What a card number validator checks

A card number validator confirms format and structure only. It verifies that the digits match an expected length, that the leading issuer prefix falls inside an assigned range, and that the last digit satisfies the Luhn mod-10 checksum. It does not contact an issuer, confirm the account exists, or return a balance. A number that passes validation can still be closed, frozen, or fictitious.

Checks run in order

1. Strip spaces and hyphens so only digits remain.
2. Reject input that contains letters or symbols.
3. Compare the digit count against the 12 to 19 range set by ISO/IEC 7812.
4. Match the first six to eight digits against issuer identification ranges.
5. Run the Luhn checksum and reject on any mismatch.

How the Luhn check works

Working from the rightmost digit leftward, double every second digit. If a doubled value is greater than 9, subtract 9 from it. Add every digit, doubled or not. The number passes when the total divides by 10 with no remainder.

1. Reverse the digit string.
2. Double each digit at an odd position, counting from one at the right.
3. Subtract 9 from any result above 9.
4. Sum all values and test whether the total modulo 10 equals zero.

A single mistyped or transposed digit breaks the checksum, which is the point of the algorithm. It catches human entry errors, nothing more.

What validation cannot tell you

• Whether the account is open
• Whether funds are available
• Whether the card was reported lost or stolen
• Whether the billing address matches
• Whether the card is enrolled in 3-D Secure

Only an authorization request sent through a payment processor answers those questions, and that request requires a merchant account and a real transaction. Any tool that claims to confirm a live card from the number alone is guessing or misrepresenting what it does.

Using a validator in a payment form

1. Run length and Luhn checks in the browser to catch typos before submit.
2. Repeat both checks on the server, since browser input is untrusted.
3. Tokenize the number with your processor so the raw primary account number never lands in your database.
4. Log validation failures as counts only, never with the digits attached.
5. Truncate any stored reference to the last four digits.

Scope under PCI DSS grows with every system that touches a primary account number. Keep the number out of logs, out of analytics, and out of error messages, and the validator stays a simple input filter rather than a compliance problem.