Answer
A card number test checks digit format and the Luhn checksum. It does not prove a card is valid, funded, or open for a charge. A test on the number returns pass or fail on the digits. It returns no data about the account behind the number.
How the Luhn check works
The Luhn formula, also called mod 10, is defined in ISO/IEC 7812-1. Start at the rightmost digit and move left. Double each second digit. If a doubled digit is above 9, subtract 9 from it. Sum all digits in the result. A total that divides by 10 with no remainder passes. Any other total fails.
- Write the digits in order.
- Double every second digit from the right.
- Subtract 9 from each doubled value above 9.
- Add all values.
- Check the total against 10.
Example: 4242 4242 4242 4242 passes. The sum is 40. Change one digit and the sum no longer divides by 10.
Test numbers from processors
Payment processors publish test card numbers for sandbox mode. These numbers start no charge and reach no bank. Stripe lists 4242 4242 4242 4242 for Visa and 5555 5555 5555 4444 for Mastercard. Test numbers also exist for Amex and Discover.
- Visa: 4242 4242 4242 4242
- Mastercard: 5555 5555 5555 4444
- Amex: 3782 822463 10005
- Discover: 6011 1111 1111 1117
Sandbox numbers pair with test expiry dates and test CVC codes. The processor documents the full set. Use the set as a unit. A test PAN with a live expiry date can fail in the sandbox.
What a test cannot tell you
A Luhn pass means the digits fit a format. It does not mean the card is active. It does not mean the account has funds. It does not mean the issuer will approve a charge. A number with a valid checksum can fail authorization. A number with a failing checksum is malformed and will fail at the gateway.
The first digit gives the network. Visa numbers start with 4. Mastercard numbers start with 2 or 5. Amex numbers start with 34 or 37. These ranges are public. A range match adds no proof of account status.
Rules and limits
PCI DSS covers the storage and transmission of card data. Testing against live card numbers outside a processor sandbox can break card network rules and law. Use published test PANs in development. Do not run tests against live accounts you do not own. A checksum test is a format check, not a validity check.