Card Number Validation Platform: What It Checks and What It Cannot
A card number validation platform checks length, BIN/IIN prefix, and the Luhn check digit. It cannot confirm the card is open, funded, or authorized.
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
A card number validation system is not one check. It is a chain of checks that get progressively harder to fake, and each layer answers a different question. Format rules tell you whether the digits could be a card number. The Luhn checksum tells you whether someone typed it correctly. BIN lookup tells you which network and issuer it points at. CVV and AVS matching tell you whether the person on the other end has the physical card and knows the billing address. Only the issuer authorization tells you whether the account is real, open, and funded. Everything before that last step is inference.
The Luhn algorithm walks the digits from right to left, doubles every second one, subtracts 9 from any result above 9, and sums everything. If the total is divisible by 10, the number passes. That is all it does.
What it catches: a mistyped digit, a swapped pair. What it does not catch: a fabricated number that happens to land on the right check digit. Roughly one in ten random digit strings passes Luhn. Test card numbers published by the networks pass it on purpose. So a green checkmark next to a card field means the arithmetic works, nothing more.
ISO/IEC 7812 defines the numbering scheme. The first digit is the major industry identifier, the next digits form the issuer identification number, then comes the individual account number, and the last digit is the check digit. Primary account numbers run up to 19 digits, though most consumer cards sit at 15 or 16. BIN ranges get reassigned and expanded over time, so any local list of prefixes goes stale. Pull BIN data from your processor instead of hardcoding it.
The security code is derived by the issuer from the account number, expiration date, and a service code, using a key only the issuer holds. The printed three or four digit code is commonly called CVV2, CVC2, or CID depending on the network. Because the code cannot be computed without the issuer key, a correct match is decent evidence that someone has the card in hand.
PCI DSS classifies the security code as sensitive authentication data. It cannot be stored after authorization, and it should not be retained at all. Merchants pass it through to the processor and drop it. If a checkout page stores the CVV, that is a compliance failure, not a feature.
AVS compares the numeric part of the street address and the ZIP against what the issuer has. Results come back as codes: full match, ZIP only, no match, not supported. Coverage is strong in the US, weaker in many other markets, and a partial match is not the same as fraud. 3D Secure adds an authentication step at the issuer, often with a liability shift, but it also adds friction and abandonment.
The issuer looks at account status, available credit, velocity, and its own models, then returns an approval or a decline reason. Those reasons matter. Insufficient funds, do not honor, expired card, and pickup card mean different things and lead to different follow-up actions. A validation system that never reaches the issuer is guessing.
Anyone can compute a check digit. The formula is public. This is the single most common mistake in DIY validation: treating a passed checksum as evidence of a live account. It is not evidence of anything except that the field was filled in plausibly.
Use client-side structure and Luhn checks for fast feedback, then re-validate on the server because client checks are trivially bypassed. Use BIN lookup to set card brand, expected length, and whether a CVV is required. Tokenize so the raw account number never sits in your database, and let the processor handle security code verification, AVS, and authorization. Keep your logs free of full account numbers. Scope reduction is cheaper than any fraud tool you can buy.