A card number isn't random. It's a structured address with a built-in spell-checker. Dissect one live and see why a typo charges nobody instead of the wrong person.
The Bank Identification Number tells every system in the chain who issued the card, the brand, the country, debit vs credit vs prepaid. Checkouts use BIN lookups to route transactions, pick 3DS rules, block sanctioned countries, and price fees — before you've finished typing. In 2022 BINs officially grew from 6 to 8 digits because the world ran out of 6-digit ones.
The last digit makes the whole number pass a checksum invented by IBM's Hans Peter Luhn. Mistype one digit (or swap most adjacent pairs) and the number fails before any network is contacted. It's not security — fraudsters compute it trivially — it's error detection. Decline code 14 is usually Luhn doing its job.
Every gateway publishes Luhn-valid numbers in reserved test BINs that can never reach a real account — 4242… is Stripe's. They exist so developers can build checkouts without touching live cards. If you've worked a day in fintech, this number is tattooed on your brain.