What Card Is This? How to Identify and Validate a Card From Its Number

A customer emails support with a card number that "keeps getting rejected." Your checkout says the card is invalid, the customer insists it works everywhere else, and nobody on the team can say at a glance whether it is a Visa, a Mastercard or a typo.

Every card number carries more information than most teams use. The first digits say which network issued it and often which bank and country it comes from. The last digit is a checksum that catches most typing mistakes before you ever send a payment. Reading both correctly prevents failed first charges, speeds up support and gives your retry logic the context it needs later.

This guide explains how to tell what card a number belongs to, how card number validation works, what a BIN lookup adds, and where validation stops and an actual authorization has to take over.

TLDR:

• The first digits of a card number identify the network: 4 is Visa, 51-55 and 2221-2720 are Mastercard, 34 and 37 are American Express.
• The first 6 or 8 digits are the BIN, which identifies the issuing bank, country and card type; new BINs have been 8 digits since April 2022.
• The last digit is a Luhn check digit that catches almost all single-digit typos and most swapped adjacent digits.
• A valid number is not a working card: only an authorization or account verification proves the card is open and can be charged.
• Slicker's free card validator and BIN lookup run these checks, and Slicker's smart retries use card type and issuer to time recovery after a decline.

How a Card Number Is Structured

Payment card numbers follow the ISO/IEC 7812 numbering standard, which defines how issuer identification numbers are assigned. A card number, also called the primary account number or PAN, has three parts:

• Issuer identification number (IIN), usually called the BIN. The leading digits. The first digit is the major industry identifier, and 3, 4, 5 and 6 cover almost all payment cards.
• Individual account number. The digits after the BIN that the issuer assigns to the cardholder's account.
• Check digit. The final digit, calculated from all the others with the Luhn algorithm.

Most cards are 16 digits long, but lengths from 12 to 19 digits are valid depending on the network. American Express uses 15 digits, and some Diners Club, Discover, JCB and UnionPay cards run to 19.

What Card Is This? Identify the Network From the First Digits

The quickest answer to "what card is this?" comes from the leading digits. Each network owns specific ranges, so the prefix tells you the brand before you look anything up.

Two details trip teams up. Mastercard's 2-series range, from 2221 to 2720, is still missing from some older validation code that only accepts cards starting with 5, so genuine Mastercard numbers get rejected at checkout. And ranges can overlap at the edges, so a prefix check should test the longest matching prefix first.

The Slicker card validator applies these same prefixes and lengths and runs entirely in your browser, so you can check a number without sending it anywhere.

What a BIN Tells You Beyond the Network

The network is only the start. The full BIN identifies the issuing bank and, through a BIN database, adds details that matter for payments:

• Issuer: the bank or fintech that issued the card.
• Country of issue: which decides rules such as Strong Customer Authentication in Europe and recurring mandate rules in India.
• Card type: credit, debit or prepaid.
• Card level or product: consumer, business, corporate or a premium tier.

A BIN lookup tool returns these fields from the first 6 to 8 digits. You never need the full card number to do it, which keeps the lookup outside the most sensitive part of the data.

6 Digit vs 8 Digit BINs

For decades the BIN was the first six digits. That range ran short as the number of issuers and card programs grew, so the standard moved to eight digits. According to Visa's numerics FAQ, Visa set April 2022 as the deadline for acquirers and processors to handle eight-digit issuing BINs, stopped assigning six-digit issuing BINs after that release, and expects both lengths to coexist. Card numbers stay 16 digits; only the share of digits that identifies the issuer changes.

For you, that has three practical consequences:

• Lookups on six digits can be ambiguous. Two issuers can share the same first six digits and differ only in digits seven and eight. Use eight digits when your provider exposes them.
• Routing and risk rules keyed on six digits may misfire. Rules such as "block prepaid cards from issuer X" can catch the wrong cards or miss the right ones.
• Masking rules did not simply expand. The PCI Security Standards Council notes that first six and last four remains the format every brand accepts, and longer formats such as first eight and last four are maximums for legitimate business needs, not a default.

How the Luhn Check Validates a Card Number

The Luhn algorithm, also called the modulus 10 check, is the arithmetic behind the last digit. It does not prove a card exists. It proves the digits are internally consistent, which catches the most common data entry errors.

Here is how it works on Stripe's familiar test number, 4242 4242 4242 4242:

1. Start from the rightmost digit and move left. The rightmost digit is the check digit itself.
2. Double every second digit, starting with the one just left of the check digit. In this number, every 4 becomes 8.
3. If doubling gives a two-digit result, add its digits (for example, 7 doubled is 14, which becomes 1 + 4 = 5). None of the 8s need this.
4. Add everything up. Eight doubled digits of 8 give 64, plus eight undoubled digits of 2 give 16, for a total of 80.
5. If the total is divisible by 10, the number passes. 80 is, so the number is valid.

The check catches every single mistyped digit and almost every case where two neighboring digits are swapped. That is why running it in the browser, before the customer submits a form, is one of the cheapest ways to prevent a failed first payment.

