marketplaces as identity theft operations. Funds sent to one of those sellers are usually gone, and the buyer has no recourse because the transaction itself is illegal.

Legitimate reasons to validate a number

• Catching typos in a checkout form before you send a charge request.
• Testing your own payment integration with the sandbox numbers your processor publishes.
• Confirming that a number a customer read to you over the phone has the right digit count.
• Displaying a masked card in a support tool. PCI DSS says show no more than the first six and last four digits.

Notice that none of these involve checking a stranger's card. If you're validating your own card, read it off the plastic or call the number on the back. Never paste a live card number into a random checker site, because that string plus your CVV is exactly what the site would need to use it.

If a card number gets misused

Report it to the issuer the same day. Under the Fair Credit Billing Act, your liability for unauthorized credit card charges caps at $50, and many issuers waive even that. Debit card rules are harsher: $50 if you report within two business days, up to $500 after that, and potentially the full balance if you wait past 60 days. The CFPB publishes the timelines. Speed matters more than anything else you do.