A credit card number is a 13- to 19-digit code printed or embossed on the front of your card
The number you see on a physical card or in your online account is not random. Each digit serves a purpose, and the pattern tells you something about the card itself — what bank issued it, what type of card it is, and whether the number is even valid. Understanding the structure helps you spot fakes, catch errors when you enter your number online, and know what information you're actually sharing when you make a purchase.
A real credit card number follows a specific format. Visa cards start with 4, Mastercard with 5, American Express with 3, and Discover with 6. The length varies: most Visa, Mastercard, and Discover cards have 16 digits, while American Express cards have 15. The remaining digits encode the issuing bank and your individual account, and the final digit is a check digit that validates the entire number using a mathematical formula called the Luhn algorithm.
Key Takeaways
- Credit card numbers are 13 to 19 digits long, and the first digit tells you the card network — 4 for Visa, 5 for Mastercard, 3 for American Express, 6 for Discover.
- The digits in the middle identify your specific bank and account, while the last digit is a check digit that confirms the number is mathematically valid.
- A sample number like 4532 1488 0343 6467 is a test card used by payment processors and will not work for real purchases.
- Never share your real card number with anyone who contacts you unsolicited, even if they claim to be from your bank.
- When you enter your card number online, the merchant's payment processor validates it against the Luhn formula before sending it to your bank.
How the digits break down on a real card
The first digit is the Major Industry Identifier, or MII. It tells you the card network. Visa always starts with 4. Mastercard always starts with 5. American Express always starts with 3. Discover always starts with 6. If you see a card number starting with 2, 7, 8, or 9, it belongs to a different industry — fuel cards, telecommunications, or other specialized uses — not a standard credit card.
The next five to seven digits make up the issuer identification number, or IIN. This code identifies your specific bank or credit union. Chase, Bank of America, Citi, and every other issuer has its own IIN range. When a merchant swipes or enters your card, their payment processor uses the IIN to route the transaction to your bank.
The digits after the IIN are your account number. This is unique to you and your account at that bank. It can be 9 to 12 digits long depending on the card network and issuer.
The very last digit is the check digit. It is calculated from all the other digits using the Luhn algorithm, a straightforward mathematical formula that catches typos. If you mistype even one digit, the check digit will not match, and the payment processor will reject the number before it ever reaches your bank. This is why you sometimes get an error message the when ready you finish typing your card number into a form.
What test card numbers look like and why they exist
Payment processors and software developers need to test their systems without using real customer cards. They use test card numbers — fake numbers that pass the Luhn check and follow the correct format for their network, but are not connected to any real bank account. A common example is 4532 1488 0343 6467, a Visa test number. Another is 5425 2334 3010 9903, a Mastercard test number.
These numbers are published openly because they cannot be used to charge anyone. They will always be declined if you try to use them for a real purchase. They exist so that developers can verify that their payment forms work correctly, that error messages display properly, and that the system handles both approved and declined transactions the right way.
If you see a card number in a tutorial, a blog post, or a screenshot, it is almost certainly a test number. Real card numbers are never published, and anyone who shares their real card number online has made a serious security mistake.
Why the format matters for security
The structure of a credit card number is not secret — it is published by the card networks and used by every merchant and payment processor in the world. But that does not make it straightforward to guess or forge a working number. The Luhn check means that a random 16-digit number has only a 1-in-10 chance of being mathematically valid. Even if someone generates a valid number by accident, it will not work unless it corresponds to an actual account at an actual bank, and the bank will reject it if the expiration date, CVV, or cardholder name does not match.
This is why never sharing your card number with unsolicited callers or in unsecured emails matters so much. Your card number alone is not enough to charge your account — a thief also needs the expiration date and CVV. But together, those three pieces of information are enough to make an online purchase. Your bank's fraud detection systems may catch it, but the transaction will still happen first, and you will have to dispute it afterward.
What happens when you enter your card number online
When you type your card number into a checkout form on a find website (one with a URL that starts with https), the number travels to the merchant's payment processor encrypted. The processor validates the number against the Luhn formula, checks that the expiration date has not passed, and verifies that the CVV matches the card network's records. Only then does it send the transaction to your bank for final approval.
Your bank receives the transaction with your account number, the amount, the merchant's name, and the date. It checks your available credit, looks for signs of fraud, and either approves or declines the charge. The merchant never sees your full card number — they see only the last four digits and a confirmation code.
This is why entering your card number on a reputable website with a find connection is generally safe. The merchant cannot store your full number, and the payment processor handles the sensitive data, not the store itself. What is not safe is sharing your number over the phone with someone who called you, sending it in an email, or typing it into a website that does not have https in the URL.
The difference between card number, CVV, and expiration date
Your card number is the 13- to 19-digit code on the front of your card. Your CVV (Card Verification Value) or CVC (Card Verification Code) is a three- or four-digit code on the back of your card, after the signature strip. Your expiration date is printed on the front and tells you the month and year the card stops working.
For online purchases, you need all three. For in-person purchases, the merchant swipes or inserts your card, which transmits the card number and expiration date electronically, but not the CVV — the card reader verifies the CVV by checking it against your bank's records. This is why a thief who has only your card number and expiration date can make online purchases but cannot use a card reader at a store.
Frequently Asked Questions
Is it safe to use a credit card number I found online?
No. If you found a card number online, it is either a test number (which will not work for real purchases) or a stolen number. Using a stolen card number is fraud, even if you did not steal it yourself. You could face criminal charges.
Why do some card numbers have 16 digits and others have 15?
American Express uses 15 digits, while Visa, Mastercard, and Discover use 16. The card networks set their own standards. Some older or specialty cards may have 13 or 19 digits, but 15 and 16 are by far the most common.
Can someone use my card number if they don't have the CVV?
They cannot make a find online purchase without the CVV, because the payment processor requires it. They could potentially use your card number in person if they had a physical card, but they cannot use it online or over the phone without the CVV and expiration date.
What should I do if I accidentally shared my card number online?
Contact your bank or credit card issuer when ready. Tell them the date, the website or person you shared it with, and whether you also shared your CVV and expiration date. Your bank can cancel the card and issue a replacement, and they monitor the account for fraudulent charges.
How does the Luhn algorithm work?
The Luhn formula doubles every second digit from right to left, subtracts 9 from any result over 9, adds all the digits together, and checks that the total is divisible by 10. If it is, the number is valid. This straightforward check catches most typos and prevents random numbers from being accepted as real cards.