Mastercard and Visa dominate global payments, and understanding their numbering systems helps merchants and consumers validate cards quickly. These 16-digit sequences follow strict standards that define card type, issuer, and permissions, making fraud detection and routing more reliable across networks.
Behind every plastic card or digital account is a carefully engineered number that encodes network rules and regional data. This article explores how these identifiers work, how they differ between networks, and how organizations manage risk and compliance.
| Network | Typical Prefix | Length | Issuer Identification |
|---|---|---|---|
| Visa | 4 | 13 or 16 | Bank or fintech |
| Mastercard | 22–27, 51–55, 2014–2017, 2221–2720 | 16 | Bank or Mastercard issuer |
| Amex | 34, 37 | 15 | American Express |
| Discover | 6011, 644–659, 622126–622925 | 16 or 19 | Discover Financial Services |
Understanding Mastercard Numbers and Their Structure
Mastercard numbers are built from an Issuer Identification Number, an account identifier, and a single check digit, all designed to meet ISO/IEC 7812 and Luhn algorithm requirements. The network assigns ranges to banks, transit systems, and large institutions, ensuring each card is globally unique while indicating permitted transaction types.
The modern range from 22 through 77 captures most new cards, while legacy 51 through 55 and branded BINs like 2014 through 2017 still function in existing portfolios. Merchants that integrate BIN validation can reduce declines by confirming card type, country, and permitted usage before authorization.
Security controls such as tokenization and cryptogram generation further separate the primary account number from the printed digits on the card. This layered approach lets networks and issuers manage fraud while maintaining compatibility with both physical and digital wallets.
How Visa Card Numbering Works
Visa cards always start with 4, with lengths of 13 or 16 digits depending on the product and region. The first six digits identify the issuer, while the remaining digits, except the last, represent the individual account.
The final digit is a checksum calculated using the Luhn algorithm, which helps detect common data-entry errors and incomplete numbers. Because Visa controls its BINs carefully, payment systems can quickly route transactions and enforce restrictions based on the card family.
For recurring billing and e-commerce, Visa tokens and digital credentials allow one-click checkout without exposing the raw number, improving security and conversion across devices.
Key Specifications at a Glance
The following table summarizes critical specifications that define how Mastercard and Visa numbers are structured and validated.
| Specification | Mastercard | Visa | Validation Focus |
|---|---|---|---|
| First Digit(s) | 2–7 | 4 | Network identification |
| Total Length | 16 | 13 or 16 | Format compatibility |
| Checksum Method | Luhn | Luhn | Error detection |
| BIN Range Example | 222100–222109 | 400000–499999 | Issuer classification |
| Issuer Scope | Banks, corporates, transit | Banks, fintechs, co‑brands | Partner controls |
Risk Management and Compliance
Financial regulators and card networks require strict controls around how account numbers are stored, transmitted, and processed. PCI DSS mandates encryption, access logging, and segmentation to protect cardholder data from unauthorized access.
Organizations use tokenization to replace raw numbers with surrogate values in their applications, reducing the scope of compliance audits. Fraud detection engines analyze patterns such as velocity, geography, and device fingerprints to decide whether to authorize, step-up, or decline a transaction.
Product and Network Evolution
Both networks continuously evolve their numbering and product rules to support new payment models, from contactless to open-loop transit and instant payouts. Mastercard’s recent ranges like 2014–2017 and 2221–2720 reflect deliberate allocations for specific regions and use cases, while Visa maintains a stable 4 prefix for broad interoperability.
Emerging standards such as QR-based payments and account token frameworks rely on these base identifiers but add layers of metadata and dynamic credentials. Integration platforms that track BIN changes and network updates help merchants remain compliant as rules shift.
Operational Recommendations for Managing Card Identifiers
- Validate BINs at entry to reduce errors and improve authorization rates.
- Implement tokenization to minimize raw number exposure in your systems.
- Monitor network updates for range expansions or renumbering.
- Align fraud rules with issuer capabilities to balance friction and security.
FAQ
Reader questions
How can I quickly check whether a number belongs to Mastercard or Visa?
Examine the first digit: a 4 indicates Visa, while 2–7 (with common ranges like 22–27 and 51–55) signals Mastercard. Length and BIN lookup provide additional confirmation.
Do Mastercard and Visa numbers ever overlap in the same range?
No, each network is allocated distinct BIN ranges by the international standards body to prevent conflicts, although some historic or co‑branded cards may appear similar at the prefix level.
Why does the length of a Mastercard or Visa number vary between 13 and 16 digits?
Legacy systems and regional product designs allow 13 digits in some markets, while most modern cards use 16 digits for broader feature support, but both formats remain valid within their respective networks.
What should I do if a transaction is declined due to BIN mismatch?
Verify that the card type, country, and allowed usage align with your merchant category; update your BIN rules or routing logic to reflect the latest network specifications from the issuer.