American Express — the format that breaks assumptions.
If your validator only works correctly on one card brand, it's almost always Amex that exposes it. Here's exactly why.
Amex's Number Structure
| Property | Value |
|---|---|
| Prefix | 34 or 37 |
| Length | 15 digits |
| Grouping | 4-6-5 (not 4-4-4-4) |
| Security code | 4-digit CID, printed on the front |
| Network model | Closed-loop — Amex is both issuer and acquirer for most of its cards |
Three Specific Assumptions Amex Breaks
- The 16-digit assumption. A form that hardcodes a 16-character input mask, or a regex expecting exactly 16 digits, will silently mishandle every Amex number. This is the single most common Amex-related validation bug.
- The 3-digit CVV assumption. Amex's CID is 4 digits and sits on the front of the card, not the back. A security-code field capped at 3 characters will truncate a valid Amex CID.
- The 4-4-4-4 spacing assumption. Amex's real-world card grouping is 4-6-5. A display or input mask built around even 4-digit chunks will format an Amex number incorrectly even when the underlying digits are stored correctly.
Why Amex's Structure Is Different in the First Place
The difference isn't arbitrary — it comes from Amex's closed-loop business model. Visa and Mastercard are open-loop: they license their networks to many separate issuing banks, which requires a highly standardized numbering system so any bank's cards work identically across the whole network. Amex, historically, issued and acquired most of its own transactions directly, giving it more freedom to use its own proprietary 15-digit scheme rather than conforming to the 16-digit convention everyone else settled on.
Generating Amex Test Numbers
Select Amex from the Card Network dropdown above — Luhnly generates a correctly formatted 15-digit number (4-6-5 grouping) paired with a 4-digit CVV automatically, specifically so you can test against Amex's real constraints rather than assuming Visa's format covers every case.
Related Guides
Frequently Asked Questions
Does American Express use the same Luhn checksum as other cards?
Yes — despite its different length and structure, Amex's 15-digit numbers still end in a standard Luhn check digit, calculated the same way as Visa, Mastercard, or any other network.
Why is Amex's security code called CID instead of CVV?
CID (Card Identification Number) is Amex's own name for the same concept other networks call CVV, CVV2, or CVC2 — a security code used to verify card-not-present transactions. It's functionally equivalent, just branded differently and printed in a different location.
Is it common for card validators to have Amex-specific bugs?
Yes — it's one of the most common real-world validation bugs, precisely because Visa and Mastercard's shared 16-digit, 3-digit-CVV format is so dominant that many forms are built around it as an unstated assumption.