The checksum formula behind every card number — and why test cards built from it are provably harmless.
Every credit card number, most debit cards, IMEI numbers on phones, and several national ID schemes share one quiet detail: their last digit isn't random. It's a check digit, calculated from all the digits before it using a public formula called the Luhn algorithm (also known as the "modulus 10" algorithm). It was published by IBM scientist Hans Peter Luhn and patented in 1960 — the patent has long since expired, and the formula itself has always been public.
The Luhn check digit exists to catch typos, not fraud. If you fat-finger a digit typing in a card number, or transpose two adjacent digits, the checksum will almost certainly no longer match — and the form can reject it before it even reaches a payment processor. It says nothing about whether the account is real, funded, or authorized; it only confirms the digits are internally consistent.
To validate a number:
To generate a valid number, you run it backwards: pick every digit except the last, run the same doubling process, sum it, and choose whichever final digit brings the total up to the next multiple of 10. That's the entire trick — no secrets, no database lookups, nothing tied to a real bank.
Take the digits 7 9 9 2 7 3 9 8 7 1 (ignoring the final check digit for a moment). Doubling every second digit from the right and adjusting anything over 9, then summing everything, gives a total ending in a particular digit away from a multiple of ten — and that gap is exactly the check digit that gets appended. Try it yourself against any real card in your wallet (without ever needing to type it into anything): the arithmetic always comes out to a multiple of 10.
Because the formula is entirely public and mechanical, a number that merely passes the Luhn check tells you nothing about whether it corresponds to a real, funded account. Real payment processors — including Stripe, PayPal, Braintree, and others — publish their own Luhn-valid test numbers precisely because passing the checksum and being a chargeable account are unrelated properties. Our own test card number generator works the same way: it builds a number of the correct length starting from each network's publicly documented prefix (Visa numbers start with 4, for instance — that much has always been public), fills the middle with random digits, and computes a matching check digit. No card database, bank, or real account is ever involved.
The same formula validates IMEI numbers on mobile phones, Canadian Social Insurance Numbers, and several national identifiers. Anywhere a long number needs to catch simple transcription errors cheaply, Luhn (or a close cousin of it) tends to show up.