The four-part output every payment form's credit card validator should surface — Luhn, brand, length, IIN — and the prefix-table traps that old validators miss.