Payment Card PAN

Identifies payment card Primary Account Numbers (PANs) for Visa, Mastercard (including 2-series BINs), American Express, and Discover. Uses Func_credit_card Luhn validator with AllDigitsSameFilter.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: card BIN prefixes combined with Luhn validation produce very few false positives. Mastercard 2-series BINs (issued since 2017) are included for comprehensive coverage.
Detection quality: Verified
Jurisdictions: global
Regulations: CCPA/CPRA, GDPR
Frameworks: ISO 27001, ISO 27701, PCI-DSS, SOC 2
Data categories: pii, financial
Scope: narrow
Risk rating: 9
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\b(?:4\d{3}|5[1-5]\d{2}|2[2-7]\d{2}|3[47]\d{2}|6(?:011|5\d{2}))\d{4}\d{4}\d{1,4}\b

Corroborative evidence keywords

payment card, card number, Visa, Mastercard, American Express, Amex, Discover, PAN, PCI, credit card, card no, CC, visa, mastercard, amex, american express, discover, jcb, diners club

Proximity: 300 characters

Should match

4111111111111111 — Visa test card (16 digits starting with 4)
5500000000000004 — Mastercard test card (16 digits starting with 55)
2221000000000000 — Mastercard 2-series test card
340000000000009 — American Express test card (15 digits starting with 34)

Should not match

1234567890123456 — Starts with 1, not a valid card prefix
411111111111 — Only 12 digits, too short
9999999999999999 — Invalid BIN prefix

Known false positives

Generic numeric sequences resembling card numbers. Mitigation: Luhn validation and BIN prefix filtering. Corroborative keywords in proximity.
Test card numbers in documentation or code. Mitigation: AllDigitsSameFilter removes trivial sequences.

References

Credit Card Number entity definition - Microsoft Learn