Yes, most PSPs do this. E.g. Stripe calls it a fingerprint. It's only valid for your merchant ID (i.e. if we both signed up for Stripe and swiped the same card,

Yes, most PSPs do this. E.g. Stripe calls it a fingerprint. It's only valid for your merchant ID (i.e. if we both signed up for Stripe and swiped the same card, we'd get different fingerprints). https://stripe.com/docs/api/tokens/create_card https://stripe.com/docs/api/tokens/create_card (notice the request has no charge, but the response contains a fingerprint). To state the obvious: it's not determinstic outside of Stripe, and there's no way to revert it, or even iterate over all CC numbers and brute force the space. You'd need Stripe's secret, e.g. assuming they use HMAC.