Payment card numbers: how detection works and why the Luhn check matters

Open almost any spreadsheet in a busy office and you will find long numbers: invoice IDs, tracking numbers, phone strings, part codes. A few of them might be payment card numbers that someone pasted in years ago. A scanner that flagged every long number would bury you in noise, so it needs a way to tell the difference. That way is a short piece of arithmetic called the Luhn check.

What the pattern step looks at

Payment card numbers follow a recognizable shape. They are a run of digits of a certain length, often grouped in fours, sometimes separated by spaces or dashes, and the first digits identify the card network. A masked version of the shape looks like 4xxx xxxx xxxx 1111, where the x characters stand in for digits we are deliberately not printing. The first step in detection is simply asking whether a value in a file has that shape.

Shape alone is a weak test, though. Plenty of things are 16 digits long. If pattern matching were the only step, every long order number would look like a card.

The Luhn check in plain language

Card issuers build a check digit into every number. The last digit is not random; it is calculated from the digits before it, so that a simple procedure applied to the whole number comes out right. The procedure is named after its inventor and is used to catch typing mistakes. It is not a secret and it does not prove a card is real or has money on it. It only tests whether the digits are internally consistent.

Here is the idea on a toy number so you can see it work. Take the four-digit number 1230:

1. Start from the right. The last digit (0) is left alone.
2. Moving left, double every second digit. So the 3 becomes 6, the 1 becomes 2, and the 2 in the middle is left alone.
3. If any doubled digit is above 9, subtract 9 from it. (None is here.)
4. Add everything up: 0 + 6 + 2 + 2 = 10.
5. If the total ends in 0, the number passes.

It passes. Change the last digit to make it 1231 and the total becomes 11, so it fails. A real card number uses exactly the same steps, just over more digits. A number such as 4xxx xxxx xxxx 1111 in our masked notation stands for a full-length value that would pass.

Why random 16-digit numbers are not flagged

If you pick digits at random, the total lands on a multiple of ten only occasionally. Most random long numbers fail the check. That is the whole point: requiring both the right shape and a passing Luhn result throws away the large majority of look-alikes, such as sequential order numbers, tracking codes and reference IDs, without anyone writing a list of exceptions.

Be realistic about what this means. Some non-card numbers will happen to pass, so you will occasionally see a false alarm. In the other direction, a card number with a typo in it fails the check and will not be flagged, and a number split oddly across cells or lines may not match the shape. Detection here is rule-based, not magic. If you want the longer discussion of handling look-alikes, see False positives: why they happen and how to triage them.

Expiry dates and CVV codes, at a high level

A card number is only one piece of cardholder data. The expiry date and the cardholder name are other pieces. The three- or four-digit security code printed on the card (the CVV or CVC) is treated differently: under the card industry's standard, PCI DSS, that code is sensitive authentication data and must not be kept after a payment is authorized. Not in a spreadsheet, not in a note, not in an email, not in a scanned form.

PCI DSS applies to anyone who stores, processes or transmits cardholder data. For a small office, the simplest path is not to store card numbers at all and to use a processor that replaces the number with a token, so your files hold a harmless reference instead. The standard itself is published at pcisecuritystandards.org; this article is general education and not advice about your specific obligations, so check with your payment processor or an advisor.

What to do when a card number is flagged

• Look at the path first. A folder called "Payments 2019" or a file named like a card authorization form is a stronger hint than a file inside a vendor export folder.
• Read the redacted sample. The report shows only a short masked sample, enough to find the number in the file without creating another copy of it; open the file to confirm it is a real card.
• Ask why the number is there. Usually it is a habit: a client emailed their card and someone saved the message, or a form template has a card section.
• Fix the habit, not just the file. Moving or deleting the file is your job or your IT provider's; MyVaultMate moves or deletes nothing on its own. The lasting fix is a rule such as "we do not take card numbers by email" and a tokenizing payment link.

You can see how findings appear in a report at /sample.