# Every card number has a built-in error check from 1954 URL: https://www.paydude.io/resources/every-card-number-has-a-built-in-error-check Type: Guide Published: 2026-09-06 · Updated: 2026-09-06 Summary: The last digit of a card number is a checksum from a 1954 IBM patent. How it works, why it exists, and what it does not protect against. **The last digit of a payment card number is not part of the account number. It is a checksum**, calculated so that the number as a whole passes a test devised by IBM engineer Hans Peter Luhn, who filed the patent in 1954. ## Summary The final digit is a check digit, not account data. It catches typos and transposed digits before any request is sent. It is a data-integrity check, not a security measure. You can verify any card number by hand in about thirty seconds. ## How it works 1. **Start from the rightmost digit and work left** — The rightmost digit is the check digit itself. Include it in the sum. 2. **Double every second digit** — That is the second from the right, the fourth, the sixth and so on. 3. **Subtract 9 from any doubled result above 9** — So 8 doubled is 16, which becomes 7. This is equivalent to adding the two digits together. 4. **Add everything up** — All the untouched digits plus all the adjusted doubled ones. 5. **Check it divides by 10** — If the total ends in zero, the number passes. If not, something was mistyped. ```text Test number: 4539 1488 0343 6467 Working from the right, double every second digit (subtracting 9 from anything over 9): untouched 7 4 3 3 8 4 9 5 -> 43 doubled 3 3 8 0 7 2 6 8 -> 37 --- total 80 80 divides by 10 -> the number is well-formed ``` ## What it is for, and what it is not The Luhn check exists to catch human error. In 1954 that meant numbers being read aloud, written down and keyed in by hand — a process that reliably produces two failure modes: a wrong digit, and two adjacent digits swapped. Luhn's formula catches both. > **It is not a security control:** Anyone can generate a number that passes the Luhn check — it is a published algorithm with no secret. Passing it means the number is well-formed, not that it corresponds to a real account or that the person entering it is entitled to. Only the issuing bank can answer that. ## Why you still see it every day When a checkout form tells you a card number is invalid before it appears to contact anyone, it has run the Luhn check locally. It costs nothing, it is instant, and it avoids sending an authorization request that was always going to fail. That is why a mistyped card fails immediately and a genuinely declined card takes a moment — the first never left the browser. The algorithm has outlived its original purpose considerably. It is now used for identification numbers well beyond payments, including some national identifiers and IMEI numbers on mobile phones. ## Sources - Hans Peter Luhn, IBM — patent for a computer for verifying numbers, filed 1954, granted 1960. - ISO/IEC 7812, which specifies the structure of identification card numbers including the check digit. - The number above is a standard publicly published test value and corresponds to no real account. **Card data you never have to handle** Tokenization keeps card numbers off your servers entirely. — [How tokenization works](https://www.paydude.io/resources/what-is-tokenization) ## Frequently asked questions ### What is the Luhn algorithm? A checksum formula that validates identification numbers, including every payment card number. IBM engineer Hans Peter Luhn filed the patent in 1954. The last digit of a card number is chosen so that the whole number passes the check. ### Does the Luhn check make card numbers secure? No, and it was never meant to. It catches typing mistakes — a mistyped digit or two transposed digits — before a request is sent. It offers no protection against fraud, because anyone can generate a number that passes. ### Why do checkout forms reject a card before contacting the bank? Because they run the Luhn check locally first. It costs nothing, catches the most common input errors instantly, and avoids a pointless authorization request. That is why an obviously mistyped number fails faster than a genuinely declined one. ### Can I check a card number by hand? Yes. Double every second digit from the right, subtract 9 from any result above 9, add all the digits together, and the total should divide by 10. It takes about thirty seconds.