How Do Credit Card Numbers Work? What do the Numbers Mean?

Card Numbers: Your Plastic Payment Method’s Most Crucial Identifying Factor

What’s the first thing that comes to mind when you think about your credit or debit card?

Maybe it’s the bank that issued your payment method, or the card network that it’s branded under. Or, perhaps it’s the number embossed on your card that you recall best.

If you can memorize that string of digits, plus the three-digit card verification value, and you can make purchases with thousands of retailers without having to present your physical card at all.

Maybe you’ve also wondered how those card numbers work, though. In this article, we discuss exactly that. We’ll touch on what card numbers are for, how they’re structured… and how fraudsters can take advantage of them if they’re not secured.

What is the Purpose of a Card Number?

In short, a card number is an identifier that connects a credit or debit card to an existing bank account or line of credit.

Card numbers allow issuers to track and authenticate transactions. When a cardholder wants to make a purchase, the card number lets the bank connect the authorization request to the right account.

Permanent card numbers also allow merchants to submit payments for processing; when a merchant accepts a credit, debit, or prepaid card, the card information is sent to the issuer for authentication and authorization. Merchants can also keep card numbers on file so that future payments can be processed automatically, without the need for manual approval from the cardholder.

Did You Know?

There were more than 1.25 billion credit cards active in the US in 2023. But, the fact each card issuer has a minimum of 15 digits to work with means there are more than one trillion possible card number combinations.

Elements of the Card Number

A Real-World Look at Chargeback Management

Based on a survey of over 400 merchants, the report presents a comprehensive, cross-vertical look at the current state of chargebacks and chargeback management.

Access the FREE Report

A card number may look like a single 15- or 16-digit number. But, it’s actually a string comprising several different indicators:

Major Industry Identifier

This first digit of every card number is known as the major industry identifier, or MII. This one-digit number, which ranges from 0 to 9, identifies the card network’s “major industry.” Each digit corresponds to a different major industry, which follow classifications set by the American Banking Association (ABA).

For example, card numbers for Diners Club and American Express-branded payment methods begin with a 3. This is the MII for the travel and entertainment industry, which is what American Express originally specialized in. Visa-branded cards, meanwhile, have MIIs of 4, since Visa member institutions operate in the banking and financial industry. Below is a breakdown of MIIs by major industry:

MII Value	Major Industry	Card Network (U.S. Only)
0	ISO/TC 68 assignment
1	Airlines
2	Airlines and financial (and other future industry assignments)	Mastercard
3	Travel & entertainment	American Express
4	Banking & financial	Visa
5	Banking & financial	Mastercard, Diners Club US
6	Merchandising, banking, and financial	Discover
7	Petroleum (and other future industry assignments)
8	Healthcare and telecommunications (and other future industry assignments)
9	Reserved for national standards bodies

Bank Identification Number

The first 4-to-6 digits of every card number sequence (inclusive of the MII) form the bank identification number (BIN) — also called an issuer identification number (IIN).

Each BIN is tied to a unique card issuer. This means that all cards issued by a particular financial institution bear the same number. Additionally, BINs also identify the type (i.e. debit, credit or prepaid) and level (e.g. individual, business, or corporate) of card issued.

BINs are useful because they make payments quicker and more secure. They help payment processors direct transactions to issuers for authorization, and enable both issuers and merchants to track, match, and categorize payments.

Learn more about BINs

Account Number

The sequence following the IIN, save for the card number’s last digit, identifies the cardholder’s account.

Also known as the account identifier or individual account identification number, this string of numbers is typically 8 to 12 digits long. It helps issuers tie transactions to a particular account. In other words, a card’s account identifier is what allows the buyer to be billed only for their purchases — nothing more, nothing less.

The Checksum Digit

Also referred to as the validator digit, this last (or in Visa’s case, 13th) digit in a card number is calculated using the Luhn algorithm. It serves to help validate card numbers.

This “modulus 10” or “mod 10” algorithm was invented in the 1950s by German scientist Peter Luhn during his time at IBM, and was later patented in August 1960. It’s used in modern cards to check for transcription, transposition, or deletion errors.

This is particularly useful, since card numbers can be mistyped or corrupted due to data entry or transmission issues. That said, the Luhn algorithm is not a cryptographic algorithm; it cannot be used to stave off fraudulent attacks.

To illustrate, assume we have an account number (minus the checksum digit) of 1789372997. In the table below, we see that the sum of the resulting digits is 56, and the check digit is equal to (10 − (56 mod 10)) mod 10 = 4. This makes the full account number read 17893729974.

	7	9	9	2	7	3	9	8	7	1
Multipliers	2	1	2	1	2	1	2	1	2	1
	=	=	=	=	=	=	=	=	=	=
	14	9	18	2	14	3	18	8	14	1
Sum digits	5 (1+4)	9	9 (1+8)	2	5 (1+4)	3	9 (1+8)	8	5 (1+4)	1

Industry policy is complicated. Let us handle the dispute management while you focus on your business.

How Do Card Numbers Get Stolen?

In 2023, scammers stole card numbers from 52 million Americans and committed roughly $5 billion worth of payment card fraud. Today, 60% of U.S. cardholders say they have been the victim of unauthorized card activity, while nearly half say they have experienced fraud more than once.

From simple tactics like physical card theft to complex ones like data breaches, here’s a rundown on how bad actors are able to steal card numbers:

Physical Theft

Scammers physically rob victims to get their hands on card numbers. Sometimes, thieves steal cards that have been misplaced in public places; other times, theft can occur when someone a cardholder trusts uses their card details without permission. Fraudsters may also sift through trash or recycling bins to look for discarded financial documents, which can hold clues that may help them reverse-engineer the cardholder’s account information.

Data Breaches

More sophisticated fraudsters may hack financial institutions’ systems to access cardholder's data, or purchase previously leaked data on the dark web. There’s a confluence of factors at play; the rising profitability of ransomware attacks is one culprit, as are weak security measures. Sometimes, data breaches can even be an “inside job,” in which unethical employees leak data to third parties for personal gain.

Malware

Scammers send malicious links or file attachments to unsuspecting cardholders. Once executed, malicious files download data from (or give fraudsters remote access to) victims’ devices. Merchants can also be targeted via a similar scam known as “formjacking,” in which fraudsters hijack legitimate eCommerce sites by embedding malicious code into contact or checkout forms. When a cardholder fills out the form, the malware transmits the data to the fraudster.

Phishing Scams

Here, fraudsters contact victims through email, text, or phone. They pretend to be a trusted source by using social engineering tactics to trick the cardholder. Once the scammer establishes their legitimacy, they will pressure the victim into divulging sensitive information. Software company Splunk estimates that 3.4 billion phishing emails are sent out every day.

Skimming

In this scam, criminals attach a skimmer on a card machine like a payment terminal or an ATM. When a cardholder uses the compromised machine, the device harvests the victim’s data and transmits it to the fraudster. In a similar vein, bad actors may use so-called card “shimmers” to extract data from a payment method’s EMV chip.

Did You Know?

The Wall Street Journal reports that 3,205 data breaches occurred in the US in 2023.

Writing Winning Chargeback Rebuttal Letters

Learn how to create a winning debit or credit card chargeback rebuttal letter. Download our rebuttal letter template and writing checklist today.

Get the FREE guide

What Happens if a Card Number Gets Stolen?

Card number theft doesn’t just affect cardholders. Businesses lose revenue and experience reputational damage when cardholders lose their payment methods and file chargebacks against unauthorized transactions. But, how exactly do fraudsters make use of illicitly-acquired card numbers to commit fraud?

Make Fraudulent Purchases

Online transactions are more fraud-prone because neither the cardholder nor their payment method is physically at the point of sale. Scammers know this, and will use card-not-present (CNP) transactions to their advantage to make fraudulent purchases. Data from Clearly Payments reveal that the average CNP fraud rate is 0.93%; more than ten times higher than the rate for card-present transactions.

Card numbers and other data may also provide clues that a fraudster can use to carry out ancillary attacks, too. For example, scammers who gain access to an account’s username, password, and email may be able to change them and hijack the account itself.

Sell Stolen Data on the Dark Web

Scammers who steal card numbers don’t even have to commit fraud themselves to benefit from it. Fraudsters can simply sell their data to illegal data brokers or other bad actors on the dark web, who will subsequently use the compromised card numbers to commit fraud.

Research from the University of South Florida and Georgia State University found that dark web data vendors made “...more than US$140 million in revenue over an eight-month period” from selling stolen card numbers, Social Security numbers, and other sensitive personal information.

Fight Fraud Before It Happens

Suffice to say, cardholders must take proactive measures to protect their card numbers from theft. They need to use strong passwords, regularly monitor their accounts, keep their card information private, and swiftly contact issuers to report lost cards.

Merchants have an important role to play as well. By deploying 3-D Secure and other fraud prevention tools at checkout, sellers can curb unauthorized activity, mitigate the risk of illicit chargebacks, and secure buyer information from data breaches and malicious attacks.

Of course, protecting customers’ card numbers may not be enough to dissuade all fraud attacks. For instance, what about first-party fraud? This is why merchants need to think about detecting bad actors as just one part of a broader strategy to tackle revenue loss.

Learn more about fraud prevention

FAQs

Can you identify cards by first 4 digits?

Sometimes. The first 4-to-6 digits of a card number represent the bank identification number, or BIN. This number ties the card to the bank or financial institution that issued it.

How do i find my card number?

Your card number is typically a 15- or 16-digit number located on the back of your card (or the front, the case of Amex cards). You may also be able to find your card number by logging into your account online via desktop or mobile app, or by taking a look at your monthly card statements.

Is it safe to give a 16-digit credit card number to someone else?

No. It’s not a safe practice to share your credit card number with anyone else, even family or close friends. If someone wants you to make a purchase for them, ask them for a shipping address so that you can make the purchase on their behalf. If feasible, you can also ask them to meet in person so that you can complete the transaction with them by your side.

What are the first 4 digits of a Visa card?

The first 4 digits of a Visa card is the bank identification number (BIN), also known as an issuer identification number (IIN). Each bank and non-bank issuer is assigned a unique four-digit BIN/IIN, and all cards issued by that institution will bear card numbers that begin with the same BIN/IIN.

Is the card number always 16 digits?

Not always. Visa, Mastercard, and Discover-branded cards feature 16-digit card numbers. American Express, however, is the one exception: its cards have numbers that are 15 digits long.