Card expiry test vs card number test: the short answer

A card expiry test checks the expiration date field: the format, the month range from 01 to 12, and whether the date is still current or in the future. A card number test checks the primary account number: digit count, Luhn checksum, and issuer range. These are separate checks on separate fields. A form can pass one and fail the other, so validate both and return an error next to the field that failed.

Card Expiry Test Alternative: Compare Options

What each test covers

Expiry date validation

  • Format: MM/YY or MM/YYYY, digits only.
  • Month range: 01 through 12, with no leading-zero gaps.
  • Date state: the card is valid through the last day of the stated month.
  • Year window: reject years too far in the past or the future.

Card number validation

  • Length: 12 to 19 digits for most networks.
  • Characters: digits only, no spaces after normalization.
  • Checksum: Luhn algorithm pass.
  • Range: BIN prefix matches a known issuer range.

A Luhn pass does not prove a card exists. It only catches typos. The same is true of an expiry check: a valid future date does not confirm the account is open. Both tests reduce failed authorization attempts, and neither replaces an authorization request.

Card Expiry Test Best

Prerequisites

  • A test or sandbox environment from your payment processor.
  • A list of boundary dates: current month, next month, last month, month 00, month 13.
  • A form with separate month and year inputs, or a single MM/YY field.
  • Access to your processor's test card numbers and their stated expiration dates.

How to test card expiry validation

  1. Enter the current month and year. Confirm the form accepts it and the charge request goes through in the sandbox.
  2. Enter the previous month. Confirm the form blocks submission and shows a date error, not a card number error.
  3. Enter month 00 and month 13. Confirm both fail with the same date error.
  4. Enter a two-digit year that maps to a past decade, such as 19. Confirm the pivot logic rejects it.
  5. Enter a date far in the future, such as 12/2099. Confirm the form either accepts it or applies a stated limit.
  6. Submit with a valid date and an invalid card number. Confirm the card number error appears and the date field stays clean.
  7. Submit with a past date and a valid card number. Confirm the date error appears and the card number field stays clean.

Common failures to watch

  • Comparing the two-digit year to a four-digit year and rejecting valid cards.
  • Blocking the current month on the first day instead of the last day.
  • Clearing both fields when only one fails validation.
  • Logging the full card number or the security code in error messages. PCI DSS treats the CVV as sensitive authentication data that must not be stored after authorization.

Keep expiry data out of logs and analytics. Store the expiration date only when you have a business reason and a documented retention period.

read more