PAN (Primary Account Number)

What Is a Primary Account Number?

A primary account number (PAN) is what most people call a “card number.” It identifies a credit, debit, or prepaid card account and may appear on the card itself. The number is also stored in the card’s magnetic stripe or EMV chip. In payment processing, the term primary account number means the identifier used to connect a transaction to the correct issuer and card account.

Most primary account numbers have 16 digits, although other lengths exist. The PAN is different from the PIN, security code, expiration date, or bank account number. Payment systems use it to recognize the card account during authorization. That is why merchants need to protect it.

How Does a PAN Work?

Every part of a PAN has a job. The first digit places the issuer in a broad industry category. The first six or eight digits form the bank identification number (BIN), which identifies the card issuer. The middle digits point to the card account. The final digit is a check digit.

A safe primary account number example is 4111 11XX XXXX 1234. The Xs hide digits that are not needed here. On a real PAN, the final digit is created using the Luhn algorithm, which catches many typing mistakes. A number can pass this check and still be fake, inactive, or used without permission. It only confirms that the format is valid.

The terminal or gateway reads the PAN at the register and puts together an authorization request. That request goes through a processor, then the card network, to the issuing bank. Before it approves or declines, the issuing bank pulls up the account, confirms there are enough funds or credit available, and runs the transaction against whatever security and fraud details it has on file.

How Is PAN Data Protected?

Under PCI DSS, PAN is considered sensitive cardholder data. Merchants should limit where it is stored, processed, and sent. Tokenization replaces the real number with a token for future payments and keeps the PAN out of systems that don’t need it.

PAN truncation permanently deletes some digits from stored records. Masking, however, hides part of the number on a screen or receipt, but the full PAN can remain in the background. One example of a masked display is XXXX XXXX XXXX 1234.

The first six and last four digits are a common truncation format accepted across payment brands, but that is a maximum, not a target for every business. A merchant should keep or show only the digits it genuinely needs and follow the rules of the card networks it accepts.

Share this article with the world

Related terms

Processing

Processing is everything that happens to move money from a customer’s card to a seller’s account after a purchase. At checkout, the customer sees only a brief pause. Behind it, the payment gateway sends the request to the payment processor. From there, it moves through the acquiring bank and card network to the issuing bank, which returns a response.

Decline Recovery (Decline Salvage)

Decline recovery, sometimes called decline salvage, describes the work of turning a failed card payment into one that goes through. A decline is not automatically the end of a sale or renewal. Sometimes the issue is temporary, sometimes the customer must take action, and sometimes the payment details on file simply need updating before anything can move forward.

MID (Merchant Identification Number / Merchant ID)

A merchant identification number (MID) is the code used to recognize a merchant account. The acquiring bank or payment processor usually assigns it when the account opens. Think of it as the account’s address inside card processing. It tells banks and card networks which merchant a sale belongs to. In simple terms, that is the merchant identification number definition.

BIN (Bank Identification Number)

A bank identification number, or BIN, sits at the very start of a card’s primary account number (PAN), running either six or eight digits long. To get at the meaning of BIN, think about what happens the moment you tap or swipe: Those opening digits tell the network which bank issued the card and where to route it next.