A credit card has four separate groups of numbers, and each one does a different job

The numbers on your credit card are not random. The longest string — usually 16 digits for Visa and Mastercard, 15 for American Express — is your account number. It identifies your specific card and account to the bank. The smaller groups tell the card reader who issued it, verify the card is real, and set an expiration date.

Understanding what each number means helps you spot fraud, know what information is safe to share online, and understand why a cashier or website might reject your card even when you know the balance is fine.

Key Takeaways

  • The main account number is 15 or 16 digits long and uniquely identifies your card to the issuing bank.
  • The first digit or two identify which company issued the card — Visa, Mastercard, American Express, or another network.
  • The expiration date tells merchants and ATMs when the card stops working, usually four to five years after issue.
  • The three or four-digit security code on the back is not stored in the card's magnetic stripe, so online merchants cannot steal it from a data breach of older transactions.
  • Never share your full account number or security code with anyone except the card issuer or a merchant you initiated contact with.

The account number: the 15 or 16 digits on the front

This is the number that matters most. It is unique to your card and your account. When you swipe, insert, or tap your card, this number is what the merchant's terminal sends to your bank to check whether the transaction is real and whether you have enough credit available.

The first one or two digits are the issuer identification number (IIN), also called the bank identification number (BIN). Visa cards start with 4. Mastercard starts with 5. American Express starts with 3. Discover starts with 6. This tells the merchant's machine which bank to contact to approve the charge.

The remaining digits are your unique account identifier. No two cards have the same full number. This is why you need to update your payment information if your card is replaced — even though it is the same account, the new physical card has a new account number.

The expiration date: when your card stops working

Your card has a month and year printed on the front, usually in the bottom right. This is when the card physically expires. After that date, the card will not work at any merchant, ATM, or online store, even if you still have available credit.

Banks issue new cards before expiration — usually 30 to 60 days before the date on your old card. You should receive the replacement in the mail. If you do not, contact your bank. The new card will have a new account number and a new expiration date, typically four to five years out.

The expiration date is not a security feature. Merchants see it and use it to reject obviously old cards, but it is printed on the front where anyone can read it. This is why it is safe to share with a merchant — they need it to process your payment.

The security code: the 3 or 4 digits on the back

On the back of your card, usually in the signature strip area, is a three-digit number (American Express uses four digits on the front). This is the Card Verification Value (CVV) or Card Security Code (CSC). It is a security feature, not part of your account number.

The security code is not stored in your card's magnetic stripe or chip. This means that if a merchant's database is hacked and old transaction data is stolen, the thief gets the account number but not the security code. Online merchants ask for it because they cannot read the chip or stripe — they need proof that you physically have the card in your hand.

Never share your security code with anyone except a merchant you are paying directly, or your bank if they call you. Legitimate companies will never ask for it by email or phone. If someone calls claiming to be from your bank and asks for the security code, hang up and call your bank's customer service number on the back of your card.

Why merchants sometimes reject your card even when you have money

A declined transaction usually means one of three things: the account number was entered wrong, the expiration date has passed, or the security code did not match. Less often, it means your bank flagged the transaction as potentially fraudulent and blocked it temporarily.

If your card is declined online, double-check that you entered the account number, expiration date, and security code exactly as they appear on the card. A single wrong digit will cause a rejection. If the card is expired, you will need to wait for your replacement or contact your bank to request a new one.

If you entered everything correctly and the card is not expired, call your bank's customer service number on the back of the card. They can tell you whether the transaction was blocked by fraud detection or whether there is another issue with the account.

What information is safe to share and what is not

Safe to share: your account number (the 16 digits), your expiration date, and your name as it appears on the card. Merchants need these to process your payment, and they are printed on the front where anyone can see them.

Never share: your security code (the 3 or 4 digits on the back) unless you are paying a merchant directly. Never share the PIN you use at ATMs. Never share your full card details with anyone who contacted you first — if your bank needs to verify something, you call them using the number on the back of your card.

If you accidentally share your security code or suspect your card number has been stolen, call your bank immediately. They can cancel the card and issue a replacement. Most banks offer fraud protection, meaning you are not responsible for unauthorized charges if you report them promptly.

The difference between card numbers and account numbers

These terms are often used interchangeably, but they are slightly different. Your card number is the 15 or 16 digits on the physical card in your wallet. Your account number is the underlying account at the bank, which may have multiple cards attached to it.

If your card is lost or stolen and the bank issues a replacement, you get a new card number but the same account. Your credit limit, balance, and payment history stay the same. This is why updating your card information with your regular merchants is important — the old card number will stop working, but the account continues.

Frequently Asked Questions

Why do different card companies use different numbers of digits?

Visa and Mastercard use 16 digits because that length provides enough unique combinations for billions of cards while staying short enough to be practical. American Express uses 15 digits. Discover uses 16. The difference is historical — each network set its own standard decades ago, and changing it now would require updating millions of merchants' systems.

Is it safe to use my credit card online if I can see the full number?

Yes, as long as you are on a secure website (look for "https://" and a lock icon in the address bar). The merchant needs your account number and expiration date to process the payment. The security code is the protection — it proves you have the physical card. Never enter your security code on a website unless you initiated the transaction.

What happens if I memorize my card number and someone steals my card?

The card itself becomes useless immediately once you report it stolen — the bank cancels it and the account number stops working. Your memorized number is now invalid. The thief cannot use the physical card or the number you remember. This is why calling your bank right away matters.

Can I use my credit card if the expiration date has passed but I still have available credit?

No. The card will be rejected at every merchant and ATM. You must wait for your replacement card to arrive in the mail, or contact your bank to request an expedited replacement. Some banks charge a fee for rush delivery, but standard replacement is free.

Why do online merchants ask for the security code if they already have my account number?

Because they cannot read your card's chip or magnetic stripe through the internet. The security code proves you physically have the card in your hand. Without it, a thief who stole your account number could make purchases online. The code is the verification that you are the one making the transaction.