Track F · Foundations

You will be able to

• Split a PAN into BIN, account and check digit
• Compute and check a Luhn digit
• Parse track 1, track 2 and track 2 equivalent
• Read a service code
• Mask a PAN correctly

The lesson

1. Why it matters
2. The concept
3. In the real world
4. Common mistakes
5. What to test

In the module

• The lesson, with diagrams, common mistakes and what to test
• A worked example you can change: Reading a card number and its track
• Practice: 5 kinds of generated exercise, each with a step-by-step solution
• A quiz of 8 questions

Key terms

BIN (IIN, issuer identification number)

The leading digits of the PAN (6 or, more and more, 8) that identify the issuer and the product. Networks route authorisations by BIN.

Discretionary data

Issuer data at the end of the track, such as the PVKI and PVV or the CVV. Its layout is set by the issuer.

Expiry date

Stored as YYMM on the stripe and in messages (field 14), printed as MM/YY on the card.

Field separator

The character between the PAN and the expiry: '=' on track 2, '^' on track 1, 'D' in the chip's track 2 equivalent data.

Luhn check digit (Mod 10)

The last digit of the PAN, chosen so that the Luhn sum (every second digit from the right doubled, digits of products added) is a multiple of 10. It catches typing errors, not fraud.

Magnetic stripe (Magstripe)

The stripe holding tracks 1 and 2. Its data is static, so it can be copied; chip and contactless replaced it for security.

PAN (Primary account number, card number)

The card number: an issuer identification number, an account number and a Luhn check digit, usually 16 digits and up to 19.

PAN sequence number (PSN)

A two-digit number that tells apart cards issued with the same PAN (EMV tag 5F34). It is part of the EMV card key derivation.

Sentinel

The start and end characters of a stripe track: '%' and '?' on track 1, ';' and '?' on track 2. A one-character LRC follows the end sentinel.

Service code

Three digits on the stripe: the first says whether the card has a chip and where it may be used, the second how authorisation is processed, the third which services are allowed and when a PIN is needed.

Track 1

The alphanumeric magnetic stripe track: format code B, PAN, the cardholder's name, expiry date, service code and discretionary data, between '%' and '?'.

Track 2

The numeric magnetic stripe track used for authorisation: PAN, '=', expiry (YYMM), service code and discretionary data, between ';' and '?'. Sent in field 35.

Track 2 equivalent data

The chip's copy of track 2 (EMV tag 57), with 'D' as the separator. It must be protected like track 2.

Tools for this module: Luhn ValidatorTrack Parser / BuilderTest Card Generator

Read the opening of the lesson →