1. How Credit Card Numbers are Generated
Elaina Liu

2. Basics 12-19 numeric digits Composed of:
Major Industry Identifier (MII)
Issuer Identification Number(IIN)/Bank Identification Number(BIN)
User ID
Check number/checksum

3. MII
The first digit that indicates what kind of institution issued the card
1 and 2: airlines
3: travel and entertainment
4 and 5: banking and financial institutions
6: merchandising and banking
7: petroleum companies
8: telecommunication companies
9: national assignment

4. IIN
Digits 2-6, together with the first digit, that tell who issued the card
Popular ones:
Visa: 4-
Mastercard: 51- to 55-
Diners Club: 36-, 38-
Discover: 6011-, 65-
JCB: 35-
American Express: 34-, 37-
See for a complete list of IINs

5. User ID
The 7th digit to the second-to-last digit that indicate customer account number
Not necessarily the same as one’s actual bank account number
Most companies use 9 digits, but can be up to 12 digits

6. Check Number
The very last digit that is used to validate the entire card number
Computed and verified using the Luhn algorithm
Can quickly identify if the card has a valid number or not
Does not catch all errors

7. 5 4 5 7 6 2 3 8 9 8 2 3 4 1 1 x Example IIN User ID MII Check Number
Arbitrary example taken from

8. Luhn Algorithm Named after IBM scientist Hans Peter Luhn
Also known as the “mod 10” algorithm
Designed to protect against accidental errors, not malicious attacks
Based on principle of modulo arithmetic and digital roots

9. How to Calculate Check Digitx 2× 2× 2× 2× 2× 2× 2× 2×
Every second digit from right to left, starting from the check digit

10. How to Calculate Check Digitx
Get Digital Root
1+0= = = =9

11. How to Calculate Check Digitx
= 67

12. How to Calculate Check Digitx
Sum = 67
x = 10 - (67 mod 10) =
= 3

13. Come up with a credit card number and test its validity

14. Strengths and Weaknesses
Can quickly detect any single-digit error and almost all transpositions of adjacent digits with the exception of 09 to 90 or vice versa
Can also detect 7 of the 10 possible twin errors with the exception of the following pairs:
22 and 55
33 and 66
44 and 77
Can still perform under zero-padding systems

15. Other Uses of Luhn Algorithm
IMEI numbers
International Mobile Equipment Identity
15 digits
National Provider Identifier numbers in the U.S.
Issued to health care providers in the U.S. by the Centers of Medicare and Medicaid Services
10 digits
Canadian Social Insurance Numbers
Israel ID numbers
Greek SSN

16. More Complex Algorithms
Verhoeff algorithm
Developed by Dutch mathematician Jacobus Verhoeff and published in 1969
First decimal check digit algorithm that detects all single-digit errors and all transposition errors involving two adjacent digits
Uses the properties of the dihedral group of order 10 combined with a permutation
Damm algorithm
Presented by H. Michael Damm in 2004
Detects all single-digit errors and all adjacent transposition errors
Similar to Verhoeff algorithm but simpler and more time-efficient

17. Damm Algorithm Prerequisite: Main diagonal entries of the table are 0
Steps:
Set up an interim digit and initialize it to 0
Process the number digit by digit:
Use the number's digit as column index and the interim digit as row index, take the table entry and replace the interim digit with it
The resulting interim digit gives the check digit and will be appended as trailing digit to the number

18. Damm Algorithm First digit Find check number of 572
Initial interim digit
Second interim digit
Obtained from Damm’s paper

19. Damm Algorithm Second digit Find check number of 572
Third interim digit

20. Damm Algorithm
Third digit
Find check number of 572
Check Number

21. Damm Algorithm
Last digit
Check validity of 5724
Valid

22. Other Methods Against Fraud
Card Verification Value (CVV) codes
Calculated with the Primary Account Number (PAN) which is consisted of a 4-digit expiration date, a pair of DES keys and a 3-digit Service Code
The calculation can only be done by the card issuer due to the use of secret DES keys

23. Other Forms of Check Digits
Parity in RAM
A byte is made up of 8 regular bits and a parity bit
The value of the parity bit was set based on the count of set bits and selected so that the sum of the numbers was even (Even Parity)

24. Questions?

25. Reference