Exploring whether regex can validate credit card numbers using the Luhn algorithm reveals deep connections between formal language theory and practical security. A deterministic finite automaton with just 100 states solves the puzzle, exposing the gulf between theoretical possibility and practical implementation.