Home > Articles > Security > What Credit Card numbers can/should tell us

How can one make sure that a provided credit card number is valid?
There might be the situation that a customer wants to provide you the number by telephone.
Although checking CC numbers is a science on it’s own, there are some basic rules good to keep in mind:

Starting digit:
Every credit card type has it’s fixed starting digit – good to know:

Amex/Diners Club: 3
VisaCard: 4
Mastercard: 5
Discover: 6

Length of number:
Also the length of the number is fixed according to card type:

DinersClub: 13
Amex: 15
All others: 16

So, the customer wants to pay with his VISA Card, but he provided only 15 digits?
And even worse, the first digit was a 7?
No, we don’t think so…

Luhn or Mod10 algorithm – the CC checksum has to be right
This checksum algorithm was invented by Hans Luhn. If the generated checksum can be divided by 10 without rest – then the number is valid – so the basic idea.
Here a practical PHP function to validate a credit card numer with it:

function VerifyLuhn($number) {
   $split = array_reverse(str_split($number));
     for ($i=1;$i<=count($split);$i+=2) {
        if (isset($split[$i])) $split[$i] = array_sum(str_split($split[$i]*2));
     }
   return (array_sum($split) % 10) ? FALSE : TRUE;
}

Warning: Using “Online Credit card number verifiers” is potentially dangerous! Somebody might “harvest” valid credit numbers and misuse them.



Comments, improvments are welcome!




Choose the way you would like to be notified for latest posts.

Subscribe to the RSS feed Sign up for Email alerts Follow on Twitter

1 Comment

Leave a Comment