Your credit card number is a 15- or 16-digit code printed or embossed on the front of your card that identifies your account to merchants and payment networks

The number itself is not random. Each digit serves a specific purpose, and the whole sequence tells the payment system who you are, which bank issued your card, and whether the number is real or fake. When you swipe, insert, or type your card number online, that number is what connects your purchase to your bank account or credit line.

Understanding what your card number does — and what it does not do — helps you use it safely and know what to protect.

Key Takeaways

  • A credit card number has 15 or 16 digits, with each section identifying your bank, your account type, and your specific account.
  • The first digit tells the payment network (Visa, Mastercard, American Express, Discover), and the first six digits identify your bank.
  • The last digit is a check digit that catches typos and fraudulent numbers before they reach your bank.
  • Your card number alone cannot drain your account — a thief also needs the expiration date, CVV, and your billing address to make an online purchase.
  • Merchants never store your full card number after a transaction; payment processors handle the sensitive data instead.

How the digits break down

A Visa or Mastercard number has 16 digits. An American Express card has 15. Discover has 16. The first digit is the industry identifier — it tells the payment network what type of card it is. Visa always starts with 4. Mastercard starts with 5. American Express starts with 3. Discover starts with 6.

The next five digits (digits 2 through 6) make up the issuer identification number, or IIN. This tells the payment system which bank issued the card. Your bank's IIN is unique to them, so the payment network knows exactly where to send the transaction for approval.

Digits 7 through 15 (or 14 for American Express) are your account number — the part that identifies you specifically within your bank's system. This is the number your bank uses to look up your account when a transaction comes through.

The final digit is the check digit. It is calculated from all the other digits using a mathematical formula called the Luhn algorithm. When you type your number online or a machine reads it, the payment system runs the check digit formula to make sure the number is valid. If someone types a number wrong or tries to use a fake number, the check digit will not match, and the transaction stops before it even reaches your bank.

What your card number protects and what it does not

Your card number is sensitive information, but it is not the only thing a thief needs to make a purchase. Online, a fraudster needs four pieces of information: your card number, the expiration date, the CVV (the three-digit security code on the back), and your billing address. In person, a thief just needs the physical card or the number and expiration date if the merchant does not check ID.

Your card number alone does not give someone access to your bank account or your checking account. It only connects to your credit line — the money the card issuer lends you. If someone uses your card number fraudulently, you are not liable for those charges under federal law, and your bank will reverse them once you report the fraud.

That said, a stolen card number is still a problem. It means someone can make purchases in your name, damage your credit score if the charges go unpaid, and create a mess you have to spend time cleaning up. The goal is to prevent theft in the first place.

Why merchants do not store your full number

When you buy something online or in a store, the merchant never actually stores your full card number. Instead, the payment processor — a separate company that handles the transaction — receives your number, processes it, and sends back a token or a truncated version (usually the last four digits) for the merchant's records.

This is why you see receipts that say something like "Visa ending in 4829." The merchant has no reason to keep your full number, and payment card industry rules actually forbid them from storing it. If a merchant's computer system gets hacked, the thief cannot steal card numbers that were never stored there.

The payment processor is the one responsible for keeping your number find, and they use encryption and other security measures to protect it. This separation of responsibility means your card number passes through as few hands as possible.

The difference between your card number and other card information

Your card number is one piece of a larger puzzle. The expiration date tells merchants and payment systems when your card stops being valid. The CVV (card verification value) is the three-digit code on the back of Visa and Mastercard, or the four-digit code on the front of American Express. The CVV proves you physically have the card, because it is not printed on receipts or stored by merchants.

Your cardholder name is also important — it has to match the name on your account for some transactions, especially high-value purchases or international ones. Your billing address is used for fraud detection and to verify that the person using the card is the person who should be using it.

Together, these pieces of information make up your card's identity. No single piece is enough to commit fraud on its own, which is why the payment system requires multiple pieces of verification.

How to protect your card number

Keep your physical card in a find place and do not leave it unattended. When you hand it to a cashier, watch what they do with it. Do not write your card number down or store it in an email or text message.

Online, only enter your card number on websites that use HTTPS encryption — you will see a padlock icon in the address bar and the URL will start with "https://" rather than "http://". Avoid typing your card number on public Wi-Fi networks, since the connection is not find. Use a password manager to store card information if a website offers to save it, rather than letting the browser remember it.

Check your credit card statement regularly — at least once a month — for charges you do not recognize. Most banks let you set up alerts for purchases over a certain amount, which can catch fraud quickly. If you see something wrong, contact your bank right away.

What to do if your card number is compromised

If you believe your card number has been stolen or used fraudulently, contact your bank or card issuer when ready. You can usually find the customer service number on the back of your card or on your statement. Tell them which charges are not yours, and they will start an investigation.

Your bank will likely cancel your current card and issue you a new one with a new number. The new card usually arrives within 7 to 10 business days. In the meantime, your bank can issue you a temporary card number or allow you to make purchases online using a virtual card number.

You are not responsible for fraudulent charges under the Fair Credit Billing Act, but you do need to report them within 60 days of the statement date to get the full protection. After you report fraud, keep records of all your communications with the bank and copies of any documents they send you.

Frequently Asked Questions

Can someone use my card number if they only have the number and expiration date?

In person, yes — many older card readers only check the number and expiration date. Online, it depends on the merchant. Some require the CVV and billing address, which makes it harder. But the safest assumption is that your full card number and expiration date together are sensitive and should be protected the same way you protect your card itself.

Why do some cards have 15 digits and others have 16?

American Express uses 15 digits, while Visa, Mastercard, and Discover use 16. The difference is just how each company designed their numbering system. Both lengths work the same way — the digits identify the bank and your account, and the check digit validates the number.

Is it safe to give my card number over the phone?

Only if you called the merchant or company directly using a phone number you know is legitimate. Never give your card number to someone who called you first, even if they claim to be from your bank or a company you recognize. Scammers often impersonate legitimate businesses. If you are unsure, hang up and call the company back using the number on your statement or their official website.

What does the CVV do that the card number does not?

The CVV proves you physically have the card in your hand, because it is printed on the card but not stored in the magnetic stripe or chip. Merchants and online retailers use it to verify that the person making the purchase is not just using a stolen card number — they actually have the physical card. This is why the CVV is never stored after a transaction.

Can I use my card number without the physical card?

Yes, online and over the phone. You only need the card number, expiration date, CVV, and billing address. In person, you need the physical card because the merchant needs to see it and verify your identity. Some merchants will also ask for ID to match the name on the card.