# Credit Card Number Key: `finance.payment.credit_card_number` Credit card or debit card primary account number (PAN). Typically 13-19 digits. Last digit is check digit (Luhn algorithm). HIGHLY SENSITIVE — encrypt immediately in production. Page: Samples: `4532015112830366`, `5425233430109903`, `374245455400126` ## Use it Shell ```shell finetype infer -i '4532015112830366' --mode column # → finance.payment.credit_card_number ``` DuckDB ```sql SELECT ft_infer('4532015112830366'); -- → 'finance.payment.credit_card_number' ``` Cast template: {col} is your column ```sql CAST({col} AS VARCHAR) ``` ## Background ### Origin A payment card number, also called a primary account number (PAN), is the card identifier found on payment cards such as credit cards and debit cards.[[1]](https://en.wikipedia.org/wiki/Payment_card_number) Payment card numbers are allocated in accordance with ISO/IEC 7812.[[1]](https://en.wikipedia.org/wiki/Payment_card_number) ISO/IEC 7812, Identification cards – Identification of issuers, is an international standard published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).[[2]](https://en.wikipedia.org/wiki/ISO/IEC_7812) ISO/IEC 7812 has two parts: Part 1, Numbering system, and Part 2, Application and registration procedures.[[2]](https://en.wikipedia.org/wiki/ISO/IEC_7812) The registration authority for issuer identification numbers is the American Bankers Association.[[2]](https://en.wikipedia.org/wiki/ISO/IEC_7812) The leading digits of a payment card number form the issuer identification number (IIN), sometimes called the bank identification number (BIN).[[1]](https://en.wikipedia.org/wiki/Payment_card_number) The first digit of the IIN is the major industry identifier (MII).[[1]](https://en.wikipedia.org/wiki/Payment_card_number) The digits after the IIN, except the last, are the individual account identification number.[[1]](https://en.wikipedia.org/wiki/Payment_card_number) The last digit of a payment card number is a check digit calculated with the Luhn algorithm.[[1]](https://en.wikipedia.org/wiki/Payment_card_number) The maximum total length of a PAN is 19 digits.[[2]](https://en.wikipedia.org/wiki/ISO/IEC_7812) The Luhn algorithm was created by IBM scientist Hans Peter Luhn.[[3]](https://en.wikipedia.org/wiki/Luhn_algorithm) The Luhn algorithm is described in US patent 2950048A, granted on 23 August 1960.[[3]](https://en.wikipedia.org/wiki/Luhn_algorithm) The Luhn algorithm is specified in Annex B of ISO/IEC 7812-1.[[2]](https://en.wikipedia.org/wiki/ISO/IEC_7812) The Luhn algorithm was meant to let a computer quickly check a number for errors when a human enters it.[[3]](https://en.wikipedia.org/wiki/Luhn_algorithm) The Luhn algorithm was designed to protect against accidental errors, not malicious attacks.[[3]](https://en.wikipedia.org/wiki/Luhn_algorithm) ### Use Wikipedia's table of issuing networks lists the IIN range of Visa as 4.[[1]](https://en.wikipedia.org/wiki/Payment_card_number) Wikipedia's table of issuing networks lists the IIN ranges of American Express as 34 and 37.[[1]](https://en.wikipedia.org/wiki/Payment_card_number) American Express card numbers are 15 digits long.[[1]](https://en.wikipedia.org/wiki/Payment_card_number) Visa's VPay brand can specify PAN lengths from 13 to 19 digits.[[1]](https://en.wikipedia.org/wiki/Payment_card_number) Treat any brand lookup built from leading digits as a guide that needs refreshing as networks add ranges, not as a fixed fact. (Meridian's view) Most credit card numbers use the Luhn algorithm as a simple way to tell valid numbers from mistyped or otherwise incorrect ones.[[3]](https://en.wikipedia.org/wiki/Luhn_algorithm) The Luhn algorithm detects all single-digit errors and almost all transpositions of adjacent digits.[[3]](https://en.wikipedia.org/wiki/Luhn_algorithm) The Luhn algorithm does not detect the transposition of 09 to 90, or the reverse.[[3]](https://en.wikipedia.org/wiki/Luhn_algorithm) A column dominated by a handful of repeated numbers may well be test data rather than real cards, so check where it came from before you treat it as either. (Meridian's view) Strip spaces and hyphens before you validate a card number, and keep it as text rather than as a number. (Meridian's view) The PCI Security Standards Council says the first six and last four digits is the truncation format accepted by all payment brands.[[4]](https://blog.pcisecuritystandards.org/8-digit-bins-and-pci-dss-what-you-need-to-know) Tokenisation replaces the true account number with an artificial account number, or token, that is printed, stored or transmitted in its place.[[1]](https://en.wikipedia.org/wiki/Payment_card_number) If you meet full card numbers in a file where you did not expect them, raise it with whoever owns data protection before you go any further. (Meridian's view) ## Sources 1. [Payment card number - Wikipedia](https://en.wikipedia.org/wiki/Payment_card_number) — secondary source 2. [ISO/IEC 7812 - Wikipedia](https://en.wikipedia.org/wiki/ISO/IEC_7812) — secondary source 3. [Luhn algorithm - Wikipedia](https://en.wikipedia.org/wiki/Luhn_algorithm) — secondary source 4. [8-digit BINs and PCI DSS: What You Need to Know](https://blog.pcisecuritystandards.org/8-digit-bins-and-pci-dss-what-you-need-to-know) — organisation ## How it's detected Check digit uses Luhn algorithm (validated in crate, not SQL). MUST be encrypted/tokenized in production. PCI DSS compliance required. Decompose extracts issuer ID, card type, last 4.