Methodology: How Our Data and Tools Work

Card numbering: ISO/IEC 7812

Payment card numbers follow the ISO/IEC 7812 standard. The first digit is the Major Industry Identifier, the leading digits form the Issuer Identification Number (IIN, commonly called the BIN), the following digits identify the individual account, and the last digit is a check digit.

Card networks are recognised by their prefixes and lengths, for example Visa numbers start with 4, and several networks use specific ranges in the 2 and 5 series. Our tools use these published patterns to identify the brand of a number.

6-digit and 8-digit BINs

The IIN was historically six digits. The standard was updated to support eight-digit IINs, and the major networks have been moving to eight-digit ranges. One six-digit prefix may therefore cover several issuers or products.

When you enter eight or more digits, we look for the most specific matching range first and fall back to the six-digit range when no eight-digit record exists.

The Luhn checksum

The Luhn algorithm (mod 10) detects most single-digit typing errors and many transpositions. It works like this:

1. Starting from the rightmost digit and moving left, double every second digit.
2. If doubling gives a number above 9, subtract 9.
3. Add all the digits together.
4. If the total is a multiple of 10, the number passes the check.

Passing the Luhn check only means a number is well formed. It does not mean the card exists, is active or has funds.

How the BIN database is compiled

Our BIN database combines publicly available range information, industry references and corrections reported by users. Records are normalised so that brand, type, level, bank and country use consistent names and codes, and conflicting records are reviewed before they are merged.

Card networks do not publish a complete public list of every range, so no third-party BIN database can be perfect. We are open about these limits:

• Issuers can reassign, merge or retire ranges at any time, and records may lag behind.
• Bank names may reflect an older name after a merger or rebranding.
• Card level and type are the most likely fields to be missing or outdated.
• Private label, fleet and some prepaid ranges may not be listed.

IP geolocation

IP lookups use the DB-IP Lite database together with network ownership (ASN) data. Country-level results are generally accurate, because IP blocks are allocated to networks in specific countries.

City, region and coordinates are approximate. Mobile carriers, corporate networks, VPNs and satellite connections can place a user far from the reported location, so city data should never be used as proof of where someone is.

VPN and proxy detection compares the network that owns an IP with known hosting, VPN and Tor networks. It produces a risk signal, not a certainty.

SWIFT/BIC and IBAN validation

A SWIFT/BIC code has 8 or 11 characters: a bank code, an ISO country code, a location code and an optional branch code. We check the format and country code and match codes against our reference directory.

IBANs are validated with the ISO 13616 MOD-97 check: the first four characters are moved to the end, letters are converted to numbers, and the result must leave a remainder of 1 when divided by 97. We also check the length expected for each country.

Synthetic test data

Card numbers and IBANs produced by our generators are synthetic. They are built from a chosen prefix or country format with random digits and a correct check digit, so they pass format validation in software under test.

They are not linked to any real account, and expiry dates and security codes are random. Test data is for development, QA and education only.

Updates and corrections

Reference data is reviewed and refreshed periodically, and reported errors are checked and corrected as they come in. The date shown on each page is when the page content was last reviewed.