You're right that the account number shown on your credit cards turns out to be quite a bit more complicated and sophisticated than you may think. It's not, in fact, just a random sequence of digits, but rather a smart way to have tons of different card numbers available while slowing down thieves who would try to guess credit card number and expiration pairs.

To explain, I'm going to use a fictitious card number, but I would encourage you to pull your own credit card out of your purse or wallet and play along at home...

The first digit of a credit card number is known as its Major Industry Identifier, and the possible values give you insight into who issues credit cards for Visa and Mastercard:

When I look at the cards in my wallet, for example, my Paypal MasterCard starts with a "5", while my Amazon.com Visa starts with a "4".

The next five digits plus the very first digit make up the Issuer Identification Number, the bank or other institution that issued the card. This means that if I compare cards with someone else who has an Amazon Visa, for example, we should both find that it has the same IIN, which starts with 4640.

Every subsequent digit on the credit card but the very last is your account number. A credit card has a maximum of 19 digits, though most use 16, meaning that there are typically 9-12 digits utilized for account numbers. Mathematically, this means that there are 10**9 possible account numbers, or a billion possible combinations. If the card issuer used 12 digits, that'd be 10**12 or 1,000,000,000 000 combinations. That's a lot of possibilities!

The last digit is perhaps the most interesting, however, it's the checksum and it's a bit tricky to calculate but here's basically how it works:

Take your credit card number and double every other digit, starting on the right.

For a sample credit card number of 4417 1234 5678 9113, that would mean that we're going to double every other digit and skip the intervening, like this:

(4*2) [4] (1*2) [7]   (1*2) [2] (3*2) [4]   (5*2) [6] (7*2) [8]   (9*2) [1] (1*2) [3]

This yields:

8 _ 2 _   2 _ 6 _   10 _ 14 _   18 _ 2 _

Any two-digit number becomes the sum of its digits, so 10 = 1 + 0, 14 = 1 + 4, 18 = 1 + 8, producing:

8 _ 2 _   2 _ 6 _   1 _ 5 _   9 _ 2 _

Now we need to fold back in the original digits that we'd skipped (I said it's complicated!) and sum up each quad:

8+4+2+7   2+2+6+4   1+6+5+8   9+1+2+3

Total value = 70 (add it up, you'll see).

This sum value doesn't need to equal the last digit on the card, however, that's just included to ensure that the digits all add up to a number that's divisible by 10. If the last digit weren't a 3, for example, but a 5, then we'd have ended up with 72, which would demonstrate that it's not a valid credit card number.

Cool, eh? I imagine that the shopping site you used actually had that complicated math formula built in to the shopping cart, so it could instantly recognize that the checksum wasn't divisible by ten and therefore you had to either have a fake card or a card with a typo somewhere in the entry.

Hope that's helpful and interesting!