Detection reference · Financial data · Updated 2026-11-03

Payment card numbers

A card number must pass the Luhn checksum, which rules out most random digit runs. Redaxa runs that check on every candidate before flagging it.

At a glance

Reported as	Card number
Category	Financial data
Severity	high: direct financial exposure or a strong identifier, such as a card or national number
Replaced with	`[CARD]`
Where it runs	The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks.
Engine rule	scanner.ts, line 229

What it looks like

13 to 19 digits starting with 2 to 6, with optional spaces or hyphens, that pass the Luhn check (ISO/IEC 7812).

Example

You paste

Charge card 4242 4242 4242 4242, exp 12/34.

Redaxa returns

Charge card [CARD], exp 12/34.

Reported as	Card number
Severity	high: direct financial exposure or a strong identifier, such as a card or national number
Replaced with	`[CARD]`

All values on this page are synthetic or published specimens; none is a working credential or a real person's data.

In a repository check

The same example, committed to a public repository and run through the free repository check:

exports/payments.csv: Card number, listed for review (severity high). Potential sensitive data. Context and authorization must be reviewed; this is not a confirmed vulnerability.
Same value in tests/fixtures/payments.csv: Test or example value, counted but not listed. Real-looking keys in test files are still reported.

Values are always shown masked in repository reports. No key is ever tested against its provider.

What it does not flag

Timestamp 1729000000000: not flagged. 13-digit millisecond timestamps start with 1, which no card number does.

Known false positives

Text that is harmless but still flagged today. Listed so you can recognise it, not hidden.

Use test card 4242 4242 4242 4242: flagged as Card number. Payment providers' test numbers pass the Luhn check and are flagged in prompts. Repository checks count them but do not list them when they sit in test files.
Card 4242 4242 4242 4241: flagged as Phone number. A Luhn failure is not a card, but the first 8 digits still match the phone rule: a known overlap between two rules.

What to do

If a real card number was exposed, the cardholder should contact the issuing bank to block and replace the card. Never paste full card numbers into AI tools; the last four digits are almost always enough.

Check before you paste

The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.

Add the Chrome extension Try a free web check

Sources

Redaxa engine: scanner.ts line 229. Every output on this page was produced by that code when the page was built.
Stripe Docs: Testing (test card numbers)
Luhn algorithm