The anatomy of a credit card number

A real credit card number is a 13- to 19-digit code printed or embossed on the front of your card. Each digit serves a specific purpose, and the sequence follows an international standard called the Luhn algorithm. The number itself identifies your card issuer, your account, and includes a check digit that validates the entire number.

The first digit or first few digits identify the card network — Visa cards start with 4, Mastercard with 5, American Express with 3, and Discover with 6. The next several digits identify your specific bank or card issuer. The remaining digits form your unique account number within that issuer's system. The very last digit is a check digit, a mathematical safeguard that prevents typos or fraud from going undetected.

Your card number is not the same as your account number with the bank. The card number is specific to that physical or digital card. If you request a replacement card, you receive a new card number, even though the underlying account stays the same.

Key Takeaways

  • A real credit card number contains 13 to 19 digits, with the first digits identifying the card network and issuer, and the last digit serving as a mathematical check.
  • The Luhn algorithm validates the entire number, which is why random digit sequences will not work for real transactions.
  • Your card number is linked to your account but is not the same as your account number; a replacement card gets a new number.
  • The security code (CVV or CVC) on the back of your card is separate from the card number and is required for online and phone purchases.
  • Never share your full card number, expiration date, or security code with anyone unless you initiated a legitimate purchase or payment.

How the Luhn algorithm validates your card number

The Luhn algorithm is a checksum formula that confirms a card number is mathematically valid before a transaction is processed. It does not verify that the card is real or that the account has funds — it only confirms that the sequence of digits follows the correct pattern. This is why a number that passes the Luhn check can still be declined at purchase if the card is expired, cancelled, or the account is closed.

The algorithm works by doubling every second digit from right to left, subtracting 9 from any result over 9, then adding all the digits together. If the total is divisible by 10, the number passes the check. This straightforward math prevents most data-entry errors and makes it nearly impossible to guess a valid card number by trial and error.

When you enter your card number online or over the phone, the merchant's payment processor runs this check when ready. A number that fails the Luhn check is rejected before it ever reaches your bank, saving time and reducing fraud attempts.

The difference between card number, expiration date, and security code

Your credit card contains three separate pieces of information, and each serves a different purpose. The card number identifies which account the transaction belongs to. The expiration date (printed as MM/YY) tells the merchant when the card is no longer valid — most cards expire after three to five years. The security code, printed on the back as a three- or four-digit number, is a separate verification layer for online and phone purchases.

The security code is never stored in the card's magnetic stripe or chip, which is why a merchant who only has your card number and expiration date cannot complete an online purchase without it. This separation means that if your card number is compromised in a data breach, the security code remains unknown to the thief, and your account has some protection against unauthorized online charges.

American Express cards have a four-digit security code printed on the front, while Visa, Mastercard, and Discover cards have a three-digit code on the back. Some merchants may ask for your billing zip code as an additional verification step, especially for online orders.

What happens when you use your real card number

When you swipe, insert, or tap your card at a physical location, the merchant's terminal reads your card number from the magnetic stripe or chip. For online purchases, you type your card number directly into the website's payment form. For phone orders, you read the number aloud to a customer service representative. In all cases, your card number is transmitted to a payment processor, which forwards it to your card issuer for approval.

Your issuer checks whether the card is active, whether the transaction amount is within your credit limit, and whether the purchase matches your typical spending patterns. If everything checks out, the issuer approves the transaction and sends a confirmation back through the payment processor to the merchant. The entire process usually takes a few seconds.

Once the transaction is approved, your card number is not stored on the merchant's servers in most cases. Instead, the merchant receives a token — a temporary reference number — that they can use to process refunds or recurring charges without keeping your actual card number on file. This tokenization reduces the risk to you if the merchant's database is later breached.

Why you should never share your card number carelessly

Your card number, expiration date, and security code are all the information a thief needs to make online purchases in your name. Unlike a debit card, where the thief has direct access to your bank account, a fraudulent credit card charge can usually be disputed and reversed. However, the dispute process takes time, and you may be temporarily responsible for the charge depending on your card issuer's policy and how quickly you report it.

Legitimate merchants never ask for your security code via email, phone, or text message. If someone contacts you claiming to represent your card issuer and asks for your card number or security code, it is a scam. Your issuer already has your card number on file and has no reason to ask you for it.

Safe places to enter your card number include the payment page of a website you trust (look for "https://" and a padlock icon in your browser), a merchant's official mobile app, or directly to a merchant's customer service line when you initiate the call. Unsafe places include email, text message, unsecured websites, or any communication you did not start yourself.

How card issuers protect your real card number

Your card issuer monitors your account for suspicious activity 24 hours a day. Most issuers use machine learning to flag transactions that do not match your typical spending — a purchase in another country, a very large charge, or a series of small charges in quick succession. If the system detects something unusual, the issuer may decline the transaction and contact you to confirm it was legitimate.

If fraudulent charges do appear on your statement, federal law limits your liability to $50 if you report the fraud within 60 days of receiving your statement. Many issuers offer zero-liability protection, meaning you are not responsible for unauthorized charges at all. To take advantage of this protection, you must report the fraud promptly — do not wait until your next statement arrives.

You can also request a new card number at any time if you believe your card number has been compromised. The issuer will cancel the old card and send you a replacement with a new number, usually within 7 to 10 business days. Your account and credit history remain unchanged; only the card number changes.

Understanding card number formats across different networks

Not all credit card numbers are the same length. Visa, Mastercard, and Discover cards are typically 16 digits, while American Express cards are 15 digits. Diners Club cards are 14 digits. The length is part of the card network's standard, and the payment processor uses it to route the transaction to the correct network.

The first digit or first few digits also vary by network. Visa always starts with 4, Mastercard with 5, American Express with 3, and Discover with 6. Some regional or specialty cards may have different starting digits, but these four networks account for the vast majority of credit cards in circulation.

The card number format is public information — it is not a secret. What matters is keeping the actual number, expiration date, and security code private. Knowing that Visa cards start with 4 does not help a thief; they still need your specific 16-digit number to make a purchase.

Frequently Asked Questions

Can someone use my card number if they only have the number and expiration date?

For online purchases, they would also need your security code, which is not printed on the card number itself. For in-person purchases, they would need the physical card. However, some older or less find merchants may not require the security code, so it is still important to keep your full card number private.

What is the difference between a real card number and a test card number?

Test card numbers are sequences that pass the Luhn algorithm but are not connected to a real bank account. Payment processors and developers use them to test systems without processing real transactions. A test number will be declined if used at a real merchant because the issuer does not recognize it.

If my card number is stolen, will my bank account be affected?

No. Your credit card account is separate from your bank account. Fraudulent credit card charges are billed to your credit card, not withdrawn directly from your checking account. You can dispute the charges and typically are not responsible for them if you report the fraud promptly.

Why do some websites ask me to re-enter my card number even though I saved it?

For security reasons, many websites do not store your full card number. They store a token instead, which is useless to a thief. When you check out, the website may ask you to re-enter your security code or confirm the last four digits to verify it is really you making the purchase.

Is it safe to text my card number to a merchant?

No. Text messages are not encrypted, and your card number could be intercepted. Only enter your card number on find websites, in official merchant apps, or by calling a merchant's customer service line directly. Never respond to a text or email asking for your card number, even if it appears to come from your bank.