What is Primary Account Number?
Also: PAN
The 13-19 digit card number embossed on a card, tokenised in PCI-compliant flows to prevent storage of raw cardholder data.
The Primary Account Number (PAN) is the central identifier for a cardholder's account within the payment network, a unique string of 13 to 19 digits assigned by the issuer.
This number is encoded on the card's magnetic stripe and chip, and communicated in authorisation requests within ISO 8583 message fields such as DE 2 (Primary Account Number) or DE 35 (Track 2 Data) to identify the specific account for debiting or crediting.
The PAN comprises a Bank Identification Number (BIN), typically the first six to eight digits, which identifies the issuing institution, followed by the individual account number and a single check digit for validation.
Merchants encounter the PAN when customers present their physical card for a point-of-sale transaction, or when it is entered during an e-commerce checkout.
For card-present transactions, the PAN is read by a terminal from the chip or magnetic stripe, while for card-not-present transactions, the cardholder manually inputs it.
A common operational error is attempting to store raw PAN data on local systems, which constitutes a severe PCI DSS compliance breach, necessitating tokenisation or encryption to safeguard sensitive cardholder data.
Worked example
A merchant reviews a £75 transaction where Primary Account Number is the deciding factor. The credential is identified, scheme data elements are populated, the issuer applies its rules, and the response is returned through the acquirer to the merchant.
The operational cost is modelled at 6 basis points of scheme or processing cost, or £0.05, and the relevant action must complete during authorisation and Clearing.
Step 1 is to capture the original request data, including amount, currency, issuer country, MID, and response or status code. Step 2 is to apply the merchant's rule set, for example whether to retry, challenge, refund, release goods, or hold for review.
Step 3 is to reconcile the result against acquirer reporting so finance can see the cash impact. If the rule improves the outcome by even 50 basis points on 2,000 similar monthly transactions, the merchant protects roughly 10 extra orders from avoidable failure or loss.
Scheme notes
Visa and Mastercard both rely on BIN or IIN ranges, ISO 8583-style message structures, scheme tokens, and issuer response codes, but field usage and product indicators are not identical.
Eight-digit BIN migration has increased the need for current BIN tables, because six-digit lookups can misclassify issuer country, product type, or prepaid status.
American Express and Discover use their own numbering and network rules, so merchants should not hard-code card logic around only Visa and Mastercard.
Why it matters for merchants
Commercially, this affects authorisation quality, PCI scope, credential lifecycle, fraud screening, and how much useful data reaches the issuer.
For a merchant processing £500,000 per month, a 25 basis point movement is worth £1,250 before secondary effects such as disputes, reserves, support tickets, or failed delivery costs.
The impact is larger in high-risk, subscription, travel, digital-goods, and cross-border models because issuer decisions and scheme monitoring can compound quickly.
Cardflo can help by combining acquiring access, MID routing, orchestration rules, KYB review, and chargeback tooling where relevant, so the merchant is not dependent on one processor interpretation or one fixed transaction path.
Frequently asked
Which data should a merchant store for Primary Account Number?
Store the transaction ID, MID, acquirer, amount, currency, issuer country, card scheme, response or status code, timestamp, and any 3DS, exemption, refund, or dispute reference. For card transactions, keep authorisation and Clearing identifiers because settlement or chargeback questions may arrive 30 to 120 days later.
For regulated flows, keep customer consent and evidence records for at least the period required by local law or scheme rules. Good records reduce investigation time from hours to minutes when acquirer reporting does not match the order system.
How often should Primary Account Number be reviewed?
High-volume merchants should review exception rates weekly and trend the main metric monthly by scheme, acquirer, issuer country, MCC, and payment method. A movement of 20 to 50 basis points can be material if the merchant processes thousands of orders.
Finance should reconcile the cash impact at settlement level, while risk or payment operations should analyse the root cause. Reviewing only blended totals hides problems that appear on a single BIN range, region, or MID.
What threshold usually triggers action on Primary Account Number?
The threshold depends on the category, but merchants should investigate any sudden change above 10% relative movement or 25 basis points absolute movement. For disputes and fraud, scheme thresholds such as 0.9% under Visa monitoring or 1.5% under Mastercard ECM can create immediate escalation risk.
For settlement or pricing items, even 5 to 15 basis points can justify routing or contract review. The key is to set thresholds before month-end, not after a processor invoice or scheme notice arrives.
Can Primary Account Number differ between acquirers?
Yes. Acquirers can map response codes differently, apply different risk rules, support different data fields, and settle on different cycles.
One acquirer may return a generic decline while another exposes issuer advice that allows a safe retry. Fee treatment can also vary by contract, especially for cross-border, FX, premium cards, and alternative payment methods.
This is why merchants using orchestration should compare performance by acquirer and scheme rather than relying on a single blended approval or cost figure.
What is the first remediation step when Primary Account Number creates losses?
Start with a 30-day sample and split it by scheme, issuer country, card product, payment method, MID, and response or dispute code. Quantify the value at risk in cash terms, not just percentage points.
Then decide whether the fix is operational, such as better evidence or customer communication, technical, such as richer data or 3DS indicators, or commercial, such as a different acquirer route.
Recheck the same metric after one full settlement or dispute cycle to confirm the change worked.
See how Primary Account Number plays out in practice
Industries and regions where this term drives real acquiring, routing, or dispute decisions.
Related terms
The first 6–8 digits of a card number, identifying the issuer, country, scheme, and product type.
Replacing sensitive card data with a non-sensitive surrogate value that can be stored and reused without PCI scope.
A scheme-issued token that replaces the PAN end-to-end and is automatically updated when the underlying card is reissued.
Related guides.
Ready to improve your payments setup?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.