A credit card has 15 or 16 digits, depending on the issuer, plus three or four additional security numbers

The main number on your card is called the Primary Account Number (PAN), and it is the long string of digits printed on the front. Most cards show 16 digits, though American Express cards have 15. These digits are not random — they follow a mathematical pattern that identifies your bank, your account type, and your specific account.

Beyond the PAN, your card carries a Card Verification Value (CVV) or Card Security Code (CSC) — a three or four-digit number on the back. American Express prints a four-digit code on the front. These security codes exist to verify that you physically hold the card when you make online or phone purchases. The issuer does not store this number in their system, so a merchant cannot use it to charge you later without your permission.

You will also see an expiration date printed on the front, usually in MM/YY format. This tells you when the card stops working, though the account itself may remain open. When your card expires, your bank sends you a replacement with a new PAN and new security code.

Key Takeaways

  • The 15 or 16-digit number on the front of your card is your Primary Account Number, and each digit position carries specific information about your bank and account.
  • The three or four-digit security code on the back (or front, for American Express) is required for online and phone purchases but is never stored by merchants.
  • Your expiration date tells you when the physical card stops working, not when your account closes.
  • The issuer bank's routing number and your account number are embedded within the PAN but are not the same as the card number itself.

How the 16-digit number breaks down

The first digit of your card number identifies the card network: Visa cards start with 4, Mastercard with 5, American Express with 3, and Discover with 6. This first digit is called the Major Industry Identifier (MII).

The next five or six digits (digits 2 through 6 or 7) make up the Issuer Identification Number (IIN), also called the Bank Identification Number (BIN). This tells the payment system which bank issued your card. When you swipe or insert your card at a store, the terminal reads the BIN to route the transaction to your bank.

The remaining digits (usually 8 through 15) are your individual account number within that bank. The very last digit is a check digit, calculated using the Luhn algorithm, a mathematical formula that prevents typos and fraud. If you mistype even one digit, the check digit will not match, and the transaction will be rejected.

What the security code protects

The CVV or CSC is a three or four-digit number that serves one specific purpose: proving you have the physical card in your hand. When you enter this code during an online purchase or phone order, you are confirming that you can see the card itself.

This code is printed on the card but never transmitted through the payment network and never stored in a merchant's system. If a hacker steals your card number from a store's database, they cannot use it online without the security code. Conversely, if someone sees your security code written down, they still cannot use your card without the full 16-digit number.

Some card issuers now generate temporary or one-time security codes for online shopping, either through their mobile app or by text message. These codes expire after one use or after a set time period, adding another layer of protection beyond the static code printed on your card.

Why card numbers change when you get a replacement

When your card expires or your bank sends you a replacement due to fraud or damage, you receive a new Primary Account Number. Even though you are still the same person with the same account, the card number itself changes.

This happens because the card number is tied to the physical card, not to your account in the bank's system. The bank's internal account number — the one used for statements, transfers, and account management — stays the same. But the card number is a separate identifier that changes with each new card.

This is why you need to update your card number with any merchants who have it on file for recurring charges. Your old card number will stop working on the expiration date, even if your account remains open. Some banks offer a service that automatically updates merchants for you, but you should verify this with your issuer.

The difference between your card number and your account number

Your card number and your bank account number are not the same thing. The card number is printed on your credit card and is used only for card transactions. Your account number is the internal identifier your bank uses to track your account in their system.

If you look at a bank statement or log into your online banking portal, you will see your account number listed separately from your card number. The account number is what appears on checks, wire transfers, and direct deposits. The card number is what you use when you swipe, insert, or enter your card at a merchant.

This separation exists for security reasons. A merchant who sees your card number does not automatically know your bank account number. Similarly, someone who knows your account number cannot use your credit card without the card number itself.

What happens if you lose or damage your card

If your card is lost, stolen, or damaged, contact your issuer immediately. Most banks have a 24-hour fraud line listed on the back of your card or on your statement. Once you report the card, the issuer will freeze that card number so no one else can use it.

Your account itself remains open and active. The bank will send you a replacement card with a new number within 7 to 10 business days, though some issuers offer expedited shipping for an extra fee. Until the new card arrives, you can still access your account online, by phone, or through the bank's mobile app.

You will need to update your new card number with any merchants who have it on file for recurring payments — subscriptions, gym memberships, insurance premiums, and similar charges. Some issuers provide a tool to help you identify which merchants have your card on file, but you should manually verify the major ones to avoid missed payments.

How to protect your card numbers

Your card number and security code should be treated as sensitive information. Never write them down or store them in an unencrypted file. When you enter your card number online, verify that the website uses a secure connection — the URL should start with "https://" and a padlock icon should appear in the address bar.

Do not share your full card number, expiration date, or security code with anyone unless you initiated the transaction. Legitimate merchants and your bank will never ask for your security code by email or phone. If someone calls claiming to be from your bank and asks for this information, hang up and call your bank's customer service number directly.

When you receive a new card, sign the back immediately. If your card is lost or stolen, the signature helps merchants verify that the person using it is the cardholder. Keep your card in a secure location, and monitor your statements regularly for unauthorized charges.

Frequently Asked Questions

Why does my card number change when I renew my card?

Each physical card has its own unique number. When your card expires or is replaced, the bank issues a new card with a new number, even though your account remains the same. The new number is tied to the new card, not to your account. You will need to update this new number with merchants who have it on file for recurring charges.

Is it safe to give my card number to a merchant online?

It is safe to enter your card number on a secure website (one with "https://" in the URL and a padlock icon). However, you should never email your card number or give it over the phone unless you initiated the call. Legitimate merchants will never ask for your security code by email or phone.

What should I do if I see charges I did not make?

Contact your card issuer immediately — most banks have a fraud line available 24/7. Report the unauthorized charges and request a dispute. The bank will typically issue a temporary credit while they investigate, and you are not responsible for fraudulent charges once you report them. Check your statements regularly to catch fraud early.

Can someone use my card number without the security code?

In person, yes — a merchant can process a card at a physical store using only the card number. Online or by phone, no — the security code is required. This is why the security code exists: to prevent someone who has only your card number from making online purchases. However, if your card is physically stolen, the thief can use it in stores without the security code.

Do I need to memorize my card number?

No. You should not memorize or write down your card number. Keep it secure and refer to your physical card or your bank's app when you need it. The only number you might want to memorize is your bank's customer service phone number, which is usually printed on the back of your card.