Card, mobile credential, payment and security
Perhaps the most important feature of any credit or debit card is the 16-digit number unique to that card. It is called an ISO number, and it is the key for linking each transaction conducted with the card to the account and account holder responsible for the transaction. In the early 1990’s, these numbers began appearing on student ID cards, replacing earlier numbering schemes like Social Security Numbers or a series of randomly generated digits. But what makes these 16 digits so important? Why would an institution choose this numbering scheme over another? And how does one go about getting an ISO number? Read on.
The International Organization for Standardization (ISO) is a global federation of standards bodies that works to create standards on nearly every imaginable topic. Its subcommittee on Information processing systems, called Technical Committee 97 (TC 97), issued its specification ISO 7812 in the mid-1980’s. ISO 7812—titled Identification cards: Numbering system and registration procedure for issuer identifiers—prescribed the format for a standardized card numbering scheme.
The importance of the standard is that it was a precursor to any attempt to build an infrastructure of card reading devices capable of accepting meaningful data from cards provided by multiple issuers. The infrastructure was necessary for mass, cost-effective development of point of sale (POS) and ATM networks. In reality, this number was required for transaction routing and control while a standard placement of the number on the magnetic stripe was needed to ensure that card readers knew where to look for the ISO number on the card. This latter goal was accomplished by the American Bankers Association (ABA) magnetic stripe encoding standard.
The first digit in an ISO number is called the Major Industry Identifier (MII). This number indicates the category best describing the card issuer owning the ISO number. The MII is broken down as follows: 1 = airlines, 3 = travel and entertainment, 4 = banking/financial, 5 = banking/financial, 6 = merchandizing and banking, 7 = petroleum. With limited exceptions, the Issuer Identifier encompasses the single digit MII and the five digits following it—for a total of six digits. In general, each card generated by an issuer starts with the same six digits.
Giant card issuers such as the major financial institutions and credit card issuers will often have multiple Issuer Identifiers as they run out of unique numbers in one and must utilize others. The next nine digits form the Individual Account Identifier. In the same way that the first six digits name the card issuer, the next nine digits name the cardholder. Actually, the issuer can choose to use between nine and 12 digits for this section, resulting in an ISO number that is between 16 and 19 digits. The generation of these numbers is left up to the issuer. A skip factor or pattern is used to avoid issuing sequential numbers and thus making it overly simple for a person to guess at other valid card numbers by looking at one actual card number.
The final digit (number 16 unless the issuer has elected to use more than nine digits for the Individual Account Identifier) is a check digit, calculated by applying a simple mathematical formula to the preceding digits. This check allows a card reader to perform the calculation based on the first 15 digits it read from the magnetic stripe and check it against the final digit read. If they match, it is likely a valid read. If they do not compute, then the reader knows that the read was bad and requests that the card be swiped again.
Many campus card programs are utilizing the ISO numbering scheme. The main reason for this is its requirement if the card is to be used in the established financial networks.
If you plan to enable financial functionality within the banking networks, ISO numbering is a must. While many campus card systems utilize numbering scheme other than ISO numbers, all card readers and all manufacturers of meal plans, security systems, and other peripheral campus card elements can utilize the ISO number as the identifier. Those that tell you they cannot accomplish this should be asked to explain.
If you never plan to use add financial capabilities to your card program, this standardization may not be necessary. However, there seems to be little reason not to go to ISO numbering for new programs and/or new campus-wide re-issuances.
You do not have to be a bank to get an ISO number. Many schools that utilize the scheme own their own numbers while others have looked to their banking partner to obtain this number on their behalf.
In the past, many believed that the campus had to own their number so that it could be ported from one bank to another if contracts were moved. In reality, most universities that have switched banking partners have been forced to recard and utilize a new ISO number, making the ownership issue less significant.
Many financial institutions are unable to utilize an ISO number that is not their own as their internal systems are geared to accept only these numbers. If you have a banking partner, or are in the review process, ask for information. The application process to obtain a number is simple and costs only $600.
The process takes four to six weeks. In the U.S., applications are processed by ISO’s member body—the American National Standards Institute (ANSI). Application materials can be requested from ANSI by calling 212/ 642-4992 or visiting the on the web at ansi.org.
