A credit card has 16 digits, but they are not all the same
The long number on the front of your card is 16 digits. The first six digits identify your bank and card type — Visa, Mastercard, American Express, or Discover. The next nine digits are your unique account number. The last digit is a check digit that prevents fraud by confirming the number is mathematically valid.
American Express and Discover cards sometimes use a different structure. American Express typically shows 15 digits instead of 16. Discover cards follow the 16-digit standard but may display them in a different grouping on the physical card.
Beyond the front number, your card also has a three- or four-digit security code on the back (called the CVV or CVC), an expiration date, and your name. Each piece serves a specific purpose when you make a purchase or set up recurring payments.
Key Takeaways
- Most credit cards display 16 digits on the front, divided into four groups of four numbers each.
- The first six digits identify your bank and card network; the next nine are your account number; the last is a check digit for fraud prevention.
- American Express cards typically show 15 digits instead of 16, and the security code is four digits rather than three.
- The security code on the back (CVV or CVC) is separate from the card number and required for online purchases.
- Your expiration date and cardholder name are also printed on the card but are not part of the main account number.
What the first six digits tell you
The first six digits of your card number form what is called the Issuer Identification Number (IIN), sometimes called the Bank Identification Number (BIN). These digits tell the merchant's payment system which bank issued your card and which card network it belongs to.
All Visa cards start with a 4. All Mastercard cards start with a 5. Discover cards start with a 6. American Express cards start with a 3. The remaining five digits in that first group narrow it down further — they identify your specific bank or credit union.
When you swipe or insert your card, the payment terminal reads these first six digits to route your transaction to the correct network and issuer. This is why a card number starting with 4 will never work on a system that only accepts Mastercard — the network is determined before the merchant even sees your full account number.
The nine digits that are uniquely yours
Digits 7 through 15 make up your account number. This is the part that ties the card to your specific account at your bank. No two cardholders at the same bank have the same nine-digit account number, even if they hold the same type of card.
Your bank assigns this number when you open the account. If you request a replacement card — because yours was lost, stolen, or simply expired — you keep the same account number. The card itself is replaced, but the underlying account stays the same.
This is why fraudsters focus on stealing the full 16-digit number rather than just the account number. The full number, combined with the expiration date and security code, is what they need to make a purchase. The account number alone is not enough.
The last digit and how it prevents fraud
The 16th digit is called the check digit, and it exists purely to catch typos and invalid numbers. Your bank calculates this digit using a mathematical formula called the Luhn algorithm, which runs the first 15 digits through a specific set of operations to produce a single digit that must match the 16th.
When you enter your card number online or a merchant swipes it, the payment system runs the Luhn check automatically. If the math does not work out — if someone typed a digit wrong or made up a number — the transaction is rejected before it ever reaches your bank. This catches honest mistakes and also stops random number generation from working as a fraud method.
You do not need to understand the Luhn formula yourself. The point is that the last digit is not random; it is mathematically tied to the first 15. This is why you cannot simply change one digit and have a valid card number.
The security code on the back is separate
The three-digit number on the back of your card (or four digits for American Express) is called the CVV (Card Verification Value) or CVC (Card Verification Code). This number is not part of your 16-digit account number — it is stored separately and printed only on the physical card.
The security code serves one purpose: to confirm that you physically have the card in your hand. When you make an online purchase, you must enter this code along with your card number and expiration date. A fraudster who has only your card number — from a data breach or a stolen receipt — cannot complete an online purchase without this code.
For in-person purchases, you do not need to provide the security code. The merchant swipes or inserts the card, which allows the payment terminal to read the magnetic stripe or chip, and the transaction goes through. Online and phone purchases require it because the merchant cannot physically verify the card.
Why American Express is different
American Express cards break the standard pattern in two ways. First, they use 15 digits instead of 16. Second, the security code is four digits instead of three, and it appears on the front of the card rather than the back.
The structure is still similar: the first six digits identify American Express and your specific bank, the next eight or nine digits are your account number, and the last digit is a check digit. The four-digit security code on the front is called the CID (Card Identification Digit) and works the same way as the CVV on other cards.
When you enter an American Express card online, you will need to provide all 15 digits, the expiration date, and the four-digit CID. Some older payment systems may not recognize the 15-digit format, which is why American Express cards sometimes do not work on certain websites or older terminals.
What happens when your card expires
Your expiration date is printed on the front of the card, usually in the format MM/YY (month and year). This date tells merchants and payment systems when your card is no longer valid. On the expiration date itself, your card stops working.
When your card expires, your bank sends you a replacement card with a new expiration date. The card number usually stays the same — same 16 digits, same account number. The only thing that changes is the physical card and the expiration date printed on it.
Some banks do issue a new card number when you renew, particularly if there has been fraud on the account or if you are upgrading to a different card product. But in most cases, your account number persists across multiple physical cards over many years.
Frequently Asked Questions
Can someone use my card number if they do not have the security code?
Not for online purchases. In-person transactions do not require the security code because the card is physically present. But for online and phone purchases, the CVV or CID is required, and most payment systems will reject the transaction without it. A stolen card number alone is much less useful than a stolen card number plus expiration date and security code.
What if I type my card number wrong by one digit?
The payment system will reject it. The Luhn algorithm check catches single-digit errors automatically, so the transaction fails before it reaches your bank. You will be asked to re-enter the number or try a different payment method.
Do all credit cards have 16 digits?
Most do, but American Express uses 15 digits. Discover and Visa typically use 16. Some older or specialty cards may use different lengths, but 15 or 16 is the standard. If a card number you are looking at is significantly shorter or longer, it may not be a credit card number at all.
Is my account number the same as my card number?
No. Your account number is nine of the 16 digits (digits 7 through 15). Your full card number includes the bank identification digits at the start and the check digit at the end. The account number is what ties you to your account; the full card number is what you use to make purchases.
Why is the security code printed on the card if it is supposed to be secret?
Because it is only useful if you physically have the card. A thief who steals your card number from a data breach cannot see the security code — it is not stored in most merchant databases or transmitted through most payment systems. The code is printed on the card itself so that only someone holding the physical card can read it.