Test credit card numbers

Every card number you have ever typed ends in a digit that exists only to catch mistakes. The scheme behind it came from Hans Peter Luhn (1896–1964), a German-American researcher at IBM who was awarded more than eighty patents and who also gave information science Key Word in Context indexing and selective dissemination of information. His check-digit method reached the US Patent Office as patent 2,950,048, "Computer for Verifying Numbers", granted on 23 August 1960. The patent is for a small hand-held mechanical device that worked out the mod-10 sum for you; the doubled-and-reduced substitutions were not computed by the machine at all but simply printed in permuted order on its body. The algorithm went into the public domain and is now specified in ISO/IEC 7812-1.

Card numbering grew up around it. Diners Club issued the first widely accepted charge card in 1950 and BankAmericard followed in 1958, but it was ISO/IEC 7812, first published in 1989, that fixed what the digits mean: a leading major industry identifier, an issuer identification number of six digits — extended to eight in the 2017 revision — then the account identifier, then Luhn's digit. The register of issuer numbers is held on behalf of the American Bankers Association, with CUSIP Global Services taking over its administration in February 2024. When Mastercard ran short of room in its 51–55 block it announced a new 222100–272099 range on 3 November 2014, and those numbers went live on 14 October 2016 — which is why a well-maintained test suite now includes a 2-series card.

Test numbers themselves are a convention, not a standard. PCI DSS keeps live card data out of development environments, so every processor publishes a sandbox set, and a handful became universal through sheer repetition across gateway documentation. Nobody reserved them the way telephone numbering reserves drama numbers; they are simply numbers that were never issued, so that nobody's real card ends up in a fixture.

Key properties

• TEST VALUES ONLY — every number here is built from a BIN prefix published for sandbox use, corresponds to no cardholder and no funds, and is declined by live acquirers. It is not a real account and cannot become one.
• Each value passes the Luhn check: double every second digit from the right, subtract 9 from any result above 9, sum everything, and the total is a multiple of 10. The last digit is the check digit.
• The first digit is the major industry identifier — 3 is travel and entertainment, 4 and 5 are banking and finance. Visa begins with 4, Mastercard with 51–55 or 2221–2720, American Express with 34 or 37, Discover with 6011, 644–649 or 65.
• Payment card numbers run from 8 to 19 digits. This page emits 16 for Visa, Mastercard, Discover and JCB and 15 for American Express, the lengths those brands use for ordinary consumer cards.
• Luhn catches every single-digit error and nearly every swap of two adjacent digits, but not 09 ↔ 90, and not the twin errors 22 ↔ 55, 33 ↔ 66 or 44 ↔ 77.
• Zero-padding a number on the left never changes its Luhn result, because the algorithm counts positions from the right and leading zeros add nothing to the sum.
• The issuer identification number is the leading six digits, extended to eight by the 2017 revision of ISO/IEC 7812-1; the account identifier sits between it and the check digit.
• A Luhn pass is not proof of anything about an account. Only an authorisation request to the issuer can establish that a card exists and has funds.

Where they turn up

• Processor sandboxes: Stripe, Adyen, PayPal and Braintree each publish a list of test card numbers, and 4111 1111 1111 1111 is accepted by test mode in practically every gateway.
• Checkout forms run Luhn in the browser before anything is submitted, which is how a mistyped digit is flagged instantly instead of after a round trip to the acquirer.
• The same algorithm guards identifiers well outside payments: IMEI numbers on mobile handsets, SIM card ICCIDs, Canadian Social Insurance Numbers and US National Provider Identifiers all end in a Luhn check digit.
• QA fixtures and CI pipelines: since PCI DSS keeps real card data out of development environments, seeded test numbers are what end-to-end checkout tests actually run against.
• Fraud screening uses a Luhn pass as the cheapest possible first filter — it throws out garbage before an authorisation is attempted, and that is the whole of its job.