What Is the Card Number On Credit and Debit Cards and How to Find Yours

The card number is the identifier that makes the transaction possible. Yet it is one of the most misunderstood pieces of information on a payment card.

In this blog post, we explore some of the most important aspects regarding the numbers on your debit or credit cards and answer some of the most frequently asked questions on the topic.

What Is a Card Number?  

The card number, formally known as the Primary Account Number, or PAN, is the unique numerical identifier assigned to a payment card. In many card transactions, the PAN is used to identify the card, although tokenised and wallet-based payments may rely on a network token instead.

You can also see it referred to as a payment card number in payment industry documentation.

The PAN is not the same as your bank account number. It identifies the card itself, not the underlying account it is linked to. A single bank account can be linked to multiple cards over time, each with a different PAN.

What is a Card Number on Debit Cards and Credit Cards

On a debit card, the PAN identifies the card used to access funds held in a current or savings account. On a credit card, it identifies the credit account against which purchases are charged. 

In both cases, the number functions the same way during a credit card transaction or debit card payment – it tells the payment network which account to debit or bill.

Is a Card Number the Same as a Bank Account Number?  

No, and this is one of the most important distinctions to understand.

Your bank account number, in the UK, is the eight-digit number used alongside your six-digit sort code to identify your account for bank transfers, direct debits, and standing orders. It does not change when your card is replaced.

Your card number is a separate identifier that lives on the card itself. It is used specifically for card payments. 

When you make a credit card transaction online or in a shop, the payment network uses the PAN, not your bank account number, to route and process the payment.

The two numbers are linked in the background by your bank, but they are not interchangeable and should be treated as separate pieces of sensitive information.

Where Is the Card Number on a Debit or Credit Card?  

On most cards, the card number is displayed on the front, either embossed (raised digits) or printed flat, depending on the card design. 

Traditionally, it appears as four groups of four digits, for example, 4921 XXXX XXXX XXXX, though some issuers now print the number on the back for security reasons. 

Other information typically displayed alongside it includes:

• Cardholder name – the full name of the account holder as it appears on the credit card application;
  
• Credit card expiry date – shown as MM/YY, sometimes labelled as the “expires end date” or “valid thru date”;
  
• Card network logo – Visa, Mastercard, or other, which identifies the payment network used to process transactions.

We’ll go into more details about these additional pieces of information later on in this article.

How Many Digits Does a Card Number Have?  

Most UK debit and credit cards carry a 16-digit PAN, but this is not universal. 

Card number length is determined by the payment network and the issuer:

• Visa – 16 digits;
• Mastercard – 16 digits;
• American Express – 15 digits;
• Maestro – 12 to 19 digits;
• Diners Club / Discover – 14 to 16 digits.

The International Organisation for Standardisation (ISO) sets the technical standard for payment card numbers under ISO/IEC 7812, which allows PANs of between 8 and 19 digits. 

In practice, 16-digit numbers dominate the UK market.

What Do the Digits in a Card Number Mean?  

A card number is not a random string of digits. 

Each section carries specific information, and understanding its structure helps explain how payment networks route transactions in milliseconds.

The first digit – the Major Industry Identifier (MII)

The opening digit indicates the card network category. 

For most payment cards, 3 indicates American Express or Diners Club, 4 indicates Visa, 5 indicates Mastercard, and 6 indicates Maestro or Discover.

Digits 1-6 – the Issuer Identification Number (IIN)

Also known as the Bank Identification Number (BIN) or bank identification number, the first six digits identify the credit card issuer – the specific bank or financial institution that issued the card. 

When a merchant’s payment terminal reads a card, it uses the IIN to determine which network to route the authorisation request through and which issuer to contact. 

This is sometimes referred to as the issuer identifier number in technical payment documentation.

From 2022, the PCI SSC extended the IIN to eight digits in some contexts to accommodate the growing number of card issuers globally, though the six-digit standard remains widely used in UK processing.

The middle digits – the account identifier

The digits between the IIN and the final check digit form the permanent account number segment that identifies the individual cardholder’s account within the issuer’s system. 

This is the section that is unique to you as a cardholder.

The final digit – the check digit

The last digit of any card number is a validation digit generated using the Luhn algorithm, a simple checksum formula developed by IBM scientist Hans Peter Luhn in 1954. 

Payment systems use it to verify that a card number is mathematically valid. It is why a single transposed digit in a card number will typically trigger an immediate “invalid card number” error at checkout.

How To Find Your Card Number Without the Physical Card  

There are several legitimate ways to retrieve your card number if you do not have the card to hand, though the options available depend on your bank or card provider:

• Through your banking app or online portal – Many UK banks and card issuers now display partial or full card numbers through their secure mobile app or online banking portal. Look under card settings or card details within your account.
   
