diff --git a/system/Validation/CreditCardRules.php b/system/Validation/CreditCardRules.php
index a31b303fcb86..0bc20f082123 100644
--- a/system/Validation/CreditCardRules.php
+++ b/system/Validation/CreditCardRules.php
@@ -199,8 +199,7 @@ public function valid_cc_number(?string $ccNumber, string $type): bool
         // Remove any spaces and dashes
         $ccNumber = str_replace([' ', '-'], '', $ccNumber);
 
-        // Non-numeric values cannot be a number...duh
-        if (! is_numeric($ccNumber)) {
+        if (! ctype_digit($ccNumber)) {
             return false;
         }
 
diff --git a/tests/system/Validation/StrictRules/CreditCardRulesTest.php b/tests/system/Validation/StrictRules/CreditCardRulesTest.php
index deda7d76f984..55a880839662 100644
--- a/tests/system/Validation/StrictRules/CreditCardRulesTest.php
+++ b/tests/system/Validation/StrictRules/CreditCardRulesTest.php
@@ -100,6 +100,16 @@ public static function provideValidCCNumber(): iterable
                 'abcd efgh ijkl mnop',
                 false,
             ],
+            'decimal_point_visa' => [
+                'visa',
+                '41.1111111111111',
+                false,
+            ],
+            'decimal_point_mastercard' => [
+                'mastercard',
+                '5351367.37861108',
+                false,
+            ],
             'bad_length' => [
                 'amex',
                 '3782 8224 6310 0051',
diff --git a/user_guide_src/source/changelogs/v4.7.5.rst b/user_guide_src/source/changelogs/v4.7.5.rst
index 5fc0cfce5578..8da98205bf39 100644
--- a/user_guide_src/source/changelogs/v4.7.5.rst
+++ b/user_guide_src/source/changelogs/v4.7.5.rst
@@ -59,6 +59,7 @@ Bugs Fixed
 - **Honeypot:** Fixed a bug where bot detection returned an HTTP 500 response instead of 403 (Forbidden).
 - **I18n:** Fixed a bug where ``Time::today()``, ``Time::yesterday()``, and ``Time::tomorrow()`` ignored the specified ``$timezone`` and ``setTestNow()`` when calculating the day.
 - **Logger:** Fixed a bug where interpolating a log message with array or non-stringable context values could raise PHP warnings or errors.
+- **Validation:** Fixed a bug where ``valid_cc_number`` accepted non-digit characters (e.g., a decimal point) in the card number. Such values could pass the Luhn check and triggered an ``Undefined array key`` warning inside it; the number is now checked with ``ctype_digit()``.
 
 See the repo's
 `CHANGELOG.md <https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md>`_