Primary account number (PAN)
DEFINITION
A primary account number (PAN) is the full digit sequence on a payment card that uniquely identifies the cardholder's account with the issuing bank.
TABLE OF CONTENTS
RELATED TERMS
A primary account number, or PAN, is the full string of digits embossed on the front of a payment card and encoded in its chip or magnetic stripe, the number that uniquely identifies the cardholder's account with the issuing bank. On its own it can be used to initiate a payment, which makes it one of the most sensitive pieces of data in the payments ecosystem.
Because the PAN can move money, it sits at the center of how payment security standards are built. Any system that transmits, processes, or stores a PAN falls under strict security requirements meant to keep that number away from anyone who should not have it. A subscription platform such as Recurly typically avoids storing the raw PAN unprotected at all, relying instead on encryption or tokenization so that recurring billing can run without their own systems ever holding the actual card number.
Why the PAN matters for subscription businesses
Subscription businesses are unique in that they need to charge a customer's card repeatedly over time, often for months or years, without the customer re-entering their card details at each renewal. That requirement means the business, or a partner acting on its behalf, has to keep some way to reference the customer's payment method long after the first transaction. Handling the PAN irresponsibly in that context creates serious risk: a breach exposing stored PANs can lead to fraud, regulatory penalties, and lasting damage to customer trust.
This is why scope matters so much in payment security. Any system that touches the PAN, whether it stores, processes, or simply transmits it, falls under compliance obligations, and the more systems that touch the raw number, the larger and more expensive that burden becomes. Reducing how many systems ever see the PAN is one of the most effective ways a subscription business can limit both its risk and its compliance scope.
How the PAN is protected
The PAN is protected in two related ways: strict handling requirements for any system that does touch it, and tokenization, which removes the need for most systems to touch it at all.
When a customer enters a card number, the raw PAN is captured, typically by a payment gateway or processor's secure fields rather than by the merchant's own servers.
The processor or a tokenization service generates a token, a substitute value that has no exploitable use outside that specific system, and returns the token to the merchant instead of the PAN.
The merchant's systems store and reference the token for future charges, such as subscription renewals, rather than the actual card number.
When a charge needs to be processed, the token is sent back to the processor, which maps it internally to the real PAN and submits the transaction to the card network.
The raw PAN itself typically exists only briefly at the point of capture and within the processor's secure environment, never persisting in the merchant's own systems.
Industry security standards such as the Payment Card Industry Data Security Standard set requirements for any organization that stores, processes, or transmits PANs, covering areas like encryption, access controls, and network segmentation.
How to reduce PAN exposure in a subscription business
Limiting how much of the business ever touches the raw PAN is the most reliable way to reduce both risk and compliance overhead.
Use tokenization for any stored payment method, so recurring charges reference a token rather than the actual card number.
Route card entry through a payment gateway's hosted fields or a similar mechanism, so raw card data never passes through the merchant's own servers.
Limit the number of internal systems, reports, and integrations that have any reason to see card data, even in encrypted form.
Train staff to recognize that a full card number should never be requested, written down, or sent through unsecured channels like email or chat.
Work with a payment processor or gateway that documents clearly how it protects the PAN and how it handles compliance responsibilities on the merchant's behalf.
Benefits and examples of proper PAN handling
Handling the PAN correctly, mainly by minimizing exposure to it, gives a subscription business several concrete benefits:
A smaller compliance footprint, since systems that never touch the raw PAN carry a lighter set of security obligations.
Lower risk of a costly and reputationally damaging data breach involving stored card numbers.
Simpler recurring billing, since tokenized payment methods can be charged repeatedly without re-collecting card data from the customer.
Greater customer trust, since subscribers increasingly favor businesses that visibly protect their financial information.
Consider an illustrative example. A subscriber signs up for an annual plan and enters a card number into a payment form. The form is hosted by the payment gateway rather than the merchant's website, so the raw PAN goes straight to the gateway, which returns a token to the merchant. Every year at renewal, the merchant's billing system sends that token back to the gateway to process the charge. At no point does the merchant's own database store the actual card number.
Frequently asked questions
What is a primary account number (PAN)? A PAN is the full card number embossed or printed on a payment card and encoded in its chip or stripe, uniquely identifying the cardholder's account with the issuing bank.
Is the PAN the same as the card number? Yes. The PAN is the formal term for what is commonly called the card number, the full digit sequence used to identify the account and initiate a transaction. It is also referred to as the FPAN, or "funding primary account number," in tokenization terms.
Why don't subscription businesses just store the PAN directly? Storing the raw PAN creates significant security risk and compliance obligations, so most subscription businesses use tokenization instead, storing a substitute token that has no value if it is exposed on its own.
What is tokenization in relation to the PAN? Tokenization obfuscates the PAN with a randomly generated or LUHN10 validated token after the card is first captured, letting a merchant reference a customer's payment method for future charges without ever storing the actual card number.
What compliance standard governs how the PAN must be handled? The Payment Card Industry Data Security Standard sets the security requirements for any organization that stores, processes, or transmits PANs, covering areas such as encryption and access control.