• Through your card provider directly – Contact your bank or credit card issuer by phone or in branch, verify your identity, and request your card details. Providers will follow identity verification procedures before disclosing sensitive card information.
  
• Through your myPOS online merchant account – If you are a myPOS merchant, your card details are accessible securely via your online merchant account, allowing you to manage card usage without needing the physical card present.

Keep in mind that card numbers cannot be retrieved from receipts – UK card receipts are required to partially mask the digits for security reasons. 

They cannot be recovered from contactless payment logs. If you cannot locate your number through the above routes, your provider will typically issue a replacement card rather than provide the full number through an unsecured channel.

What To Do If Your Card Is Lost, Stolen, or Exposed  

Here’s what you should do if you suspect you have a lost, stolen, or exposed card:

Step 1 – Freeze or block the card immediately

Most UK banking apps allow you to freeze a card instantly, preventing any further transactions while you assess the situation. 

This does not cancel the card permanently, and it can be reversed if the card is found.

Step 2 – Contact your card provider

Report the card as lost, stolen, or compromised. 

UK banks operate 24-hour lost and stolen card lines. Under the Consumer Credit Act and Financial Conduct Authority rules, you may be liable for unauthorised transactions capped at £35 if unauthorised transactions have been registered before notifying your provider.

You face zero liability if the card was used fraudulently before you could reasonably report it.

Step 3 – Review recent transactions

Check your statement or app for any unfamiliar charges. 

Dispute these with your provider as soon as possible – the earlier you report suspicious activity, the stronger your position for a refund.

Step 4 – Request a replacement card

Your provider will issue a new card with a new PAN. 

If you have any recurring payments or subscriptions linked to the old card number, you will need to update those details once the new card arrives. This is a standard part of credit card renewal.

Step 5 – Change associated passwords

If you suspect your card details were exposed through a data breach rather than physical loss, change the passwords on any accounts where that card was saved.

UK Finance reported that in the first half of 25, a total of £629.3 million was stolen by criminals, and there were 2.09 million confirmed cases across both authorised and unauthorised fraud. 

These figures underscore why rapid response to a lost or compromised card matters.

Can a Card Number Be Used Safely Online?  

Yes – but only in the right environments. 

When you enter your card number online, you are trusting that the checkout page is secure, the merchant is legitimate, and the payment provider handling the transaction is compliant with PCI DSS.

Before entering your card details online, verify that:

• The page URL begins with https:// and shows a valid security certificate;
• The payment page is hosted or processed by a recognised payment provider;
• You are on the genuine merchant website and not a spoofed version.

For additional credit card fraud prevention, most UK card issuers now require 3D Secure authentication – an additional verification step (such as a one-time passcode sent to your phone) for online purchases. 

This significantly reduces the risk of unauthorised credit card usage on genuine merchant sites.

Avoid entering your card number via email, SMS, or any channel that was not initiated by you. Legitimate card issuers and merchants will never ask for full card details through these channels.

Virtual Card Numbers, Tokens, and Digital Wallets  

Modern credit card usage increasingly involves payment methods that do not expose the original card number at all.

Tokenisation is the process by which a payment network or digital wallet replaces your real PAN with a surrogate number – a token – for use in a specific transaction or with a specific merchant. 

If the token is intercepted, it cannot be used elsewhere. This is the technology underpinning Apple Pay, Google Pay, and Samsung Pay when used for contactless payment at a terminal or online.

Virtual card numbers, on the other hand, are temporary PANs generated for a single transaction or merchant, linked to your main account but distinct from your physical card number. 

Some UK credit card issuers offer virtual card generation through their apps, particularly useful for one-off online purchases where you prefer not to expose your permanent PAN.

What Other Details Does a Payment Card Have?  

Beyond the card number, a payment card carries several other identifiers that work together to authorise transactions and protect against fraud.

Expiry date

Shown as MM/YY on the card face, the expiry date – sometimes labelled expires end date – indicates the last month in which the card is valid. 

Some cards also display a valid from date. Online checkouts routinely require the expiry date alongside the card number to process a payment; a mismatch will decline the transaction. 

Credit card renewal generates a new card with a new expiry date, and in many cases a new PAN.

Security code (CVV)

The card verification code – referred to as CVV, CVC, CVV2, or CVC2 depending on the network – is a three-digit number printed on the back of Visa and Mastercard cards, or a four-digit number on the front of American Express cards. 

It is one of the most important credit card features from a fraud prevention standpoint. 

Merchants are prohibited under PCI DSS from storing the CVV code after a transaction is authorised.

PIN

Your credit card PIN is a four-digit number used to authenticate in-person chip-and-PIN transactions. It is not printed on the card and should never be written down or shared with anyone – including bank staff. 

Unlike the card number or CVV, the PIN is known only to the cardholder and stored in encrypted form by the issuer.

Bank account number

As noted earlier, your bank account number is separate from your card number and is used for bank transfers and direct debits rather than card transactions. 

Knowing someone’s card number does not give them access to your bank account number, and vice versa.

What the Card Number Means for Businesses Accepting Payments  

For UK businesses, the card number sits at the centre of every card transaction you process, and with that comes specific responsibilities.

Card numbers are essential for online and remote payments. For any credit card transaction completed without the card being physically present, the card number, expiry date, and CVV are the primary means of authentication. 

This makes them high-value targets for fraud.

Businesses should minimise direct exposure to card data. The less card data that passes through your own systems, the lower your fraud risk and your PCI DSS compliance burden. 

Using a payment provider that handles card data on your behalf – through a hosted payment page, payment link, or tokenised terminal – means your systems never see the raw PAN, significantly reducing your exposure.

Handling card data affects trust and liability. If a data breach occurs and card numbers are exposed through your business environment, the consequences extend beyond financial penalties. 

Customer trust, your ability to continue accepting cards, and your standing with acquiring banks can all be affected. 

Credit card limits and card data quality affect authorisation rates. Expired card numbers, incorrectly entered PANs, or transactions that exceed a customer’s credit card limits are among the most common causes of declined transactions at checkout. Building clear error handling and retry prompts into your payment flow means reducing unnecessary abandonment.

How myPOS Helps Businesses Accept Card Payments More Securely  

For UK SMEs, managing card payment acceptance securely does not require building complex infrastructure from scratch. 

myPOS provides a suite of tools designed to handle the security-critical elements of card data processing on your behalf.

Online payment gateway

myPOS’s online checkout solution processes card transactions through a PCI DSS-compliant environment, meaning customer card numbers are handled securely without passing through your own systems. 

This reduces your compliance scope and your exposure to card data.

Payment links

For businesses that take remote or phone payments, myPOS payment links allow you to send a secure checkout URL directly to a customer.

This eliminated the need to collect or handle card details over the phone manually.

Physical and mobile terminals

All myPOS terminals are PTS-compliant and support chip and PIN, contactless payment, and digital wallet acceptance.

As a result, in-person transactions can meet the required hardware security standards.

Unified merchant account

Whether you sell in person, online, or through payment links, all transactions feed into a single myPOS merchant account.

This gives merchants visibility over payment activity across all channels and simplifies credit card management and reconciliation.

Reduced need to handle card data directly

By routing card processing through myPOS’s certified infrastructure, businesses can avoid the operational and compliance risks that come with direct handling of PANs and sensitive card data.

Conclusion  

For businesses, treating card numbers as sensitive data is both a legal obligation and a sound operational practice. Your aim should be to minimise direct exposure, use compliant payment solutions, and understand how card details flow through your payment environment.

On the other hand, for consumers, understanding where to find your card number, what its digits represent, and how to protect it gives you better control over your financial security and reduces your exposure to fraud.

Frequently Asked Questions 

What card details should staff avoid writing down during phone payments?

Staff should never write down the CVV/CVC code, the full card number, or the PIN under any circumstances. Even if the note is destroyed after the call, capturing this data, however briefly, brings it into scope for PCI DSS and creates unnecessary fraud exposure.

Can a business store a customer’s card number for repeat payments?

Not without meeting strict requirements. Storing a raw PAN is permitted under PCI DSS only if it is encrypted, access-controlled, and genuinely necessary, but storing the CVV is prohibited under any circumstances, making self-managed card storage impractical for most SMEs. The standard approach for repeat billing is tokenisation.

Do paper forms containing card numbers create extra compliance risks?

Yes, significantly. Any paper record containing a PAN is in scope for PCI DSS, meaning it must be physically secured, access-controlled, and disposed of through cross-cut shredding. Paper records are also harder to audit and easier to lose than digital ones.

Can invoices safely include the last four digits of a payment card?

Yes, displaying only the last four digits of a card number is standard practice and does not constitute a PCI DSS risk. What invoices must never include is the full PAN, expiry date, or CVV, either printed or embedded in digital invoice files.

What is the risk of saving card numbers in spreadsheets or CRM notes?

Significant. Any file or system containing a full PAN immediately becomes part of your cardholder data environment, which triggers PCI DSS obligations for that system. Spreadsheets and CRM free-text fields are rarely built with these controls in place, and a single misdirected email or misconfigured sharing permission can expose the data instantly.