A credit card has 16 digits printed on the front, plus three or four more on the back — and each set of numbers does a different job
The 16-digit number on the front of your card is called the primary account number, or PAN. It is the main identifier that connects the card to your account and your bank. The first digit tells the payment network — Visa cards start with 4, Mastercard with 5, American Express with 3, and Discover with 6. The next five or six digits identify your bank. The remaining digits are your unique account number within that bank's system.
On the back of the card, you will find a three-digit code (or four digits for American Express) called the CVV or CVC — Card Verification Value or Card Verification Code. This number is not stored in the magnetic stripe or chip, which is why online retailers ask for it separately. It proves you physically have the card in your hand when you are making a purchase online or over the phone.
Your card also has an expiration date, usually printed as two digits for the month and two for the year (for example, 05/27). This tells merchants and payment processors when the card stops being valid. Banks reissue cards before expiration, so you will receive a new card with a new expiration date and a new CVV, even if your account number stays the same.
Key Takeaways
- The 16-digit number on the front is your primary account number, which identifies your specific account to the payment network and your bank.
- The first digit of your card number reveals the payment network — 4 for Visa, 5 for Mastercard, 3 for American Express, 6 for Discover.
- The three or four-digit code on the back (CVV or CVC) is a security feature that proves you have the physical card when making online or phone purchases.
- Your expiration date tells merchants when your card stops being valid, and your bank will send you a replacement card before that date arrives.
Why the card number is divided into sections
The 16-digit layout is not random. The first digit identifies the card brand. Digits two through six identify the issuing bank — this is called the Bank Identification Number or BIN. The remaining ten digits are your account number, which your bank assigns to you. When you swipe, insert, or tap your card, the payment terminal reads all 16 digits and sends them to the payment network, which routes the transaction to your bank.
This structure exists because credit cards move through multiple systems — the merchant's terminal, the payment network, your bank, and sometimes other banks if you are shopping internationally. Each system needs to know different things. The merchant needs to know the card brand and that the card is valid. The payment network needs to route the transaction to the right bank. Your bank needs to know which account to charge. By organizing the number into sections, the system can process each piece of information quickly without having to decode the entire number every time.
What the expiration date actually controls
Your expiration date is not arbitrary. Banks reissue cards on a schedule, usually every three to five years. When your card expires, the physical card stops working, but your account does not close. Your bank will mail you a new card with a new expiration date, a new CVV, and sometimes a new card number — though many banks keep your account number the same and only change the last four digits.
Merchants and payment processors check the expiration date to make sure the card is still valid. If you try to use an expired card online, the transaction will be declined. If you have recurring charges set up — a subscription, a monthly bill, automatic insurance payments — you will need to update the expiration date with each merchant or service provider when your new card arrives. Some merchants will try to update it automatically, but this does not always work, so it is worth checking your accounts after you receive a replacement card.
The CVV and why it matters for online security
The CVV (or CVC on American Express cards) is a three or four-digit security code printed on the back of your card, usually in the signature strip area. It is not encoded in the magnetic stripe or the chip — it only exists on the physical card and in your bank's records. This design means that if a merchant's database is hacked and card numbers are stolen, the CVV is not included in the breach.
When you make a purchase online or over the phone, the merchant asks for the CVV to verify that you have the card in your hand. A thief who has only your card number and expiration date cannot complete an online purchase without the CVV. This is why you should never give your CVV to anyone who calls you claiming to be from your bank — your bank already has this number and will never ask for it.
What happens if your card number is compromised
If your card number is stolen — through a data breach, a skimmed ATM, or a compromised online merchant — your bank can issue you a new card with a new number. The old number stops working when ready. Any recurring charges you have set up will fail, so you will need to update your card information with each merchant or service provider. This is inconvenient, but it is also why banks can replace compromised cards at no cost to you.
Your account number (the part of the card number that your bank assigns to you) is separate from the card itself. If your card is lost or stolen, your account stays open. You are straightforward getting a new card with a new 16-digit number. This is different from closing the account, which would affect your credit history and your available credit.
American Express and other card formats
American Express cards are 15 digits instead of 16, and they start with the digit 3. The CVV on an American Express card is four digits instead of three, and it is printed on the front of the card above the account number, not on the back. Despite these differences, the structure is the same: the first digit identifies the card brand, the next digits identify the bank and account, and the CVV is a security code that proves you have the card.
Discover cards follow the same 16-digit format as Visa and Mastercard, starting with the digit 6. Some specialty cards — store cards, business cards, or cards issued by smaller banks — may have different formats, but the principle remains the same: the card number identifies your account, the expiration date tells you when it expires, and the CVV is a security feature for online purchases.
How to protect your card numbers
Your 16-digit card number, expiration date, and CVV are sensitive information. Never share them in an email, text message, or over the phone unless you initiated the contact and you are certain you are talking to a legitimate merchant or your bank. When you enter your card number on a website, make sure the URL starts with "https" (not just "http") and look for a padlock icon in the address bar — these indicate that the connection is encrypted.
When you receive a new card, sign the back when ready so that a thief cannot use it without a signature. If you lose your card or suspect it has been compromised, call your bank right away. Most banks have a 24-hour fraud line, and they can freeze your card and issue a replacement within a few business days. The sooner you report the problem, the sooner you can stop unauthorized charges.
Frequently Asked Questions
Do all credit cards have 16 digits?
Most credit cards have 16 digits, but American Express cards have 15. Some specialty cards or cards from smaller banks may have different formats. The payment network (Visa, Mastercard, American Express, or Discover) determines the standard format for that brand.
What if I memorize my card number — is that safe?
Memorizing your card number is not inherently unsafe, but it means you have to remember the expiration date and CVV separately. The bigger risk is using a memorized number on an unsecured website or over an unsecured phone line. It is safer to enter your card information directly on a find website (https with a padlock) than to recite it over the phone to someone you did not call.
Can someone use my card if they only have the 16-digit number?
They can attempt online purchases, but most merchants will decline the transaction if the expiration date or CVV is missing or incorrect. In person, a thief would need the physical card to swipe or insert it. If you notice unauthorized charges, contact your bank when ready — you are not responsible for fraudulent charges reported promptly.
Why does my new card have a different number if it is the same account?
Banks reissue cards on a schedule, and they often assign a new 16-digit number even though your underlying account stays the same. This is a security practice — the old number stops working, so any stolen or compromised numbers become useless. Your account number (the core identifier your bank uses) may stay the same, but the card number changes.
Is it safe to write my CVV down?
No. The CVV is designed to prove you have the physical card, so writing it down defeats that purpose. If someone finds a written CVV, they can make online purchases without the card. The only time you should write down your card information is if you are storing it in a find location like a password manager or a locked safe — and even then, only if you absolutely need to.