PAN stands for Primary Account Number. It is the unique payment-card number associated with a credit, debit or prepaid card account and is one of the core pieces of cardholder data protected by payment-security standards.
The PCI Security Standards Council defines PAN as the unique payment card number that identifies the issuer and the cardholder account. In everyday language, the PAN is usually what people mean when they say “card number.”
Understanding PANs is useful for consumers, merchants and developers because PAN data sits at the center of card payments, PCI DSS requirements, masking, truncation and modern tokenization systems.
Quick answer: A PAN is the main payment-card number printed or stored on a credit, debit or prepaid card. It identifies the issuer and cardholder account. Tokenization protects PAN data by replacing it with a surrogate token so the original card number does not need to appear throughout every payment workflow.
What Does PAN Stand For?
PAN stands for Primary Account Number. PCI SSC describes it as the unique payment-card number that identifies the issuer and the cardholder account.
A PAN is part of cardholder data under PCI DSS. Other cardholder-data elements can include the cardholder name, expiration date and service code when they are stored, processed or transmitted with the PAN.
Is the PAN the Same as the Credit Card Number?
In most consumer contexts, yes. The long number on the front or back of a payment card is the PAN. The formal term is useful because payment systems need to distinguish the account number from other card details such as the CVV/CVC, expiration date, cardholder name and PIN.
How Is a PAN Structured?
A PAN is structured so different parts of the number serve different purposes within the card-payment ecosystem. Exact layouts can vary by payment brand and PAN length, but the high-level model is consistent.
PAN section | Purpose |
|---|---|
Issuer identification | The opening digits contain the Issuer Identification Number (IIN), commonly called the BIN. |
Account-specific portion | The following digits identify the particular cardholder account within the issuer structure. |
Check digit | The final digit is commonly used as a check digit to help detect data-entry errors. |
How Many Digits Are in a PAN?
PAN length varies by payment brand and product. PCI SSC tokenization guidance describes PAN space as supporting card numbers from 13 to 19 digits under ISO-based definitions, although many familiar consumer cards use 16 digits.
The PAN length should not be confused with the BIN/IIN length. Modern issuer identification uses eight-digit IINs under ISO/IEC 7812, while the overall PAN remains a longer account number.
What Is the Difference Between PAN and BIN/IIN?
The BIN or IIN is only the issuer-identification portion at the beginning of the PAN. The PAN is the complete payment-card account number.
PAN vs BIN/IIN
Term | Meaning | Relationship |
|---|---|---|
PAN | Primary Account Number | The complete payment-card account number. |
IIN/BIN | Issuer Identification Number / Bank Identification Number | The opening issuer-identification portion of the PAN. |
PAN vs CVV/CVC
The PAN and CVV/CVC are different card data elements. The PAN identifies the payment account. The CVV/CVC is a separate card security code used as an additional verification signal in certain card-not-present payments.
PCI DSS classifies the PAN as cardholder data and card verification codes such as CAV2, CVC2, CVV2 and CID as sensitive authentication data. Their security requirements are therefore not identical.
PAN vs Bank Account Number
A payment-card PAN should not be confused with an ordinary bank account number, routing number, sort code or branch code. PCI SSC states that ordinary bank-account data is not payment-card data unless the account number is also a PAN or contains PAN data in a way that brings it within payment-card requirements.
Why PAN Data Is Sensitive
PAN data is valuable because it is a core payment credential. If exposed together with other useful payment information, it can increase the risk of unauthorized card-not-present transactions and other account misuse.
- PANs should not be unnecessarily displayed in full.
- Systems storing PANs need appropriate security controls.
- Merchants should minimize how widely PAN data is collected, stored and transmitted.
- Tokenization, encryption, masking and truncation can reduce unnecessary exposure when implemented correctly.
What Is a Masked PAN?
Masking conceals part of a PAN when it is displayed. For example, an account interface or receipt might show only selected digits while hiding the rest.
PCI SSC distinguishes masking from truncation: masking protects PAN when displayed, while truncation permanently removes a segment of PAN data when it is electronically stored.
What Is a Truncated PAN?
Truncation removes part of the PAN so the full number cannot be reconstructed from that stored value alone. PCI SSC allows truncation as one method for rendering stored PAN unreadable, subject to payment-brand-specific truncation formats and PCI DSS requirements.
A truncated PAN is not the same as a token. Truncation removes digits; tokenization substitutes the PAN with another value.
What Is PAN Tokenization?
PAN tokenization replaces the Primary Account Number with a surrogate value called a token. PCI SSC describes tokenization as the process by which the PAN is replaced with a surrogate token value.
The merchant or payment application can then use the token for supported payment functions without needing ordinary access to the original PAN.
How PAN Tokenization Works
1. A card is entered through a legitimate payment flow.
The payment system securely receives the PAN.
2. The PAN is tokenized.
Trusted payment infrastructure creates or assigns a substitute token.
3. The merchant receives the token.
The merchant can store the token instead of the original PAN for supported use cases.
4. A later authorized payment uses the token.
The merchant sends the token to the payment provider rather than handling the PAN directly.
5. Trusted infrastructure resolves the token.
The provider or payment network connects the token to the correct underlying account for authorization.
Merchant Tokens vs Network Tokens
Not every token is the same. PCI SSC distinguishes proprietary acquiring or merchant tokens from standardized payment tokens.
