The whole number is used in the checksum calculation (the Luhn algorithm). The last digit is basically the checksum. The first six digits will identify an iss

The whole number is used in the checksum calculation (the Luhn algorithm). The last digit is basically the checksum. The first six digits will identify an issuing bank and card type. All Chase Debit Visas will start with the same six digits (unless they've further broken it down), but no Citibank one will use them. It's still plenty guessable-- try the most popular prefixes and you'll probably hit a few percent of the time. It might be based in PCI regulations. They might be allowed to store or display the first six/last four in plain text, but probably have to encrypt the whole number or store a token in lieu of the actual full card number.