Card Number Validation Techniques: Luhn, BIN and Length Checks
Card number validation combines digit normalization, length and BIN range checks, and the Luhn checksum to catch typos before authorization.
Redeem your gift cards at any of our Merchants
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
A card number validation platform earns its place in your stack only when it checks number format and issuer data inside your own checkout or onboarding flow, and it makes no claim to test whether someone else's card is live. The core buying advice: choose a vendor that runs a Luhn check plus a BIN lookup at the point of entry, returns a verdict in well under a second, keeps nothing but a token, and gives you a sandbox with published test card numbers so you can prove all of that before you sign. Any product marketed as a way to verify card numbers in bulk, or to find out whether a card is active or funded, is a fraud tool with real legal exposure attached. Buy for checkout quality and data hygiene, not for card testing.
The platform should separate three jobs and tell you which it performs: structural validation (length, prefix, Luhn checksum), issuer identification (BIN or IIN lookup for card brand, country, and card type), and authorization (asking the issuer for an approval). Only the first two belong to a validation platform. Authorization happens at your acquirer or payment service provider. A vendor that blurs these lines is either confused about its own product or selling something you should not buy.
Ask where the full primary account number lives during a request and after it. The right answer is that it exists in memory for the duration of the check and is replaced by a token before anything is written to disk or shipped to analytics. Confirm the vendor's own compliance documentation and check whether their service pulls your business into a wider PCI DSS scope than you already carry.
Issuer ranges change as banks merge, launch new card programs, and migrate portfolios. Ask how often the BIN table is rebuilt, who supplies it, and how the vendor handles ranges it does not recognize. A large unknown rate shows up later as declined transactions and misrouted payments.
Look for a documented REST endpoint, server-side SDKs in the languages you actually run, idempotent requests, and clear error codes that distinguish a malformed number from a service failure. Read the docs for a sandbox before you talk to sales.
No. The Luhn algorithm detects transcription errors in a number string. It cannot tell you whether an account is open, funded, or authorized for a given amount. Only an authorization request through your acquirer answers that.
No, and no legitimate vendor should offer it. Balance and credit availability are only visible to the issuer during an authorization.
Running checks against card numbers outside your own customer flow, or against lists you obtained elsewhere, is not something a compliant business does. Use the platform only on numbers submitted by your own customers during a transaction or account setup.
It depends on whether your systems store, process, or transmit cardholder data. A properly built integration that hands the number straight to a tokenizing service can shrink your scope, but it does not automatically remove it. Confirm the boundary with your acquirer.
Malformed numbers, expired date combinations, unknown BIN ranges, non-card-brand prefixes, and network timeouts. Verify the error codes are distinct for each case so your checkout can show a useful message.