Six digits name the bank. Three digits prove you touched the plastic. The rest tells you whose money sits behind it. This is every piece of card data — BIN, CCN, CVV, track data, fullz — broken down until a kid could recite it back to you.
TL;DR — A card number is engineered, not random. BIN = issuer fingerprint. CCN = the number itself. CVV = anti-copy proof code. Track data = full stripe clone. Fullz = card plus human. Cheat sheet at the bottom.
1. SIXTEEN DIGITS ARE NOT RANDOM (KID VERSION)
Picture a giant apartment building with mailboxes in the lobby. Every mailbox has a number. The first part of the number tells you the building. The second part tells you the apartment. A postman reads the building digits first and knows instantly which building he is standing in front of.
A card number works the same way and the building part is called the BIN.
Banks do not randomize the front. The front is a published passport — which network runs the card, which bank issued it, which country it lives in, debit or credit or prepaid, grocery-store tier or platinum tier. Card number first six (classically) and now ranges up to eight digits carry that passport. Everything after the building digits is the apartment — the victim's account — and the last single digit is pure math.
That last digit is a checksum from the Luhn algorithm. Multiply, alternate, add, see if it lands on a multiple of ten. It exists so a typo cannot pass as a real number. Change one digit and Luhn fails — the number stops existing in the eyes of every payment system on earth. That is also why every generated card list dies instantly at a gateway: wrong checksum, bounced before a human ever saw it.
2. THE BIN — WHAT SIX DIGITS TELL A STRANGER
Feed any BIN into a lookup and this falls out with zero hacking involved — this data is published for shops and fraud teams by design:
This is why BIN-first workflows exist. Before you touch a full record you already know if it is a prepaid gift card that caps at fifty bucks or a credit card with a ceiling nobody checks. Prepaid BINs treat every charge like cash — no victim watching, no chargeback muscle. Credit BINs carry the balance and the fraud alerts. Shops and fraud filters reason about cards the same way you do, starting from the BIN.
Your country matters too. Cards from regions where OTP adoption is lazy behave differently at checkout than cards from banks that text a code for every breath. The BIN tells you which world you are in before a single test fires.
3. CCN vs CVV — THE TWO NAMES EVERYBODY MANGLES
CCN — Cardholder Card Number. The full account number itself, the16 digits (or 15 for Amex, 14-19 for some debit), nothing else. When a shop asks for your card number they are asking for the CCN. It identifies the account. Alone it is a name without a key.
CVV family — the anti-copy codes. The little numbers that live on the plastic itself, invented so a number lifted from a database cannot be used without a photograph of the physical card. Every network names its code differently and the digits sit in different spots:
The distinction is the whole game. CVV1 lives inside the magnetic stripe — a swipe machine reads it, a website never does. CVV2 lives printed on the plastic — a website demands it, a swipe machine does not. Database breaches give shops CVV2-less data constantly, which is why PCI rules scream about storing codes, and why a record WITH the printed code sells heavier than a record without it.
Physical tap plus printed code equals the two halves of one key. That is the entire carding data economy in a single sentence.
4. TRACK DATA — THE STRIPE CLONE
Magnetic stripes carry two highways of data called Track 1 and Track 2, both written by standard ISO formats that any terminal on earth understands:
Track 1 — alphanumeric. Cardholder name spelled out, account number, expiry, service flags. Richer data, richer attacks.
Track 2 — numeric only. Account number, expiry, service code. Slimmer, and the one most PIN pads care about.
A complete capture of these tracks is a dump. A dump is a clone — feed it to a magnetic writer, slap it on a blank stripe, and a cloned card walks into an ATM like it owns the place. This is the card-present world: skimmers, shim devices, deep-shells on fuel pumps, all hunting for track data. CVV2 data cannot make a physical clone. Track data can.
Online world runs on CVV2. Physical world runs on Track data. The two never fully replace each other, and mixing them up is how newbies buy the wrong product and wonder why the checkout rejects it.
5. FULLZ — CARD PLUS THE HUMAN
A bare card record is a stolen object. A fullz record is a stolen identity: card number, expiry, CVV, holder name, billing address, dob, ssn, sometimes mother's maiden name, email, phone. Everything a verification script could ask for.
Why the premium? Shops run soft checks — does the name on the card match the name on the account? Does the billing address zip match the card's bank zip? Fullz sails through those checks because it answers them truthfully, stolen truth but truth. Half-data stalls at the first question and dies there.
Stealers harvest fullz directly — browser saves the card AND the autofill profile together. Breach dumps sometimes lack the human, which is why combo lists (card numbers in bulk, no people attached) trade at bargain prices and fullz trade ten times higher. You are paying for the answers, not the digits.
6. WHAT CHECKERS PULL FROM ALL OF THIS
The record feeds a checker, the checker runs a test authorization, and the response classifies your pile. Four answers matter: dead (dead on arrival), live (opens), chargeable (opens AND swallows charges without dragging a phone OTP into it), and the VBV flag telling you whether a 3D-Secure wall waits at checkout. Non-VBV records — no wall, numbers alone walk in — remain the crown jewels for anything remote.
Every one of those answers traces back to the anatomy you just read: BIN says who to ask, CCN says which account, expiry says whether it still breathes, CVV says the plastic was seen, track data says a clone can walk. Assemble the vocabulary and checkers stop being magic boxes.
7. FIELD CHEAT SHEET
— RELATED GUIDES —
Digits up, building first. BIN names the bank, CCN names the account, CVV proves the plastic, track data clones it, fullz drags the human along. Every term in every checker response traces back to this anatomy — learn the parts once and every list, gate, and response in this game reads like plain text.
TL;DR — A card number is engineered, not random. BIN = issuer fingerprint. CCN = the number itself. CVV = anti-copy proof code. Track data = full stripe clone. Fullz = card plus human. Cheat sheet at the bottom.
1. SIXTEEN DIGITS ARE NOT RANDOM (KID VERSION)
Picture a giant apartment building with mailboxes in the lobby. Every mailbox has a number. The first part of the number tells you the building. The second part tells you the apartment. A postman reads the building digits first and knows instantly which building he is standing in front of.
A card number works the same way and the building part is called the BIN.
Code:
4539 1488 0343 6467
^^^^ ^^
building (BIN) — this is Visa, issued by this bank, in this countryBanks do not randomize the front. The front is a published passport — which network runs the card, which bank issued it, which country it lives in, debit or credit or prepaid, grocery-store tier or platinum tier. Card number first six (classically) and now ranges up to eight digits carry that passport. Everything after the building digits is the apartment — the victim's account — and the last single digit is pure math.
That last digit is a checksum from the Luhn algorithm. Multiply, alternate, add, see if it lands on a multiple of ten. It exists so a typo cannot pass as a real number. Change one digit and Luhn fails — the number stops existing in the eyes of every payment system on earth. That is also why every generated card list dies instantly at a gateway: wrong checksum, bounced before a human ever saw it.
2. THE BIN — WHAT SIX DIGITS TELL A STRANGER
Feed any BIN into a lookup and this falls out with zero hacking involved — this data is published for shops and fraud teams by design:
| Field | What it exposes |
| Network | Visa, Mastercard, Amex, Discover, UnionPay — the road rules |
| Issuer bank | Chase, HSBC, some tiny credit union — who holds the money |
| Country | Where the card sleeps — US cards and EU cards behave differently |
| Card type | Debit, credit, prepaid, gift — how deep the money runs |
| Tier | Classic or platinum — spending limits and fraud thresholds |
| Bank behavior | Some issuers never enable OTP, some demand it on every hop |
This is why BIN-first workflows exist. Before you touch a full record you already know if it is a prepaid gift card that caps at fifty bucks or a credit card with a ceiling nobody checks. Prepaid BINs treat every charge like cash — no victim watching, no chargeback muscle. Credit BINs carry the balance and the fraud alerts. Shops and fraud filters reason about cards the same way you do, starting from the BIN.
Your country matters too. Cards from regions where OTP adoption is lazy behave differently at checkout than cards from banks that text a code for every breath. The BIN tells you which world you are in before a single test fires.
3. CCN vs CVV — THE TWO NAMES EVERYBODY MANGLES
CCN — Cardholder Card Number. The full account number itself, the16 digits (or 15 for Amex, 14-19 for some debit), nothing else. When a shop asks for your card number they are asking for the CCN. It identifies the account. Alone it is a name without a key.
CVV family — the anti-copy codes. The little numbers that live on the plastic itself, invented so a number lifted from a database cannot be used without a photograph of the physical card. Every network names its code differently and the digits sit in different spots:
| Network | Code name | Where it lives |
| Visa | CVV2 | Last 3 digits, signature panel back |
| Mastercard | CVC2 | Last 3 digits, signature panel back |
| Amex | CID | 4 digits, printed front above the number |
| Discover | CAV2 | Last 3 digits, signature panel back |
| Any stripe copy | CVV1 | Hidden IN the stripe — only card-present terminals read it |
The distinction is the whole game. CVV1 lives inside the magnetic stripe — a swipe machine reads it, a website never does. CVV2 lives printed on the plastic — a website demands it, a swipe machine does not. Database breaches give shops CVV2-less data constantly, which is why PCI rules scream about storing codes, and why a record WITH the printed code sells heavier than a record without it.
Physical tap plus printed code equals the two halves of one key. That is the entire carding data economy in a single sentence.
4. TRACK DATA — THE STRIPE CLONE
Magnetic stripes carry two highways of data called Track 1 and Track 2, both written by standard ISO formats that any terminal on earth understands:
Track 1 — alphanumeric. Cardholder name spelled out, account number, expiry, service flags. Richer data, richer attacks.
Track 2 — numeric only. Account number, expiry, service code. Slimmer, and the one most PIN pads care about.
A complete capture of these tracks is a dump. A dump is a clone — feed it to a magnetic writer, slap it on a blank stripe, and a cloned card walks into an ATM like it owns the place. This is the card-present world: skimmers, shim devices, deep-shells on fuel pumps, all hunting for track data. CVV2 data cannot make a physical clone. Track data can.
Online world runs on CVV2. Physical world runs on Track data. The two never fully replace each other, and mixing them up is how newbies buy the wrong product and wonder why the checkout rejects it.
5. FULLZ — CARD PLUS THE HUMAN
A bare card record is a stolen object. A fullz record is a stolen identity: card number, expiry, CVV, holder name, billing address, dob, ssn, sometimes mother's maiden name, email, phone. Everything a verification script could ask for.
Why the premium? Shops run soft checks — does the name on the card match the name on the account? Does the billing address zip match the card's bank zip? Fullz sails through those checks because it answers them truthfully, stolen truth but truth. Half-data stalls at the first question and dies there.
Stealers harvest fullz directly — browser saves the card AND the autofill profile together. Breach dumps sometimes lack the human, which is why combo lists (card numbers in bulk, no people attached) trade at bargain prices and fullz trade ten times higher. You are paying for the answers, not the digits.
6. WHAT CHECKERS PULL FROM ALL OF THIS
The record feeds a checker, the checker runs a test authorization, and the response classifies your pile. Four answers matter: dead (dead on arrival), live (opens), chargeable (opens AND swallows charges without dragging a phone OTP into it), and the VBV flag telling you whether a 3D-Secure wall waits at checkout. Non-VBV records — no wall, numbers alone walk in — remain the crown jewels for anything remote.
Every one of those answers traces back to the anatomy you just read: BIN says who to ask, CCN says which account, expiry says whether it still breathes, CVV says the plastic was seen, track data says a clone can walk. Assemble the vocabulary and checkers stop being magic boxes.
7. FIELD CHEAT SHEET
| Term | Exact meaning |
| BIN | First 6-8 digits — issuer, country, type, tier passport |
| Luhn check | Checksum math — last digit validates the whole number |
| CCN | Full cardholder account number, the 16 digits alone |
| CVV2 / CVC2 / CID | Printed anti-copy code — Visa/MC last-3, Amex front-4 |
| CVV1 | Stripe-embedded code — card-present only |
| Track 1 / Track 2 | Two stripe highways — name+data, then number+expiry |
| Dump | Complete stripe capture — clone material |
| Fullz | Card + the human — name, addr, dob, ssn bundle |
| Combo list | Card numbers in bulk, people stripped out — cheap tier |
| Live / Dead | Gateway accepts the record vs gateway rejects it |
| Chargeable | Live and charges clean without OTP challenge |
| Non-VBV | No 3D-Secure wall on checkout — numbers alone work |
— RELATED GUIDES —
- Carding 101: How the Whole Machine Works in 2026
- Non-VBV Bins 2026: Why Live Lists Are Dead
- Non-VBV Bin List 2026: Fresh Working Bins That Skip 3D-Secure
- Non-VBV Sites 2026: Why Every Live List Lies
- What Are Fullz: Anatomy, Myths, and Market Truth
- CC to BTC: Card to Crypto Cashout Method (2026)
- Prepaid Card Loading Method (Green Dot, Netspend)
- CVV to Cash: The Complete Beginner Pipeline
- Fullz to Bank Account: The Onboarding Chain
- Non VBV Meaning: The Definition in 3 Contexts
Digits up, building first. BIN names the bank, CCN names the account, CVV proves the plastic, track data clones it, fullz drags the human along. Every term in every checker response traces back to this anatomy — learn the parts once and every list, gate, and response in this game reads like plain text.
Last edited: