Primary account number (PAN) is the number that identifies a payment card account and tells the network which issuer should receive a transaction. It is usually 16 digits on Visa and Mastercard, 15 on American Express, and ISO/IEC 7812 allows 8 to 19. The first digit hints at the brand, the first eight digits have formed the issuer identification number, or BIN, since April 2022, and a final Luhn check digit catches most typos. A reissued card often gets a new PAN for the same account, and wallet network tokens follow the PAN format without being it. Any system holding the PAN falls within PCI DSS scope, so stored numbers must be unreadable and displays masked.
What is PAN on a payment card
On a physical card the PAN is the long number embossed or printed on the front or back, and it is also stored on the chip and magnetic stripe. The card itself is not the account: when a card is lost and reissued, the bank often issues a new PAN for the same underlying account.
What is a primary account number made of
Each part has a job:
- Major industry identifier: the first digit shows the industry, and in practice it also hints at the brand: 4 for Visa, 5 and 2 for Mastercard, 3 for American Express and JCB.
- Issuer identification number: the first eight digits since ISO/IEC 7812 moved from six digits in April 2022, better known as the bank identification number (BIN). It identifies the issuer, brand, card type and country.
- Individual account identifier: the digits the issuer assigns to this card.
- Check digit: the last digit, calculated with the Luhn algorithm, which catches most single-digit typos and swapped adjacent digits before the number leaves the checkout page.
In a 16-digit PAN such as 4000 1234 5678 9010, a checkout form can reject a mistyped number instantly by recomputing the Luhn digit, without contacting the issuer.
PAN vs card number
In everyday use the two are the same thing. The difference appears with digital wallets and tokenization. A card added to Apple Pay or Google Pay receives a device-specific network token that looks like a card number and follows the same format, but it is not the PAN. Merchants see the token, the issuer maps it back to the real PAN, and the receipt shows the token's last four digits, which is why they may not match the plastic card.
How PCI DSS protects the PAN
The PAN defines the scope of PCI DSS: any system that stores, processes or transmits it is in scope. Stored PANs must be unreadable through strong cryptography, truncation, hashing or tokenization. When shown on screens or receipts, masking normally leaves no more than the BIN and last four digits visible. Unlike the CVV, the PAN may be stored after authorization, but only with a documented business need.
Why PAN handling shows up in due diligence
A payment company storing millions of PANs carries much more breach exposure than one that holds only tokens. A buyer checks where PANs live, who holds the decryption keys, and whether card data can be migrated if the business changes processors.