Primary Account Number (PAN)

The Primary Account Number (PAN) is the 14 to 19 digit number embossed or printed on a payment card that uniquely identifies the cardholder's account with the issuing bank. It is the most sensitive piece of cardholder data and the central subject of PCI DSS data protection requirements. Any system that stores, processes, or transmits a PAN is, by definition, in scope for PCI DSS.

The PAN is structured to encode information about the card. The first six to eight digits form the BIN (Bank Identification Number), which identifies the issuing bank and card product. The middle digits form the account number assigned to the specific cardholder. The final digit is a check digit calculated using the Luhn algorithm, which allows systems to validate that a card number is structurally valid without processing a transaction.

PANs must be rendered unreadable wherever they are stored, through strong one-way hashing, Tokenization, truncation, or Encryption. When displayed for cardholder or merchant reference (on receipts, in account management interfaces), PANs must be masked: only the first six and last four digits may be visible, with the remaining digits replaced by masking characters. The full PAN must never appear on printed or digital receipts.

The industry's strategic direction is toward PAN elimination, replacing PANs with Network Tokens throughout the authorization flow so that the actual PAN is never transmitted during a transaction. Mastercard has announced the goal of eliminating manual card entry by 2030 through token-based payments, a goal that Network Tokenization infrastructure is designed to support.