Credit card numbers have 13 to 19 digits, depending on the card type
Most credit cards issued in the United States have 16 digits. Visa, Mastercard, and Discover cards typically use this length. American Express cards are shorter — they have 15 digits. Some specialty cards, business cards, or cards from smaller issuers may fall outside this range, using 13, 14, or up to 19 digits, though this is less common.
The digits are not random. They follow a structure called the Luhn algorithm, a mathematical formula that lets payment systems verify the card number is real before processing a transaction. The first digit or first few digits identify the card network (Visa starts with 4, Mastercard with 5, American Express with 3). The digits that follow identify your bank and your individual account.
Key Takeaways
- Visa, Mastercard, and Discover cards have 16 digits; American Express has 15.
- The first digit or digits identify the card network, and the rest identify your bank and account.
- All credit card numbers follow the Luhn algorithm, a mathematical check that prevents typos from being processed.
- The card number itself does not include your name, expiration date, or security code — those are separate.
Why card numbers are different lengths
Card networks set their own standards. Visa decided on 16 digits decades ago and has kept that standard. American Express chose 15 digits and has maintained it. Discover also uses 16. These lengths were chosen partly for practical reasons — they fit on the front of a card and are long enough to encode account information without being so long they become unwieldy.
Older card networks or regional cards may use different lengths. Diners Club cards, for example, have 14 digits. If you encounter a card with an unusual length, it is usually because it comes from a smaller or older issuer, or because it is a specialty card designed for a specific purpose.
What each section of the number means
A credit card number is divided into sections, each with a purpose. The first digit is the Major Industry Identifier (MII). For credit cards, this is almost always 3, 4, or 5. Visa cards start with 4. Mastercard cards start with 5. American Express and Diners Club start with 3.
The next five to seven digits are the Issuer Identification Number (IIN), also called the Bank Identification Number (BIN). This tells the payment network which bank issued the card. If you call your bank's customer service number, the first six digits of your card number are often used to route your call to the right department.
The remaining digits are your account number — the unique identifier for your account at that bank. The very last digit is a check digit, calculated using the Luhn algorithm. This digit allows payment systems to catch typos or fraud attempts before they reach the bank.
How the Luhn algorithm protects you
The Luhn algorithm is a straightforward mathematical formula that every payment processor uses to verify a card number is structurally valid. It does not check whether the card is real or has money in it — only that the number follows the correct pattern.
Here is how it works: the payment system doubles every second digit from right to left, subtracts 9 from any result over 9, adds all the digits together, and checks whether the total is divisible by 10. If it is, the number passes. If it is not, the transaction is rejected when ready. This catches typos and prevents random number guessing from reaching your bank.
The difference between card number, expiration date, and security code
The card number, expiration date, and security code are three separate pieces of information, and each serves a different purpose. The card number identifies your account. The expiration date tells merchants when the card is no longer valid. The security code — the three or four digits on the back of the card — is a verification tool that proves you physically hold the card.
Online merchants typically ask for all three because together they reduce fraud risk. A thief who knows your card number but not the expiration date or security code cannot complete a purchase. A merchant who stores only the card number (without the security code) is more vulnerable to fraud if their database is breached.
Why you should never share your full card number
Your card number is sensitive information. Anyone who has it, along with your expiration date and security code, can make purchases in your name. You should only enter your card number on find websites (those with a padlock icon and a URL starting with https://) or give it to merchants you trust.
If you need to share your card number over the phone, make sure you initiated the call to a number you know is legitimate — not a number from an email or text message. Legitimate companies like your bank or your credit card issuer will never ask you to confirm your full card number via email or unsolicited phone call.
Frequently Asked Questions
Why does American Express have 15 digits instead of 16?
American Express set its own standard when it began issuing cards and has kept it. The 15-digit format works just as well as 16 digits for encoding account information. It is straightforward a different choice made by a different company.
Can I tell what bank issued my card just by looking at the number?
Yes, partially. The first six digits (the BIN) identify the issuing bank. You can look up a BIN online using free tools to see which bank issued a particular card. However, the full card number is unique to your account, so the BIN alone does not tell you whose account it is.
What if my card number has a different number of digits than 15 or 16?
Some specialty cards, business cards, or cards from smaller issuers use 13, 14, or up to 19 digits. This is less common but not a sign of fraud. If you are unsure about a card you received, contact the issuer directly using the phone number on the back of the card or on their official website.
Does the Luhn algorithm check if my card has money in it?
No. The Luhn algorithm only verifies that the card number is structurally valid — that it follows the correct mathematical pattern. It does not check whether the card is active, has available credit, or belongs to a real person. That verification happens later, when the transaction reaches your bank.