Mastercard Number Format Explained

A Mastercard number is 16 digits and begins in one of two ranges: 51–55, or 2221–2720. Both are ordinary issuance, both carry a Luhn check digit, and the three-digit CVC2 on the back is not part of the number.

The second range is the interesting one, and not only because so much validation code predates it. Its boundaries were chosen by arithmetic, and that arithmetic explains the whole change.

If you need numbers to test against, the Mastercard generator produces them on both ranges.

The format at a glance

Fixed length is worth noting because Mastercard is the exception among the major networks. Visa allows three lengths, JCB four, Maestro eight. Mastercard allows one, so a length === 16 check is correct here — and reusing that rule elsewhere is where the trouble starts. The length rules by network cover which networks tolerate it.

Why the 2-series has those exact boundaries

Mastercard ran out of room in 51–55 and needed a second block. What is rarely explained is why the replacement is 2221–2720 and not some rounder-looking span.

Count the issuer identification numbers each range yields.

The original block fixes the first two digits to one of five values — 51, 52, 53, 54, 55 — and leaves the rest free. With a six-digit BIN that is four free digits, so 5 × 10,000 = 50,000 BINs.

The new range fixes the first four digits to one of 500 values, since 2720 − 2221 + 1 = 500, and leaves two free at six digits: 500 × 100 = 50,000 BINs.

Identical. The relationship holds at eight digits too — 5,000,000 each — because widening the BIN adds the same two digits to both sides.

So the 2-series was not an arbitrary allocation inside MII 2. It was sized to exactly double Mastercard’s issuing capacity, and the boundaries fall where they do because 500 four-digit blocks is what it takes to match five two-digit ones. Once you see that, 2720 stops looking like a strange number to stop at.

The range sits under Major Industry Identifier 2, originally earmarked for airlines — which is why a 2-series card looks so unlike a payment card to code that was written when the first digit still implied an industry.

The pattern, briefly

A numeric range is not a string prefix, so 2221–2720 decomposes into five alternatives:

const MASTERCARD = /^(?:5[1-5]\d{4}|222[1-9]\d{2}|22[3-9]\d{3}|2[3-6]\d{4}|27[01]\d{3}|2720\d{2})\d{10}$/;

The decomposition, the boundary cases either side of 2221 and 2720, and the detection order that keeps Mastercard from colliding with Maestro are all covered in the brand detection guide. The short version: test 2220… and 2721… and confirm both are rejected, because a range check that passes on the middle and fails at the edges is the normal outcome of writing one by hand.

Stripe publishes 2223 0031 2200 3222 as its 2-series test card, and its testing documentation is a convenient source for a number your gateway will actually recognise.

What the change asks of your data, not just your regex

Fixing the pattern is the visible half. The rest of the work is in places that do not throw errors:

Stored BIN prefixes. Any table keyed on a two-digit or six-digit Mastercard prefix needs new rows, not edited ones — the old range did not move. Routing rules, interchange estimates, and surcharge logic all read from those tables, and a missing row produces a default rather than a failure.

Analytics and reporting. Dashboards that segment by card brand using your own detection will show a growing “unknown” bucket rather than a broken chart. That bucket is the symptom, and it is easy to read as noise for months.

Fraud rules. Rules written against 5* prefixes silently stop applying to a share of Mastercard traffic. Neither the rule nor the transaction reports anything unusual.

Fixture data. A test suite whose Mastercard numbers all start with 54 proves nothing about the new range. This is the cheapest thing on the list to fix and the one most often left.

The common thread is that none of these fail loudly. The 2-series does not break payments — cards on it authorise normally — it breaks the things your own code inferred from the prefix, which is why the change can be years old and still be finding new victims.

Product families, and what the number does not say

Mastercard Standard, World, and World Elite are tiers of the same product. Mastercard Debit and Prepaid are issued on the same ranges as credit. Business, Purchasing, and commercial products have their own BIN assignments but no distinguishing format.

None of it is visible in the number. Tier, funding type, country, and issuer all come from a BIN database, not from the digits — the number identifies the network and stops there.

This trips people up more with Mastercard than with most networks, because the tiers are heavily marketed and the interchange difference between a Standard consumer card and a World Elite one is real money to a merchant. The temptation is to infer the tier from the prefix, and it does not work: two cards on adjacent BINs can be different products, and the same product spans BINs that share no visible pattern. If your pricing depends on the distinction, it depends on licensed data, and building it on prefix heuristics means quietly mispricing a fraction of transactions with no error to alert you.

Maestro and Cirrus

Two related marks that are not Mastercard:

Maestro is operated by Mastercard as a separate scheme: BIN ranges 50 and 56–69, lengths from 12 to 19 digits, debit-only funding, and a security code that some issuers omitted entirely. The variable length is what breaks systems — any fixed-length rule excludes valid Maestro cards — and its broad 6… range overlaps Discover and UnionPay, which is why detection order matters. The Maestro page covers that range in full.

Cirrus is an ATM network, not a card scheme. The mark indicates where the card can be used to withdraw cash. It has no BIN range, no format implications, and nothing for your payment code to detect — it appears here only because it shares the branding and is regularly mistaken for a third scheme.

History

The naming has changed more often than the format. The network began in 1966 as the Interbank Card Association, a group of banks formed to compete with BankAmericard. Its cards were branded Master Charge from 1966, renamed MasterCard in 1979, and restyled as Mastercard — lower-case c — in the 2016 rebrand that also simplified the interlocking-circles mark.

Through all of it the 5 prefix remained, which is why a card issued in 1979 and one issued in 2016 are indistinguishable by format. The 2-series is the first structural change to Mastercard numbering in the scheme’s history, and it changed the prefix without touching the length, the check digit, or anything else. Mastercard’s developer documentation is the current reference for its APIs and BIN guidance.

Common integration mistakes

1. ^5[1-5] as a complete pattern. It was correct until 2017 and is now wrong for a growing share of cards. This is the most common Mastercard-specific bug in production.
2. Never testing the 2-series. A fixture set of 5424… numbers exercises none of the new range. Add a 2-series number and the boundary cases around it.
3. Committing to a brand on the first digit. A leading 5 narrows things quickly; a leading 2 identifies nothing until four digits are typed. Detection that guesses early shows the wrong logo and then corrects itself.
4. Merging Maestro into Mastercard. Different ranges, different lengths, different funding. Code that treats them as one is wrong about both.
5. A four-character security code field. If the field widened for American Express, it has to shrink back to three for Mastercard — the validator is a quick way to confirm your form handles the switch.