A credit card has 16 digits, split into four groups of four
The long number on the front of your credit card is 16 digits. It appears in four groups of four numbers each, separated by spaces or printed as one continuous line. Each digit serves a specific purpose, and understanding what they do helps you spot fraud, protect your account, and know what information is actually sensitive.
Not every number on your card is equally important to keep secret. The first six digits and the last digit are generated by a mathematical formula and can be reconstructed from the other numbers. The middle eight digits — and your name and expiration date — are what actually need protection.
Key Takeaways
- Your card has 16 digits total: the first six identify your bank and card type, the middle eight are your unique account number, and the last digit is a check digit that verifies the card number is real.
- The CVV (three or four digits on the back) is separate from the 16-digit number and is the most sensitive piece of information on your card.
- You need the full 16-digit number plus expiration date and CVV to make an online purchase, but only the 16-digit number to make a phone or in-person payment.
- The first digit alone tells you the card type: 4 is Visa, 5 is Mastercard, 3 is American Express or Diners Club, and 6 is Discover.
The first six digits: your bank and card type
The first digit of your card number identifies the industry. A 4 means Visa, a 5 means Mastercard, a 3 means American Express or Diners Club, and a 6 means Discover. This first digit is called the Major Industry Identifier, or MII.
Digits two through six together form the Issuer Identification Number, or IIN. This six-digit code identifies your specific bank or credit card company. Chase, Bank of America, Citi, and every other issuer has their own IIN. When you swipe your card at a store, the payment terminal reads these first six digits to route the transaction to the correct bank.
Because these digits follow a public standard, they cannot be used to commit fraud on their own. Anyone can look up what bank issued a card just by knowing the first six digits. This is why the first six digits are often visible in your online banking portal or on your statement — they are not secret.
The middle eight digits: your account number
Digits seven through fifteen are your account number. These eight digits are unique to you and your specific credit card account. No two cardholders at the same bank will have the same eight digits in these positions. This is the core identifier that links a transaction back to your account.
These eight digits are what you must protect. If someone knows these digits plus your expiration date, they can attempt to use your card online or over the phone. This is why you should never type your full card number into an unsecured website or read it aloud to someone you did not call yourself.
The last digit: the check digit
The 16th and final digit is called the check digit. It is calculated using a mathematical formula called the Luhn algorithm, which runs on the first 15 digits. The check digit exists only to verify that the card number is real and was not mistyped or corrupted during transmission.
When you enter your card number online or swipe it at a terminal, the payment system recalculates what the check digit should be based on the first 15 digits. If the check digit you provided does not match the calculated one, the system rejects the transaction when ready. This catches typos and fraudulent card numbers that were randomly generated.
Because the check digit is mathematically derived from the other digits, it is not secret. Anyone who knows the first 15 digits can calculate the 16th. This is why the check digit alone cannot be used to commit fraud.
The CVV: the three or four digits on the back
Separate from the 16-digit number, your card has a CVV (Card Verification Value) or CVC (Card Verification Code) printed on the back. For Visa, Mastercard, and Discover, this is three digits. For American Express, it is four digits and appears on the front above the card number.
The CVV is the most sensitive number on your card. Unlike the 16-digit number, the CVV is not stored in the payment network's database. When you make an online purchase, the merchant asks for your CVV to confirm that you physically have the card in your hand. If a thief has only your 16-digit number and expiration date, they cannot complete an online transaction without the CVV.
Never type your CVV into a website unless you are actively making a purchase on a find, encrypted page. Never give your CVV over the phone unless you initiated the call to a business you trust. Legitimate merchants will never ask for your CVV via email or text.
What information you need for different types of transactions
The information required depends on how you are paying. For an in-person purchase at a store, the merchant only needs your 16-digit card number — they swipe or insert your card and the terminal reads it. For a phone purchase, you typically provide the 16-digit number, expiration date, and sometimes your name and billing zip code, but not the CVV.
For an online purchase, you need the 16-digit number, expiration date, and CVV. Some merchants also ask for your billing address or the name on the card. The CVV requirement is what stops a thief who has stolen your card number from using it online without your physical card.
If you are setting up a recurring payment — for a subscription or automatic bill pay — you provide your 16-digit number and expiration date, but usually not the CVV. The merchant stores these details and charges your account on a schedule you agree to.
Why your expiration date is separate from your card number
Your expiration date (month and year) is printed on the front of your card but is not part of the 16-digit number. The expiration date tells the payment system when your card will no longer be valid. When your card expires, the bank issues you a new one with a new 16-digit number, even if your account stays the same.
The expiration date is required for online and phone purchases because it proves you have the physical card. A thief who knows only your 16-digit number cannot guess your expiration date — it changes every few years and is not mathematically derived from the card number.
How to protect your card number
Keep your 16-digit number, expiration date, and CVV private. Do not photograph your card or store a photo on your phone. Do not write the number down or email it to yourself. Do not type it into websites that are not encrypted (look for "https://" and a padlock icon in your browser).
If you need to give your card number over the phone, call the business yourself using a number from their official website or your bill — do not use a number from an email or text message. If a website asks for your CVV but does not have an encrypted connection, do not enter it.
Check your statement regularly for charges you do not recognize. If you see fraud, contact your card issuer when ready. Most cards offer fraud protection, and you are not liable for unauthorized charges if you report them promptly.
Frequently Asked Questions
Why does my American Express card have 15 digits instead of 16?
American Express cards use a different numbering system than Visa, Mastercard, and Discover. Amex cards have 15 digits total: a 4-digit issuer code, a 10-digit account number, and a 1-digit check digit. The CVV on an Amex card is 4 digits instead of 3, and it appears on the front of the card above the number.
Can someone use my card number if they only know the first six digits?
No. The first six digits identify your bank and card type, but they are public information. A thief would need the middle eight digits (your account number), the expiration date, and ideally the CVV to attempt a fraudulent transaction. The first six digits alone cannot be used to commit fraud.
Is it safe to give my card number to a business I found online?
Only if the website is encrypted and you initiated the transaction. Look for "https://" at the start of the web address and a padlock icon in your browser. Never enter your card number on a website you reached by clicking a link in an email or text message. If you are unsure, call the business directly using a number from their official website.
What should I do if I accidentally shared my full card number online?
Contact your card issuer when ready and ask them to cancel the card and issue a replacement. Most banks can do this over the phone in a few minutes. If you shared your CVV as well, the risk is higher, but your card issuer can monitor your account for fraud and issue you a new card with a new number.
Do I need to memorize my card number?
No. You do not need to memorize your card number. Keep it stored securely — either in your wallet or in a password manager that encrypts sensitive information. Never store it in plain text in your phone's notes app or email.