Token type | Who typically manages it | Typical role |
|---|---|---|
Merchant/gateway/acquiring token | Merchant, acquirer, gateway or service provider | References protected PAN data inside the provider environment for card-on-file or recurring use. |
Network payment token | Payment-network token infrastructure with issuer participation | Acts as a payment credential in supported network payment flows and can be restricted by merchant, device or scenario. |
How Tokenization Protects PAN Data
- Reduces the number of systems that need to store the real PAN.
- Makes exposed merchant data less useful when it contains tokens instead of broadly reusable card numbers.
- Allows network tokens to be restricted to specific merchants, devices or payment scenarios.
- Supports safer card-on-file, subscription, ecommerce and digital-wallet payment experiences.
- Can simplify parts of PCI DSS scope when implemented correctly, although tokenization does not automatically remove every PCI DSS responsibility.
Does Tokenization Remove PCI DSS Requirements?
No. PCI SSC states that tokenization can reduce the amount of cardholder data in an environment and may simplify validation efforts, but it does not eliminate the need to maintain and validate PCI DSS compliance.
The effect on scope depends on the implementation, especially whether supposedly out-of-scope systems can retrieve the original PAN or otherwise access cardholder data.
Does a Token Reveal the Original PAN?
A properly designed token should not allow ordinary users or merchant applications to derive the original PAN merely from the token value. PCI SSC notes that the security of a tokenization system depends heavily on the infeasibility of determining the original PAN from the surrogate value alone.
Does a PAN Show the Cardholder Name or Balance?
No. A PAN identifies the payment issuer and cardholder account within the card-payment system, but the number itself does not reveal the account balance, password, PIN, full identity profile or whether a transaction will be approved.
Can a PAN Tell Whether a Card Is Valid?
No. The structure of a PAN can identify issuer-related information and include a check digit, but it cannot establish whether a card is active, funded, stolen, expired or authorized for a particular transaction. Those decisions require legitimate issuer and payment-network authorization systems.
PANs and Digital Wallets
Many digital wallets use network tokenization so a tokenized credential is presented during supported payments instead of exposing the underlying PAN in the same way. This separates the merchant-facing payment credential from the original account number and can reduce the value of compromised payment data.
PANs and Card-Not-Present Fraud
Card-not-present payments depend on digital credentials rather than physical presentation of the card. Reducing exposure of the PAN is therefore an important fraud-prevention objective.
Tokenization does not eliminate card-not-present fraud, but it can make compromised credentials less reusable and can work alongside 3-D Secure, Strong Customer Authentication where applicable, AVS, CVV/CVC and transaction-risk monitoring.
Common PAN Misunderstandings
- Myth: PAN means a bank account number. Reality: PAN specifically refers to the payment-card Primary Account Number.
- Myth: PAN and CVV are the same security value. Reality: the PAN identifies the card account; CVV/CVC is a separate verification value.
- Myth: the BIN is the whole PAN. Reality: the BIN/IIN is only the issuer-identification portion at the beginning of the PAN.
- Myth: masking and tokenization are the same. Reality: masking hides part of a displayed PAN; tokenization substitutes the PAN with another value.
- Myth: knowing a PAN proves the card is usable. Reality: only legitimate issuer and payment systems can authorize a transaction.
Frequently Asked Questions
What does PAN mean on a credit card?
PAN means Primary Account Number, the unique payment-card number that identifies the issuer and cardholder account.
Is a PAN the same as a credit card number?
In ordinary consumer usage, yes. The long payment-card number is the PAN.
How many digits is a PAN?
PAN length varies by payment brand and product. PCI SSC tokenization guidance describes PANs as ranging from 13 to 19 digits under ISO-based definitions.
Is the BIN part of the PAN?
Yes. The BIN/IIN is the issuer-identification portion at the beginning of the PAN.
Is CVV part of the PAN?
No. CVV/CVC is a separate card security code and is not part of the PAN.
What is a tokenized PAN?
It means the original PAN has been replaced with a token or surrogate value for supported payment use.
Is a masked PAN the same as a tokenized PAN?
No. Masking hides selected digits when a PAN is displayed; tokenization substitutes the PAN with another value.
Does tokenization make a PAN useless to attackers?
It reduces exposure and can limit the usefulness of compromised payment data, but no single control eliminates every payment-fraud risk.
Does tokenization remove PCI DSS scope?
Not automatically. PCI SSC states that tokenization may reduce scope, but the effect depends on implementation and whether systems can access the original PAN.
Final Thoughts
PAN is simply the formal name for the payment-card account number at the center of a credit, debit or prepaid card transaction. It identifies the issuer and the cardholder account and is therefore one of the most important data elements protected by PCI DSS.
Modern payment security increasingly tries to minimize unnecessary PAN exposure. Masking hides the number when displayed, truncation removes part of it when stored, encryption protects it cryptographically, and tokenization substitutes it with a safer surrogate value for supported payment flows.
For merchants and consumers, the key lesson is that the PAN is a sensitive payment credential, but it is not an authentication method by itself. Safer payments come from combining data protection with authorization, authentication, fraud monitoring and secure payment infrastructure.
Authoritative References
- PCI Security Standards Council - Glossary (PAN definition)
- PCI Security Standards Council - Tokenization Guidelines Information Supplement
- PCI SSC - Difference between acquiring tokens, issuer tokens and Payment Tokens
- PCI SSC - Masking vs truncation
- PCI SSC - Truncated PAN and PCI DSS
- EMVCo - EMV Payment Tokenisation
Editorial note: This article is educational and focused on payment-security awareness. Card-data handling and PCI DSS scope depend on the actual payment environment and service-provider architecture.
