The anatomy of a credit card number

A credit card has 13 to 19 digits printed or embossed on the front. Each number serves a specific purpose in the card's identity and security. The card issuer (your bank or credit union), the card network (Visa, Mastercard, American Express, Discover), and payment processors all rely on these digits to route transactions and verify the card is genuine.

The numbers are not random. They follow a mathematical formula called the Luhn algorithm, which allows payment systems to catch typos or fraud before a transaction reaches the bank. If you enter a card number incorrectly, the system can reject it immediately without contacting your issuer.

Understanding what each section of numbers does helps you protect your card, spot fraud, and know what information is actually sensitive when you share it online or over the phone.

Key Takeaways

  • The first digit or first six digits identify the card network and issuer; Visa cards start with 4, Mastercard with 5, American Express with 3, and Discover with 6.
  • The middle digits are your account number, unique to you and tied to your specific account at the bank.
  • The last digit is a check digit that validates the entire number using a mathematical formula; it catches most typos automatically.
  • The three or four digits on the back (CVV or CVC) are a separate security code not stored in the card's magnetic stripe or chip, making them harder to steal in bulk.
  • Expiration date and cardholder name are printed on the card but are not part of the 13–19 digit sequence.

The first digit: card network identifier

The very first digit tells you which payment network issued the card. This is called the Major Industry Identifier (MII). Visa always starts with 4. Mastercard always starts with 5. American Express always starts with 3. Discover always starts with 6. Diners Club starts with 3 (which overlaps with Amex, but the full number pattern differs).

This digit is public information. You can see it on your card, and merchants see it when you swipe or insert your card. It does not identify you personally — it only tells the payment system which network to route your transaction through.

The first six digits: issuer identification number

The first six digits together form the Issuer Identification Number (IIN), also called the Bank Identification Number (BIN). These six digits tell the payment network which bank or credit union issued your card. Chase, Bank of America, Citi, and every other issuer has its own set of IINs.

When you make a purchase, the merchant's payment processor uses the IIN to route the transaction to your specific bank. The processor does not contact your bank directly; it sends the transaction to the card network (Visa, Mastercard, etc.), which then routes it to your issuer based on the IIN.

The IIN is semi-public. Merchants and payment processors see it, but it does not uniquely identify your account — millions of cardholders may share the same IIN if they bank at the same institution and hold the same type of card.

The middle digits: your account number

After the first six digits, the remaining digits (up to the last one) make up your account number. This is the part that actually identifies your specific account at your bank. No two cardholders at the same bank have the same account number, even if they hold the same type of card.

Your account number is sensitive. If someone has your full card number, they can attempt to make purchases or set up recurring charges. This is why you should never type your full card number into an unsecured website, read it aloud in public, or write it down where others can see it.

The account number portion varies in length depending on the card network. Visa and Mastercard typically have 15 or 16 total digits, so the account number is 9 or 10 digits long. American Express has 15 total digits, making the account number 9 digits. Discover has 16 total digits.

The last digit: the check digit

The final digit is called the check digit or checksum. It is calculated from all the other digits using the Luhn algorithm, a mathematical formula that payment systems use to validate the card number before processing any transaction.

Here is how it works in practice: when you enter your card number online or a merchant swipes your card, the payment terminal runs the Luhn algorithm on the digits you provided. If the check digit does not match what the algorithm produces, the transaction is rejected immediately. You never reach your bank. The system knows the number is either fake or mistyped.

This check digit catches most data-entry errors automatically. It does not prove the card is legitimate or that you own it — it only proves the number follows the correct mathematical pattern. A stolen card number will still pass the Luhn check because the thief has all the digits, including the correct check digit.

The CVV or CVC: the security code on the back

The three or four digits printed on the back of your card (or the front, for American Express) form the Card Verification Value (CVV) or Card Verification Code (CVC). Visa and Discover call it CVV2. Mastercard calls it CVC. American Express calls it CID.

This code is not part of the 13–19 digit sequence. It is a separate security feature. Unlike the card number, the CVV is not stored in the card's magnetic stripe or chip. This means a thief who steals your card number from a data breach cannot use the CVV — they would have to physically see your card or have access to a database that stores CVVs, which legitimate merchants are not allowed to keep.

When you make an online purchase, the merchant asks for your CVV to verify you have the physical card in your hand. If you are making a phone order, you provide it over the phone. The CVV is transmitted to the merchant but should not be stored in their system after the transaction completes. If a merchant asks you to email your CVV or write it on a check, that is a red flag — legitimate businesses do not ask for it that way.

Why card length varies: network differences

Not all credit cards have the same number of digits. Visa and Discover cards have 16 digits. Mastercard cards have 16 digits. American Express cards have 15 digits. Diners Club cards have 14 digits. Some older or specialty cards may have 13 digits.

The variation exists because each card network designed its numbering system independently, and they have never standardized on a single length. The payment system can handle any length within the valid range, so there is no practical reason for you to memorize the exact count. What matters is that your card number is consistent — the same card always has the same number of digits.

If you are entering your card number online and the form rejects it, the most common reason is a typo, not a mismatch between your card length and the form's expectations. Modern payment forms accept all valid card lengths.

What information is actually sensitive

Your full card number is sensitive and should be treated as a secret. If someone has all 16 digits, they can make online purchases or set up recurring charges without your permission. However, the first six digits (the IIN) are not sensitive — merchants see them every time you use your card.

Your CVV is sensitive, but only in combination with your card number and expiration date. A CVV alone is useless. Your expiration date is printed on the front of your card and is semi-public — merchants see it when you hand them your card.

Your name is printed on the card and is public. Your account number (the middle digits) is sensitive in the same way your full card number is — it identifies your specific account.

When you shop online, reputable websites use encryption (look for "https://" in the address bar and a padlock icon) to protect your card number in transit. They should never ask you to email your card details or provide your CVV outside of the payment form itself.

Frequently Asked Questions

Can someone use my card number if they only have the first six digits?

No. The first six digits (the IIN) identify your bank and card type, but they do not identify your specific account. Millions of cardholders may share the same first six digits. A thief would need the full card number, including the account number and check digit, to attempt a purchase.

Is it safe to give my card number to a merchant over the phone?

It depends on the merchant. Established businesses with phone-order systems (airlines, hotels, mail-order companies) have secure processes for handling card numbers. Never provide your card number to someone who called you unsolicited. If you want to make a purchase, hang up and call the merchant's official customer service number yourself.

What does it mean if my card number is declined at checkout?

The most common reason is a typo in the card number or expiration date. The Luhn algorithm caught an error. Other reasons include the card being expired, the card being reported lost or stolen, insufficient funds, or the merchant's payment processor being down. Contact your bank if the card was entered correctly and you know it is active.

Why do I need to provide my CVV if the merchant already has my card number?

The CVV proves you have the physical card in your hand. A thief who steals your card number from a data breach does not have the CVV because it is not stored in the card's chip or stripe. Requiring the CVV for online purchases adds a layer of protection, though it is not foolproof.

Can I use my card number without the expiration date or CVV?

In person, yes — you can swipe or insert your card without providing either. Online, most merchants require the expiration date and CVV for security. Some merchants, especially those processing recurring charges, may store your expiration date but should never store your CVV. If your card is compromised, you can call your bank to cancel it and receive a new one with a different number and expiration date.