Those 16 Digits on Your Card Tell a Complete Story: System Design & The Luhn Algorithm.

Card Number Architecture (Every Digit Has a Purpose)

Payment card numbers usually range from 15 to 19 digits (with 16 digits being the global standard for Visa, Mastercard, and RuPay). The architecture is split into 4 distinct layers:

Let's dissect each of these 4 components in detail to understand how payment processors use them in real-time.

What is MII (Major Industry Identifier)?

The very first digit of a card number is known as the Major Industry Identifier (MII). It immediately tells the payment terminal or online checkout page which industry category and network family the card belongs to.

BIN / IIN: The Card Identity Layer

The first 6 digits (and recently expanded to the first 8 digits under the latest ISO update) form the Bank Identification Number (BIN), also called the Issuer Identification Number (IIN).

Middle Digits: Individual Customer Account Reference

Digits 7 through 15 represent the customer's specific account identifier. These digits are assigned exclusively by the issuing bank (not the card network like Visa or Mastercard).

Luhn Check Digit: Fast Math to Catch Human Typos

The last digit (the 16th digit on a 16-digit card) is NOT part of your account number. It is a mathematical validation checksum calculated using the Luhn Algorithm (also known as the “Modulus 10” or “Mod 10” algorithm), created by IBM scientist Hans Peter Luhn in 1954.

/**
 * Production-ready Luhn Check Digit Algorithm in Java
 * Verifies standard ISO/IEC 7812 payment card numbers
 */
public class LuhnValidator {

    public static boolean isValidCardNumber(String cardNumber) {
        if (cardNumber == null || cardNumber.length() < 13 || cardNumber.length() > 19) {
            return false;
        }

        // Remove optional spaces or dashes
        String cleanNumber = cardNumber.replaceAll("[^0-9]", "");
        int sum = 0;
        boolean alternate = false;

        // Process digits from right to left
        for (int i = cleanNumber.length() - 1; i >= 0; i--) {
            int n = Character.getNumericValue(cleanNumber.charAt(i));

            if (alternate) {
                n *= 2;
                if (n > 9) {
                    // Equivalent to adding digits: e.g. 16 -> 1+6 = 7 or (16 - 9 = 7)
                    n = (n % 10) + 1;
                }
            }

            sum += n;
            alternate = !alternate;
        }

        // If total sum is divisible by 10, the card number is mathematically valid
        return (sum % 10 == 0);
    }

    public static int calculateCheckDigit(String numberWithoutCheckDigit) {
        String clean = numberWithoutCheckDigit.replaceAll("[^0-9]", "");
        int sum = 0;
        boolean alternate = true; // In calculating check digit, first digit from right doubles

        for (int i = clean.length() - 1; i >= 0; i--) {
            int n = Character.getNumericValue(clean.charAt(i));
            if (alternate) {
                n *= 2;
                if (n > 9) n = (n % 10) + 1;
            }
            sum += n;
            alternate = !alternate;
        }

        int remainder = sum % 10;
        return (remainder == 0) ? 0 : (10 - remainder);
    }

    public static void main(String[] args) {
        // Example from architecture breakdown:
        String testCard = "4539672198765430";
        System.out.println("Card Valid: " + isValidCardNumber(testCard));
    }
}

CVV: Why It Is Never Stored in Databases

The 3-digit (or 4-digit for Amex) Card Verification Value (CVV/CVC) is a cryptographic security code. Its purpose is to prove to the issuing bank that the person initiating an online purchase (Card Not Present) actually holds the physical card.

“CVV is not random, and under global PCI-DSS compliance regulations, it is NEVER stored in any database.”

If a hacker breaches an e-commerce website or merchant database, they may steal stored card numbers and expiry dates, but they can never steal CVVs because merchants are legally forbidden from saving them.

Card Numbers Aren't Random. They're Engineered Systems.

The next time you make an online transaction or enter your credit card into a checkout form, remember the layers of engineering executing in milliseconds: