Primary Account Number (PAN)

What a Primary Account Number is

A Primary Account Number (PAN) is the number associated with a payment card account. It identifies the issuer and funding account, and payment systems use it to route a transaction for approval. The PAN is also commonly called the card number.

A PAN is commonly 12 to 19 digits long. It can be printed or embossed on a physical card, encoded in its chip or magnetic stripe, or represented in a digital payment flow. A cardholder enters it into an online payment form’s card-number field; a terminal reads it when a customer uses a physical card.

The PAN itself does not add a processing fee, but exposing it can create real security and compliance costs.

How it works in a payment

When you accept a card payment, transaction data is sent through the acquiring side and card network to the issuer. The issuer uses the PAN to identify the account and evaluate the authorization request, then returns an approval or decline. The PAN connects the transaction to the right account; it does not determine your processing price.

A payment token can stand in for the underlying PAN in supported digital and stored-card transactions. That means your system can use a substitute value instead of exposing the original card number in each payment flow. A token is not the customer’s actual PAN, and its use does not remove your responsibility to understand your payment setup and security obligations.

Why PAN security matters to your business

The PAN is cardholder data under PCI DSS. If your business stores, processes, or transmits card numbers, the way you handle that data affects your security controls and compliance work. PCI DSS v4.0.1 is the current version as of 2026. A PAN exposed with a customer’s name, billing address, or transaction details can give criminals useful information for payment fraud or account misuse.

Do not treat a full card number as ordinary customer information. Use payment systems that limit where the PAN is handled, and avoid copying it into email, spreadsheets, support notes, or other tools that are not designed for card data. Masking hides digits on screen or in print; truncation removes digits from a displayed number. A receipt showing only the last four digits gives staff a reference without exposing the full PAN.

A PAN is not the card’s security code. The CVV, CVC, or CID is separate sensitive authentication data, so do not confuse the two when reviewing your payment forms or security procedures. Card-not-present sales, such as online orders and phone payments, deserve particular attention because the physical card is not being presented to your staff.

What it means for your costs

There is no standard processing fee charged simply because a transaction has a PAN. Your card costs come from interchange, network fees, and processor markup, not from the card number itself. Security work can still affect your operating costs: processors commonly bill a monthly PCI non-compliance fee when a merchant has not validated compliance.

On a merchant statement, look for a PCI non-compliance fee or similar PCI-related line if you have not completed the required validation. That fee is separate from the card processing charges on each sale. If you see it, compare the charge with your compliance status and the specific action needed to resolve it.

What you can actually change

1. 01
   Limit PAN exposure. Use a payment page or terminal setup that keeps full card numbers out of email, spreadsheets, and staff notes. Check where your payment data is captured and which systems handle it.
2. 02
   Use masked displays. Review receipts, confirmations, and customer records to make sure they show only the digits needed to identify a card, such as the last four.
3. 03
   Close PCI gaps. Confirm your PCI DSS validation is complete and address any listed requirement. If your statement has a PCI non-compliance fee, identify the validation step tied to that charge.
4. 04
   Check stored-card flows. Find out whether your recurring or returning-customer payments use a token or retain raw card data. Limit access to any system that handles the full PAN.

Frequently asked questions