The 16 digits on your Visa card are not random — each group tells the card issuer, the merchant, and the payment network something specific about the transaction

Your Visa card number is divided into four blocks of four digits. The first digit is always 4, which identifies Visa as the network. The next five digits identify your bank or credit union — the institution that issued the card to you. The remaining ten digits are your individual account number, assigned by your bank. When you swipe or type that number, the merchant's system reads these blocks to route the payment to the right network and the right issuer.

Understanding what each part does helps you recognize legitimate card requests, spot potential fraud, and know what information is actually necessary when you're asked to provide it. The structure is the same whether you're using a Visa debit card, a Visa credit card, or a Visa prepaid card.

Key Takeaways

  • The first digit (always 4) identifies Visa; the next five digits identify your specific bank or credit union.
  • The remaining ten digits are your unique account number, assigned by your issuer and never shared with merchants.
  • The three- or four-digit security code on the back is separate from your card number and serves a different fraud-prevention purpose.
  • Merchants never need your full card number for recurring charges after the first transaction — they use a token instead.
  • Legitimate companies will never ask for your card number by email, text, or unsolicited phone call.

Breaking down the 16-digit structure

The first digit, called the Major Industry Identifier (MII), tells the payment system what type of financial institution issued the card. For Visa, this is always 4. If you see a card starting with 5, it's Mastercard. American Express starts with 3. This single digit is how automated systems when ready know which network to contact.

The next five digits make up the Issuer Identification Number (IIN), also called the Bank Identification Number (BIN). These five digits identify your specific bank, credit union, or financial institution. If you call your bank's customer service number from the back of your card, you're reaching the institution identified by these five digits. Different banks have different IINs, so two Visa cards from different banks will have different IINs even though both start with 4.

The remaining ten digits are your account number. Your bank assigns this number to your specific account. This is the part that makes your card unique from every other Visa card in the world. Even if you get a replacement card because yours was lost or stolen, the account number stays the same — the new card is just a new physical representation of the same account.

The security code is separate from your card number

The three-digit number on the back of your Visa card (or four digits for American Express) is called the Card Verification Value (CVV) or Card Security Code (CSC). This is not part of your 16-digit card number, and it serves a different purpose. The CVV is printed on the card but not stored in the magnetic stripe or chip, which means a merchant who only has your card number cannot complete an online transaction without also having the CVV.

When you shop online or over the phone, you provide both your card number and your CVV. The merchant sends both to your bank, which verifies that the CVV matches the card number on file. If someone has stolen your card number but not the physical card, they cannot use it online without guessing the correct CVV. This is why you should never write your CVV on the back of a receipt or share it in an email.

What merchants actually store and what they do not

When you make a purchase, the merchant's payment processor reads your card number and sends it to Visa and your bank for approval. However, the merchant does not store your full card number in their system. Payment Card Industry Data Security Standard (PCI DSS) rules forbid it. Instead, the processor stores a token — a unique code that represents your card but is useless to anyone who intercepts it.

If you set up a subscription or recurring charge (like a monthly streaming service), the merchant does not ask for your card number again. They use the token from your first transaction. This means that if the merchant's database is breached, the stolen tokens cannot be used to make purchases elsewhere because they only work with that specific merchant.

Merchants also never need your CVV for recurring charges. The CVV is only required for the first transaction or for one-time purchases. If a company asks for your CVV to set up a subscription, that is a sign something is wrong with the request.

How to spot requests for your card number that should raise a red flag

Legitimate companies will never ask for your full card number by email, text message, or unsolicited phone call. If you receive a message claiming to be from your bank or a store asking you to "verify" your card number, do not respond. Your bank already has your card number — they issued it to you.

If you initiated contact with a company (by calling their customer service number from your bill or their official website), it is safe to provide your card number over the phone. The key is that you made the call, not the other way around. When you call, you control which number you dial and you know you are reaching the real company.

Be especially cautious of requests that ask for your card number plus your CVV plus your PIN or password. Legitimate merchants never need all three. Your PIN is for ATMs and debit card transactions at the point of sale, not for credit card purchases. Your online banking password is for your bank's website, not for merchants.

What happens when your card number is compromised

If your card number is stolen, your liability is limited. Federal law caps your responsibility at $50 if you report the fraud before the charges post, and $0 if you report it after. Most card issuers offer $0 fraud liability as a matter of policy, meaning you pay nothing for unauthorized charges.

When you report fraud, your bank cancels the card and issues a replacement with a new card number. The account number stays the same, but the physical card is different. Any recurring charges you have set up will fail on the new card until you update them with the new card number. Your bank can usually provide a list of merchants you have authorized, which helps you know which ones to contact.

The token-based system means that if a merchant's database is breached, the stolen data is much less useful than a stolen card number would be. Tokens are merchant-specific and cannot be used elsewhere. This is one reason why using the same card at multiple merchants is safer than it sounds — each merchant only has a token, not your actual card number.

Visa card numbers versus other card networks

All major credit card networks use the same 16-digit structure and the same security code system. Mastercard cards also start with 5 and have 16 digits. Discover cards start with 6 and have 16 digits. American Express is different — it starts with 3 and has 15 digits instead of 16, with a four-digit security code instead of three.

The payment process is the same across all networks: the merchant reads your card number, the network routes it to your issuer, your issuer approves or declines, and the merchant receives a response. The differences are in the details of how each network handles disputes, fraud prevention, and merchant fees. From your perspective as a cardholder, the security protections are similar across all major networks.

Frequently Asked Questions

Is it safe to give my card number to a website?

It is safe if the website uses encryption, which you can verify by looking for "https://" at the start of the URL and a padlock icon in your browser. Encrypted websites scramble your card number so it cannot be read if intercepted. The merchant still does not store your full number — they store a token instead. Never enter your card number on a website that does not have "https://".

Why does my new replacement card have a different number?

Your bank issues a new card number for security reasons. Even though your account number stays the same, the physical card is new, and the bank assigns it a new 16-digit number. This is why you need to update recurring charges with the new number. Your account itself does not change — only the card representing that account.

Can someone use my card number if they do not have the physical card?

They can attempt online or phone purchases, but they cannot complete them without your CVV. They also cannot use it at a store that requires the physical card or a PIN. If they somehow obtain both your card number and CVV, report it to your bank when ready. Your liability is capped at $50 and often $0, depending on when you report it.

What is the difference between my card number and my account number?

Your account number is the ten-digit portion of your card number (digits 7 through 16). Your full card number includes the network identifier and the bank identifier as well. When you call your bank, you can identify your account using just the account number. When you make a purchase, you provide the full 16-digit card number.

Do I need to memorize my card number?

No. You only need to memorize your CVV if you want to make online purchases without having your physical card in front of you, though most people straightforward look at the card when needed. Memorizing your full card number is unnecessary and not recommended — the fewer places your number exists, the safer it is.