Your Visa card number is a 16-digit code printed on the front of your card that identifies your account and bank
The number itself is not random. Each digit or group of digits tells your bank, the payment network, and merchants something specific about your account. Understanding what those digits mean helps you spot fraud, know what information is actually sensitive, and use your card safely online and in stores.
The 16 digits break into four groups of four. The first digit is always 4 on a Visa card — that single number tells every payment system in the world that you are using Visa, not Mastercard or American Express. The remaining 15 digits identify your specific bank account within the Visa network.
Key Takeaways
- The first digit of a Visa card is always 4, which identifies the card brand to payment systems.
- The next five digits identify your bank and the type of account you hold with them.
- The last digit is a check digit that catches typos and fraud attempts, calculated from the other 15 digits.
- Your card number alone cannot be used to withdraw money from your account — the CVV, expiration date, and cardholder name are also required for online purchases.
- Merchants and payment processors should never store your full card number after a transaction is complete.
How the 16 digits are organized
After the first digit (4 for Visa), digits 2 through 6 identify your bank and the type of account. A bank might use one range of numbers for personal checking cards, another for business cards, and another for student cards. This five-digit block tells Visa's computers which institution issued your card and what category of account it is.
Digits 7 through 15 are your individual account number within that bank. This is the part that ties the card to your specific checking or savings account. Two people at the same bank will have the same first six digits but different digits in this section.
The 16th and final digit is called the check digit. It is calculated using a mathematical formula called the Luhn algorithm, which uses the first 15 digits to produce a number that catches most typos and fraudulent card numbers. If someone types your card number wrong by even one digit, the check digit will not match, and the payment system will reject it when ready.
What information is actually sensitive
Your card number by itself is less sensitive than many people think. Merchants and payment processors see your full 16 digits during a transaction, but they are not supposed to store it afterward. If a store's database is hacked, thieves get the card number but cannot use it without two other pieces of information: the CVV (the three-digit security code on the back of your card) and the expiration date.
The CVV is the real security tool. It is not encoded in the card number and is not stored in the magnetic stripe or chip. It exists only on the physical card and in your bank's records. A thief who steals your card number from a database cannot make an online purchase without the CVV. For in-person purchases, the merchant never needs the CVV — only the card number and expiration date.
Your cardholder name is also required for online purchases. Together, the card number, CVV, expiration date, and name form the minimum set of information needed to charge your account. If any one of these is missing or wrong, the transaction fails.
Why your card number changes when you get a new card
When your card expires or your bank issues a replacement, you receive a new 16-digit number even though you still have the same bank account. The first six digits might stay the same (same bank, same account type), but your bank assigns a new individual account number in digits 7 through 15, and the check digit recalculates.
This happens because card numbers are tied to the physical card itself, not to your account. Your bank account is a separate thing from your card number. You can have multiple cards linked to the same account, and each one will have its own unique 16-digit number. When a card is compromised or expires, issuing a new number is simpler and faster than changing your account number, which would require updating every automatic payment and recurring subscription you have.
How to protect your card number
Do not share your full card number, expiration date, and CVV together with anyone unless you are making a purchase you initiated. If a business calls you asking for this information, hang up and call the number on the back of your card instead — legitimate companies do not ask for your CVV over the phone.
Online, only enter your card number on websites with a URL that starts with "https://" (the "s" means the connection is encrypted). Look for a small padlock icon in the address bar. This encrypts your information in transit so it cannot be intercepted by someone on the same network.
If your card number is compromised, call your bank when ready. Most banks offer zero liability for fraudulent charges, meaning you are not responsible for purchases you did not make. Your bank will cancel the card and issue a new number, usually within 3 to 7 business days.
Card numbers and payment networks
Your Visa card number works only within the Visa network. When you swipe or insert your card at a store, the merchant's terminal sends your card number to Visa's payment network, which routes it to your bank. Your bank checks whether the purchase is legitimate and whether you have enough money or credit available. The bank then sends approval or denial back through Visa to the merchant.
This is why a card number alone does not let someone withdraw cash from an ATM or transfer money from your account. ATMs and online banking require a PIN (personal identification number), which is separate from your card number and known only to you and your bank. A thief with your card number cannot access your account without the PIN.
What happens if your card number is used fraudulently
If someone uses your card number to make a purchase without your permission, contact your bank as soon as you notice. Most banks have a fraud department that works 24 hours a day. You can usually report fraud by calling the number on the back of your card or through your online banking portal.
Your bank will investigate the charge and typically reverse it within 1 to 3 business days. During the investigation, the charge may still appear on your statement, but it will be marked as disputed. Once the bank confirms it was fraudulent, the charge is removed and you are credited. You are not responsible for paying fraudulent charges on a credit card, and most debit card issuers also offer fraud protection, though the rules vary.
Frequently Asked Questions
Can someone use my card number if they don't have the CVV?
Not for online purchases — the CVV is required. For in-person transactions, a thief with only your card number and expiration date could potentially make a purchase at a store that does not check the CVV, though most modern terminals do. Your best protection is to monitor your statements and report any charge you do not recognize.
Is it safe to give my card number to a business over the phone?
Only if you called them first using a number you know is legitimate. Never give your card number to someone who called you, even if they claim to be from your bank or a company you do business with. Legitimate businesses do not ask for your CVV over the phone, and your bank will never call asking for it.
What does the first digit of my card number tell me?
The first digit 4 identifies your card as Visa. Mastercard numbers start with 5, American Express with 3, and Discover with 6. This single digit tells payment systems which network to route your transaction through.
Do I need to memorize my card number?
No. Most people do not memorize their card number, and you should not write it down or store it in an unencrypted note on your phone. If you need your card number for a purchase, look at the physical card or log into your bank's website or app, where the number is stored securely.
What if I see charges on my statement from a card number I don't recognize?
Contact your bank when ready. It is possible your card number was used fraudulently, or the charge might be from an online merchant that uses a different business name on statements than on their website. Your bank can tell you which merchant made the charge and help you dispute it if it was unauthorized.