F2 – Card Number
This is the number that identifies the cardholder and the card’s issuing bank. In short, it is the card number used in the transaction. If the F2 value is not sent in the transaction, the card number information can be obtained from Data Element position 35.
The card number consists of the following information:
- Card BIN number (first 6 digits)
- Individual account identifier (8 digits for Amex cards, 9 digits for Mastercard and Visa)
- Check digit number prepared according to the Luhn algorithm. You can review the link below for the Luhn algorithm.
- https://arifunal.com/yazi/kredi-karti-numarasi-nasil-uretilir-luhn-algoritmasi/
Current status: 8-digit BIN
At the time this article was first published, the BIN number was defined as the first 6 digits of the card number. As the need for card numbers increased, the ISO/IEC 7812 standard was updated, and card schemes transitioned to using an 8-digit BIN. For this reason, systems need to be updated so that they can perform BIN checks based on 8 digits.
Format of the field
F2 is a variable-length field. Two digits indicating the length of the card number are sent at the beginning of the field, followed by the card number. The card number can be at most 19 digits. For example, for a 16-digit card number, the value 16 is sent at the beginning of the field.
The first digit of the card number
The first digit of the card number gives information about which sector and scheme the card belongs to. For example, numbers starting with 4 are Visa, numbers starting with 5 and 2 are generally Mastercard, and numbers starting with 34 and 37 are American Express cards. TROY card numbers, on the other hand, start with 9.
From a security perspective
The card number is sensitive data. According to the PCI DSS standard, the card number must be masked on screens, receipts, and in log records. Generally, only the first 6 and last 4 digits are allowed to be visible. If it needs to be stored in a database, it must be stored encrypted or tokenized.
