What it means
The PAN works like an address for the card account. The first digit shows the type of issuer, such as banking or travel, the first several digits identify the bank that issued the card, and most of the remaining digits identify the individual account.
The last digit is a check digit, which lets systems catch typing mistakes by running a simple mathematical test. When a customer pays by card, the PAN, together with the expiry date and security code, travels through the payment network so the issuer can approve the payment.
Anyone who gets hold of the full number and these extra details may be able to make fraudulent payments. That is why PANs are heavily protected.
Businesses that accept, store or process card data must follow the Payment Card Industry Data Security Standard, known as PCI DSS. In general, it limits when a PAN may be stored, requires it to be unreadable if it is, and requires it to be masked when displayed, for example showing only the last four digits on a receipt.
Many companies avoid holding PANs at all by letting a payment provider handle the data. A common solution is tokenisation, where the PAN is replaced by a random substitute value, called a token, that is useless to a thief.
The business can use the token to charge a returning customer, while the real number is kept securely by the payment provider. This lowers both the risk and the cost of compliance.
For finance staff, the practical rules are simple. Never ask for a full card number by email, chat or phone note, do not copy it into spreadsheets, and use the last four digits only when you need to identify a transaction.
A breach involving PANs can lead to fines, card replacement costs and serious damage to customer trust. Finance teams should also expect questions about PANs during audits and supplier reviews.
Auditors check where card data could appear, including emails, shared drives and call recordings. Mapping those places in advance, and removing card data from them, is usually quicker than defending it later.
In practice
Real-world examples.
Example
A customer pays for an online order, and the checkout page sends the PAN directly to a payment provider. The retailer's own systems only ever see a token and the last four digits, so a hack of the retailer's database would not expose card numbers. The retailer therefore has far fewer security obligations than if it handled the numbers directly.
Example
A restaurant prints a receipt showing "**** **** **** 4821" in place of the full number. The masking protects the customer if the receipt is lost and complies with card industry rules. Only the final four digits are needed for a customer to recognise which card was used.
Example
A subscription software company stores customer cards for monthly billing. It uses the provider's tokens, so its finance team can see which card is charged without ever handling the real numbers. If a customer's card is replaced, the provider updates the token automatically, which cuts failed payments.
Case study
Seen in the real world.
Marlowe Tickets is a fictional events company that allowed staff to take bookings by phone and write the customer's card details on a notepad. During an illustrative internal audit, the reviewer found notebooks full of full card numbers, expiry dates and security codes in an open drawer.
The audit report rated this as a severe risk and estimated that a theft could trigger fines and replacement costs. The company immediately destroyed the notebooks and moved phone bookings to a system that sends the card details straight to the payment provider while the call handler never hears or sees them.
In this fictional case, the changeover took one month and cost far less than the potential penalties. The lesson is to design processes so staff never touch the full PAN in the first place. The reviewer also asked staff to confirm they had destroyed any copies on personal devices.
Watch out
Common mistakes.
- Storing full card numbers in spreadsheets or email because it feels convenient. Convenience is never a valid reason to keep card data.
- Assuming that masking the middle digits on screen means the number is safely stored, when the stored data may still contain the full PAN. Check what is actually kept in the database or logs.
- Thinking a small business is exempt from card data security rules, when the rules apply to any business that accepts cards. Smaller businesses usually follow a simpler version of the same standard.
Questions
People also ask.
What does PAN stand for?
It stands for primary account number, the number that identifies a payment card account. It must not be confused with the personal identification number, which is a separate secret code.
What do the first digits of a PAN mean?
The first digit shows the industry of the issuer, and the leading digits together identify the bank or card scheme that issued the card.
Is a card token the same as a PAN?
No, a token is a substitute value with no use outside the system that issued it, while the PAN is the real account number.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%Related