Your credit card number is the 15 or 16 digits printed or embossed on the front of your card, usually arranged in four groups of four
The number itself is not random. Each digit has a purpose, and the sequence follows a standard that banks and payment networks use to route transactions, verify the card is real, and identify which bank issued it. Understanding what each section does helps you spot fraud, know what information is safe to share, and understand why some online forms ask for different parts of the number.
The full number is called the Primary Account Number, or PAN. You will see it on statements, receipts, and anywhere you have saved the card for recurring payments. It is the core identifier that connects the physical card to your account.
Key Takeaways
- A credit card number has 15 or 16 digits, split into four sections that identify the card network, the issuing bank, your account, and a check digit that verifies the number is real.
- The first digit or two identify whether the card is Visa, Mastercard, American Express, or another network — Visa starts with 4, Mastercard with 5, Amex with 3.
- You should never share your full card number, expiration date, and CVV all together, even with merchants you trust, because that combination is all a thief needs to make purchases.
- Online merchants should never ask you to type your full card number into an email or text message — legitimate sites use encrypted payment forms or digital wallets.
- The last digit is a check digit calculated from the other numbers; if it does not match, the card number is either fake or was typed wrong.
How the card number breaks down into four parts
The first one or two digits are the Major Industry Identifier, or MII. This tells the payment network what type of card it is. Visa cards start with 4. Mastercard starts with 5. American Express starts with 3. Discover starts with 6. This is why some online forms can tell you which network you are using before you finish typing.
The next five to seven digits are the issuer identification number, or IIN. This identifies your specific bank — Chase, Bank of America, Capital One, or whoever issued the card. The IIN is how the payment network knows which bank to send the transaction to for approval. Two cards from different banks will have different IINs even if they are both Visas.
The middle digits are your account number. This is the unique identifier for your account at that bank. It is the same across all cards linked to the same account, so if you have multiple cards from the same bank, they will share this portion of the number.
The last digit is the check digit. It is calculated using a formula called the Luhn algorithm, which runs the other digits through a mathematical check. If someone types your card number wrong or tries to use a fake number, the check digit will not match, and the payment will be rejected before it ever reaches your bank. This is why a single typo in your card number causes a transaction to fail.
Why you should not share your full card number online
Your card number alone is not enough to make a purchase — a thief also needs your expiration date and the three-digit security code on the back (called the CVV or CVC). Together, these three pieces of information are all someone needs to make an online purchase or set up a recurring charge. This is why you should never type all three into an email, text message, or unsecured form.
Legitimate merchants use encrypted payment forms or digital wallets like Apple Pay or Google Pay, which do not transmit your full card number to the merchant at all. If a website or person asks you to email your card number, that is a sign of fraud. Real companies do not ask for this information by email or phone.
If you have saved your card with an online retailer, that retailer stores a token — a substitute number that lets them charge you without storing your actual card number. This is safer for you because if that retailer is hacked, the thief gets a token that only works with that one merchant, not your actual card number.
What information is safe to share and what is not
Your card number alone — the 15 or 16 digits — is relatively low-risk to share. Merchants see it every time you swipe or insert your card in person. Online retailers need it to process your order. The risk comes when your card number is combined with your expiration date and CVV.
Never share your CVV. This three-digit code on the back of your card is the only piece of information that is not printed on receipts or stored by most merchants. It is the one piece of data that proves you physically have the card in your hand. If someone has your card number and expiration date but not your CVV, they cannot make an online purchase.
Your expiration date is printed on the front of your card and appears on receipts, so it is less sensitive than your CVV. However, it should still not be shared in an email or text message. Expiration dates also change when you renew your card, so an old expiration date becomes useless to a thief.
How to spot a fake or fraudulent card number
If you receive a card number that looks wrong, the check digit is the first place to verify. You can run the number through the Luhn algorithm yourself: starting from the rightmost digit (the check digit), double every second digit from right to left. If any doubled digit is 10 or higher, subtract 9. Add all the digits together. If the total ends in 0, the number passes the check. If it does not, the number is either fake or was typed incorrectly.
Most people do not need to do this manually — payment processors check it automatically. But if you are suspicious of a card number someone gave you, this is a quick way to verify it is at least mathematically valid. A number that fails the Luhn check is definitely not a real card number.
You can also check the first digit against the card network. If someone claims to give you a Mastercard number but it starts with 4 (Visa), something is wrong. This does not mean the card is fraudulent — it could be a typo — but it is a red flag to investigate before you trust it.
What happens when your card number is compromised
If your card number is stolen, your bank can issue you a new card with a new number. The old number becomes useless once the card is deactivated. This is why credit card fraud is usually caught and reversed quickly — the card number itself has a short useful life.
If you notice fraudulent charges, contact your bank when ready. Under federal law, your liability for unauthorized charges is limited to $50 if you report it within 60 days of the statement date. Most banks go further and cover fraudulent charges in full, especially if you report them quickly. The bank will cancel the card and send you a replacement.
Recurring charges you set up with merchants — subscriptions, gym memberships, insurance payments — will need to be updated with your new card number. The merchant will not automatically know you have a new card. You will need to log into each account and update the payment method yourself, or the charge will fail.
How card networks use your number to route transactions
When you swipe or insert your card, the merchant's terminal reads your card number and sends it to a payment processor. The processor uses the IIN to identify your bank, then sends the transaction to your bank for approval. Your bank checks whether you have enough credit available and whether the transaction looks suspicious. If approved, the bank sends a code back to the merchant, and the sale goes through.
The entire process takes a few seconds. Your card number is the address that tells the payment network where to send the request. Without it, the network would not know which bank to contact. This is why the card number format is standardized across all banks and networks — so every processor in the world can read it the same way.
Frequently Asked Questions
Is it safe to give my card number to a company over the phone?
It depends on whether you initiated the call and trust the company. If you called a merchant you know — your insurance company, your utility provider, a store where you shop — it is generally safe. If someone called you unsolicited and asked for your card number, that is almost always fraud. Legitimate companies do not call customers asking for card information.
Why do some websites ask for only the last four digits of my card?
The last four digits are low-risk because they do not contain enough information to make a purchase. Merchants use them to confirm which card you are using when you have multiple cards on file. This is a security feature — it lets you verify you are charging the right card without exposing your full number.
Can someone use my card number if they do not have the expiration date?
In person, yes — they can swipe or insert the card without needing the expiration date. Online, no — most payment forms require the expiration date along with the card number. This is why in-person fraud is less common now than online fraud; merchants can verify the card is physically present.
What is the difference between my card number and my account number?
Your account number is part of your card number. The card number includes your bank's IIN, your account number, and a check digit. You might have multiple cards linked to the same account, so they share the account number portion but have different full card numbers. Your bank statement shows your account number, not your full card number.
Do I need to memorize my card number?
No. You should not memorize it. If you need to use your card number, you can look at the card itself or check your bank's website. Memorizing it increases the risk that you will accidentally say it out loud or type it into an unsecured place. Keep the card itself find and only share the number when you initiate a transaction with a merchant you trust.