Credit Card Number Structure: BIN, IIN, and What Each Digit Means

Every payment card number you have ever typed follows one international standard: ISO/IEC 7812. It defines the layout of the Primary Account Number (PAN) so that an issuer, a network, and a terminal can read the same digits the same way. This guide breaks the PAN into its four parts, maps each one to the spec, and gives you reference tables for parsing card numbers in QA and test-data work.

What is the structure of a credit card number?

Under ISO/IEC 7812, a card number (the PAN) has four parts read left to right: the Major Industry Identifier (MII) is the first digit, the Issuer Identification Number (IIN/BIN) is the first 6 to 8 digits and includes the MII, the individual account identifier is the variable middle section, and the final digit is a Luhn check digit ^[iso-7812].

Take the well-known Visa documentation number 4111 1111 1111 1111. The leading 4 is the MII (banking and financial). The first eight digits 41111111 fall inside Visa's issuer space. The digits between the IIN and the last digit form the account identifier. The trailing 1 is the Luhn check digit. The total length is 16, which is the modern norm even though ISO/IEC 7812 permits a PAN of up to 19 digits.

What does the first digit of a card number mean (MII)?

The first digit is the Major Industry Identifier (MII), defined in ISO/IEC 7812 as the leading digit of the IIN. It places the issuing organization into a broad industry category. The MII is why Visa numbers start with 4, Mastercard with 5 or 2, and American Express with 3: those categories were allocated to banking, financial, and travel-and-entertainment issuers ^[iso-7812].

What is a BIN number and how does it differ from an IIN?

A BIN (Bank Identification Number) and an IIN (Issuer Identification Number) name the same thing: the leading digits of the PAN that identify the issuing institution. IIN is the current term in ISO/IEC 7812; BIN is the older label still used across processors and acquirers. Both let a network route a transaction and let merchants look up the card's brand, type, and issuing country ^[iso-7812].

Why the IIN grew from 6 to 8 digits

The IIN was 6 digits for decades. To expand the pool of assignable issuer ranges, ISO/IEC 7812 was revised to support an 8-digit IIN, and the card networks adopted 8-digit assignments on a phased schedule. Mastercard and Visa moved their issuers to 8-digit BINs, with the industry transition centered on April 2022 ^{[mastercard-8digit]}.

An issuer identification number (IIN) is a number, conforming to this part of ISO/IEC 7812, that identifies the major industry and the card issuer.

What are the card number prefixes and lengths for each network?

Each network owns specific IIN prefixes and PAN lengths. Visa numbers start with 4 and are usually 16 digits (the spec allows 13 to 19). Mastercard uses 51-55 and the newer 2221-2720 range at 16 digits. American Express uses 34 and 37 at 15 digits. Validators check both the prefix and the length before running the Luhn check ^{[wikipedia-pan]}.

These ranges drive the brand-detection logic in our /tools/credit-card-validator: it matches the prefix to a network, confirms the length is allowed for that network, and only then verifies the check digit. A number can fail at any of the three gates.

How does the Luhn check digit fit into the card number?

The last digit of the PAN is a Luhn check digit, computed over every preceding digit using the mod-10 algorithm defined alongside ISO/IEC 7812. It is chosen so the whole number passes the checksum, which catches most single-digit mistakes and many adjacent transpositions during manual entry ^{[luhn-original]}. It adds zero security, since anyone can recompute it.

We cover the arithmetic, worked examples, and language implementations in depth in /blog/luhn-algorithm-explained. The short version: double every second digit from the right, subtract 9 from any result above 9, sum all the digits, and a valid number sums to a multiple of 10. For 4111 1111 1111 1111 the digits sum to 30, which is divisible by 10, so the number is well-formed.

What the check digit does not prove

• It does not prove the card exists. Most Luhn-valid 16-digit numbers were never issued to anyone.
• It does not prove the card is active or funded. Only the issuer's authorization system knows that.
• It does not validate expiry or CVV, which are separate fields checked during authorization.
• It provides no fraud protection, since the digit is deterministic and public-knowledge math.

Which test card numbers are safe to use in a sandbox?

Payment processors publish reserved test BINs that are Luhn-valid, brand-correct, and inert: they pass validation in a sandbox but never move money. Use these in test suites and demos instead of real numbers. Each processor documents its own set, and the table below lists widely cited examples for common networks ^{[stripe-testing] [paypal-testing]}. To produce fresh ones on demand, the credit card generator emits Luhn-valid sandbox test numbers for every major scheme, with Visa, Mastercard, Amex, and Discover variants.

How should developers generate fictional card numbers for tests?

For sample data that is not tied to a specific processor, generate numbers that satisfy the format but were never issued: pick a network prefix, fill the account identifier with deterministic or random digits, then append a correct Luhn check digit. This is exactly what libraries such as Faker do with their card-number providers, and it keeps test data realistic without touching real accounts ^[faker-docs].

Generated numbers should be clearly labeled as synthetic, restricted to QA and documentation, and validated with the same three-gate logic (prefix, length, checksum) you ship in production. The goal is data that exercises your parsing and validation code paths, not data that resembles any one person's card.

A quick parsing checklist

1. Strip spaces and dashes, then confirm the value is all digits.
2. Read the first digit for the MII, and the leading 6-8 digits for the IIN/BIN.
3. Match the prefix to a network and confirm the length is allowed for that network.
4. Run the Luhn check over the full number to validate the check digit.
5. Reject anything that fails any gate, and surface a clear, specific error message.

Build all five steps once and reuse them: our /tools/credit-card-validator applies the same sequence, and pairing it with the deeper math in /blog/luhn-algorithm-explained covers both the structure and the checksum end to end.