What Card Validation Can and Cannot Tell You

Validation answers "is this a well-formed card number from a real network?" It cannot answer "will this card pay?" Teams that blur the two end up either blocking good customers or trusting bad cards.

Only the last two rows involve the issuer. That is the boundary: everything above it is free and instant, and everything below it costs a network call and depends on the bank's answer.

Using Card Data to Prevent Failed First Payments

Most failed first payments on a subscription come from avoidable input problems: a mistyped number, an expiry date in the past, or a card type your product cannot accept. A few checks at the moment of entry remove most of them:

• Run the Luhn and prefix checks as the customer types, and show the detected network logo so they can see a mistake immediately.
• Validate expiry and security code length per network. American Express uses a four-digit code; most others use three.
• Decide your prepaid policy in advance. Prepaid cards often lack funds for renewals and some cannot be used for recurring charges at all. Use the BIN to warn or block before the subscription starts, not after it fails.
• Verify the card before a trial ends. A zero-amount authorization at signup confirms the issuer recognizes the card, which catches closed and fake cards before you give away a month of service.

Why Card Type Matters When a Renewal Fails

Card data matters even more after a decline. The same decline code means different things on different cards, and the BIN is how you tell them apart.

A consumer debit card declined for insufficient funds usually recovers after the next payday. A corporate card declined for the same reason is more likely sitting at a monthly spending limit, so a retry after the limit resets works better. A prepaid card declined for insufficient funds may never be reloaded, so repeated retries add risk without adding revenue. Issuer country decides whether a failure needs the customer to authenticate, as covered in the guide to authentication required declines.

That is also why insufficient funds is not one problem but several. The guide to code 51 retry timing shows how much the right timing depends on the card behind the decline, and the same reasoning applies to the larger, variable charges covered in failed payments in usage-based billing.

Card Numbers Change, Customers Do Not

Even a perfectly validated card number has a shelf life. Cards expire, get reissued after fraud or a lost wallet, and move to new BIN ranges when issuers change programs. The customer is the same, but the number on file stops working.

Network account updater services and network tokens refresh many of these details automatically, but coverage varies by issuer and region. The comparison of card account updaters and predictive retries covers where each one helps. Whatever you use, a card that was valid at signup should never be assumed valid at renewal.

Is It Safe to Use an Online Card Validator?

It depends on where the check runs. A validator that sends the full card number to a server exposes data you are responsible for protecting, and you have no way to know whether it is logged. A validator that runs in your browser never transmits the number, which is the safe pattern for checking a format or detecting a network.

For BIN lookups you never need the full number: the first 6 to 8 digits are enough. Keep full numbers inside your payment provider's tokenized fields, and use validators only for formats, prefixes and BINs.

How Slicker Uses Card Data to Recover Failed Payments

Slicker's free card validator and BIN lookup answer "what card is this?" in seconds, and its decline code glossary explains what each issuer response means. The same data drives Slicker's recovery engine.

For every failed subscription payment, Slicker's smart retries combine the decline code with the card's network, type, issuer and country to decide whether to retry and when. Consumer debit cards are retried around pay cycles, corporate cards around spending limit resets, and cards that will never work go straight to a hyper-personalized email asking for a new payment method. Every change is measured with AABB testing against your current setup.

Final Thoughts on Identifying and Validating Card Numbers

The digits on a card tell you the network, the issuer, the country and whether the number was typed correctly, all before you spend a single network call. Using them at checkout prevents avoidable failures, and using them after a decline turns a generic retry schedule into one that fits the card.

What they cannot tell you is whether the card will pay next month. That takes an issuer's answer, and when the answer is no, it takes recovery logic that knows what kind of card it is dealing with. Talk to the Slicker team about using card data to recover more failed payments.

FAQ

How can I tell what type of card a number is from the first digits?

Look at the leading digits. Visa starts with 4, Mastercard with 51-55 or 2221-2720, American Express with 34 or 37, and Discover with 6011, 644-649 or 65. For the issuing bank, country and whether it is credit, debit or prepaid, run the first 6 to 8 digits through a BIN lookup.

Does a card number that passes the Luhn check mean the card is real?

No. The Luhn check only confirms the digits are internally consistent, which catches typos. A made-up number can pass it. Only an authorization or account verification with the issuer confirms that the card exists, is open and can be charged.

What is the difference between a BIN and an IIN?

They are the same thing. IIN, issuer identification number, is the term used in the ISO/IEC 7812 standard, while BIN, bank identification number, is the older industry term. Both refer to the first 6 or 8 digits of a card number that identify the issuer.

Why does my checkout reject Mastercard cards that start with 2?

Mastercard added the 2221-2720 range years ago, but some older validation code still only accepts Mastercard numbers starting with 5. Update the prefix rules to include the 2-series range and check that your BIN handling supports both 6 and 8 digit BINs.

Is the Slicker card validator safe to use with a real card number?

Yes. The Slicker card validator runs entirely in your browser, so the number is never sent to a server, stored or logged. For issuer and country details, the BIN lookup needs only the first 6 to 8 digits, never the full card number.