A primary account number (PAN) is a payment card number that appears on a credit, debit, or prepaid card and identifies the account and the card issuer. For businesses that conduct card transactions, using PANs securely and efficiently is a core aspect of their operations—one that can have direct implications on reputation and customer trust. They must understand the regulatory environment, security measures, and practical considerations regarding PANs, especially as payment systems and fraud prevention efforts become more complex and expansive.

Below, we’ll explore how PANs function, the standards that govern PANs, the best practice businesses can implement to safeguard and improve their use, and the important differences between PANs and other account numbers.

What's in this article?

• What is a primary account number?
  
• How primary account numbers work
  
• PAN security measures
  
• Primary account numbers vs. account numbers
  
• How Stripe Payments can help
  

What is a primary account number?

A primary account number is the technical term for a payment card number, the series of digits (usually 12–19) embossed or encoded on a credit, debit, or prepaid card that identifies the issuer and specific account. Its purpose is to route and process transactions between you, your bank, and the payment network. This long number is displayed on the front (or sometimes back) of your card, and it's what you enter in the “card number” field at online checkout.

The PAN is assigned by a financial institution to a cardholder account and is a key piece of data that facilitates communication between the entities involved in processing a payment. Keeping the PAN secure is important because misuse or unauthorised access can lead to fraudulent transactions or identity theft.

The PAN identifies your account and works alongside the card verification value (CVV). This separate three- or four-digit security code verifies that the person who makes a purchase actually has the physical card. The PAN routes the transaction; the CVV helps confirm it's legitimate.

How primary account numbers work

Understanding the PAN’s role is important for anyone in the payment processing industry. This unique identifier lives at the core of payment transactions, linking cardholders to their account information in the issuer’s database.

These steps show the PAN's role in a card payment transaction:

• Transaction initiation: When a cardholder initiates a transaction, the payment terminal reads the PAN from the card, either via the magnetic strip, near-field communication (for contactless payments), or Europay, Mastercard, and Visa (EMV) chip.

• Tokenisation: Tokenisation bolsters transaction security, particularly in digital or card-not-present environments. This process replaces the PAN with a unique token for each transaction, protecting the real account details in case transaction data is compromised.

• Data transmission: The transaction information, including the PAN, transaction amount, and business information, is encrypted and sent to the business’s bank, which is called the acquiring bank or acquirer.

• Forwarding information: The acquiring bank then sends this information through a card network to the cardholder’s bank, which is known as the issuing bank or issuer.

• Validation checks: The issuing bank uses the PAN to look up the cardholder’s account and checks the account balance, card validity, and any potential indicators of fraud before it approves the transaction.

• Transaction approval: Once the issuing bank approves the transaction, the response travels through the card network to the acquiring bank and ultimately to the business’s terminal, usually within seconds.

PAN security measures

The PAN plays a fundamental role in payment processing, and businesses must take PAN-related security seriously. Security standards such as the Payment Card Industry Data Security Standard (PCI DSS) help protect PANs during storage, processing, and transmission.

Here are some PAN security measures:

• Encryption: This process converts the PAN data into a coded form, making it unreadable to anyone without the decryption key. The PAN is encrypted during transmission from the point of transaction (e.g., a payment terminal) to the appropriate financial institutions. Encryption ensures that even if fraudulent actors intercept the transaction data, they cannot understand or use it.

• Truncation: Truncation is the practice of removing a portion of the PAN when displaying it. For instance, on a receipt or a payment confirmation screen, you might see only the last four digits of the PAN with the rest replaced by Xs or asterisks. Truncation helps protect the PAN by ensuring that the full number isn’t displayed in places where fraudulent actors could see and copy it.

• Masking: Similar to truncation, masking involves hiding part of the PAN, typically while a cardholder is entering the number or when it’s displayed on a screen. For example, when you enter your card number on a website, it’s common to see each digit replaced by an asterisk as soon as you type it. This ensures that neither someone who’s looking over your shoulder nor a malicious screen capture software can read the full PAN.

These measures help build trust with customers because they demonstrate that the business is serious about the security of their payment information. Companies that process card payments are required to comply with these standards, and failure to do so can result in penalties.

Primary account numbers vs account numbers

PANs and account numbers both serve as unique identifiers for financial accounts, but they have different uses and applications, especially in the context of payment processing. These are the key distinctions between them:

Primary account number

A PAN is a 12- to 19-digit number that appears on a credit, debit, or prepaid card. It’s an identifier provided by the card-issuing bank or financial institution. The PAN identifies the cardholder’s account and contains information about the card issuer and the card type.

The PAN is used in card-based transactions, both at point of sale (POS) terminals and for online payments, to enable communication between the entities involved in payment processing. Because of the PAN’s sensitive nature, businesses must securely handle this key piece of data. Standards such as the PCI DSS provide rules on how businesses should protect PANs during storage, processing, and transmission.

Account number

An account number is a unique identifier for an account held at a bank or other financial institution. Unlike the PAN, the account number doesn’t contain information about the card issuer or card type. Instead, it’s linked directly to an individual’s or a business’s account and is used primarily for direct transactions with the bank, such as deposits, withdrawals, and transfers.

Typically, account numbers are used for direct debits, electronic transfers, and other forms of direct bank transfers. You can find account numbers on bank statements or obtain them through your bank’s online portal or customer service channels. Although it’s also important to handle account numbers securely, they aren’t subject to the same stringent PCI DSS requirements as PANs because they aren’t used in card transactions.

How Stripe Payments can help

Stripe Payments provides a unified, global payments solution that helps any business – from scaling startups to global enterprises – accept payments online, in person and around the world.

Stripe Payments can help you:

• Optimise your checkout experience: Create a frictionless customer experience and save thousands of engineering hours with prebuilt payment UIs, access to 125+ payment methods and Link, a wallet built by Stripe.

• Expand to new markets faster: Reach customers worldwide and reduce the complexity and cost of multicurrency management with cross-border payment options, available in 195 countries across 135+ currencies.

• Unify payments in person and online: Build a unified commerce experience across online and in-person channels to personalise interactions, reward loyalty and grow revenue.

• Improve payment performance: Increase revenue with a range of customisable, easy-to-configure payment tools, including no-code fraud protection and advanced capabilities to improve authorisation rates.

• Move faster with a flexible, reliable platform for growth: Build on a platform designed to scale with you, with 99.999% historical uptime and industry-leading reliability.

Learn more about how Stripe Payments can power your online and in-person payments or get started today.