Structural card-number check before hitting a PSP: Luhn checksum, network detection from public IIN prefixes (visa, mastercard, amex, discover, jcb, diners, unionpay) and per-network length validation. POST body on purpose: the number never appears in a URL, so it stays out of request logs and x402 payment metadata — never stored, logged or echoed back. No BIN/issuer lookup (BIN databases are licensed): well-formed does not mean the card exists.