There are actually four elements on a card
Treat payment as an identity claim, and the information on a card splits into two groups: one group says “what this card is,” and the other says “whether the person using the card is the cardholder himself or herself.” The first group can be shared publicly; the second cannot.
| Element | What it is | Everyday name | May it be stored? |
|---|---|---|---|
| Primary Account Number (PAN) | The embossed string of digits on the front of the card, usually 16 digits | Card number | Yes, but it must be protected per PCI DSS requirements (masking or encryption) |
| BIN / IIN | The first 6 digits of the card number (extendable to 8) | Card BIN, card prefix | Yes: it is in itself public information used for routing |
| Expiry date | When the card number expires, in MM/YY format | Expiry date | Yes |
| Security code | The three digits after the signature panel on the back (four digits on the front for Amex) | CVV2 / CVC2 / CID | Must not be stored after authorization: it is sensitive authentication data |
the storage rules for the security code are completely different from those for the other three elements.
The security code goes by different names on different networks: Visa calls it CVV2, Mastercard calls it CVC2, and American Express calls it CID. They work the same way but differ in length and position: Amex's 4-digit CID is printed on the front of the card, at the top right, not on the back. Looking for three digits on the back when processing an Amex card is a common operational mistake.
Card number lengths aren't uniform either: Visa and Mastercard are commonly 16 digits, Amex is 15, and some card networks allow 13 to 19. The card number carries a check digit (the Luhn check), which can only verify whether this string of digits is well-formed: it cannot tell whether the card really exists or has any balance. Taking “the card number format is valid” to mean “the card works” is the most common misunderstanding.
What the BIN determines
The BIN (Bank Identification Number: referred to as the issuer identification number in the standards) is the leading block of the card number. It doesn't take part in the charge itself, but the routing and judgment of the whole transaction start here:
- Which card network it runs on: numbers starting with 4 are mostly Visa, 51–55 and the 2221–2720 range are mostly Mastercard, and numbers starting with 34 / 37 are American Express;
- Which institution issued it: BIN ranges are allocated and registered by standards bodies, so the issuing institution can be looked up from them;
- Which category this card belongs to: the credit / debit / prepaid category is set by the issuing bank and is read from the BIN range by merchants and acquirers;
- Which country issued the card: the country of the institution the BIN belongs to, often used by risk control as one signal of a transaction's region.
The third and fourth points are where virtual card users most often hit a wall: if the issuer registers the card's category as “prepaid” on the BIN range, then a merchant that doesn't accept prepaid cards already knows at the moment it receives the card number: it doesn't need to wait for your charge to fail. That is also why some platforms decline right at the binding stage instead of erroring at charge time: they're reading the BIN, not test-charging it.
Expiry date and security code: division of labor and storage rules
These two are usually filled in together, but their meaning and their rules are completely different.
| Expiry date | Security code | |
|---|---|---|
| What question it answers | Whether this card is still within its validity period | Whether the person using the card has the card in hand right now |
| Does it change | Yes: it changes when the issuer replaces the card at expiry | Yes: the security code changes along with a reissued card |
| Consequence of a leak | Leaking it alone is not enough to complete a payment | Combined with the card number, it is enough to complete a card-not-present transaction |
| Storage rules | May be stored | Must not be stored after authorization |
The security code is designed around the premise of “don't store it”: its very purpose is to prove that the cardholder physically holds the card at that moment.
On storage rules, the industry standard is firm: sensitive authentication data (including the three- or four-digit code on the card) must not be stored in any form after authorization is complete: neither encrypted nor masked. This rule is a different tier from how the card number may be handled: the card number may be stored masked, but the security code may not. For the specific clauses, see the official PCI SSC documentation library.
The expiry date has one more thing that's frequently misread: it means valid through the end of that month, not “expired as of the 1st of that month.” A card dated 09/28 remains usable until September 30, 2028. When a subscription charge fails a few days early, sometimes it isn't a balance problem: it's that after a card replacement both the number and the expiry date changed, while the merchant is still using the old pair.
A postal code too? What AVS is verifying
Many US merchants ask for a billing ZIP code at checkout in addition to the card number. That step runs AVS (Address Verification System). It does not compare the full address: it only compares the numeric part of the address and the postal code:
- The street number and postal code from the billing address tied to the card number are extracted and sent for verification;
- What comes back is a degree of match (full match, postal-code-only match, no match, etc.) rather than a simple pass or fail;
- Each merchant decides for itself which degrees of match to let through: which is why behavior differs from one merchant to another;
- AVS mainly serves markets like the US, the UK, and Canada; many European and Asian merchants never send this request at all.
So there is exactly one correct answer to how to fill in a billing address: copy it character by character from the one the issuer has on file, including the street number and postal code. If you make up an address that looks plausible, AVS simply won't match. For where the billing address of our cards comes from, see where does the billing address come from.
Where these elements are commonly misused
With the concepts clear, the common mistakes all find their slot:
| Wrong practice | Why it's wrong | Right practice |
|---|---|---|
| Treating Amex's CID as the three digits on the back | Amex's 4-digit code is on the front of the card | Enter it where the card actually shows it; don't apply the Visa habit |
| Judging whether a card is real by the number's length | The length only shows the format is well-formed, not that the card exists | The real check happens at authorization, not when filling in a form |
| Updating only the card number after a replacement | The expiry date and security code change along with it | Update all four elements after a replacement, especially for subscriptions with a next charge |
| Treating the first of the expiry month as the expiry day | The expiry date includes that month and is valid through its end | Count it as valid through the last day of the month |
| Filling in the billing address from memory | AVS compares the street number and postal code | Copy the address char by char from what the issuer has on file |
Half of this table is “form-filling errors.” They give you no warnings: they just surface as failed charges.
With all elements understood, card binding stops being guesswork
In practice, the order in which you bind a card is the order of the elements themselves: follow it and you can skip eight out of ten “I don't know why it failed” troubleshooting rounds:
First make sure the card number, expiry date, and security code are all present and from the same card
Mixing details from different cards is the most basic cause of failure. If you've replaced a card, swap all four elements together.
Enter the security code in the right position and length for the card network
Amex is 4 digits on the front; the common standard elsewhere is 3 digits on the back. Get the digits wrong and there's no warning: it's simply declined.
Copy the billing address exactly as the issuer has it on file
The street number and postal code are what AVS actually compares. Copy them character by character; don't paraphrase or abbreviate.
Confirm this transaction type is allowed
Subscriptions and ad accounts need the recurring type. This is a setting on the issuer side, unrelated to the card number itself, and should be confirmed at issuance.
When a charge fails, read the decline code instead of retrying repeatedly
The decline code tells you whether it's a balance, address, or type problem: see the triage order in what to do after a declined payment. Repeated retries mostly just trigger stricter risk control.
We provide the full set of four elements: the card number, expiry date, security code, plus the billing address that goes with the card. Card numbers stay valid long-term, which is why recurring use cases like subscriptions and ad accounts work. The flip side is worth repeating: all four elements must be updated together when a card is replaced: changing only the number will surface as a failure at the next charge. We do not promise charge results at any merchant: whether to accept is decided by the merchant and its acquirer at the moment the transaction is sent.
The four elements on the card are exactly the input you copy when binding a card. To get the full set (card number, expiry date, security code, billing address), first check card types and regions, then issue a card.
FAQ
Which digits of the card number make up the BIN?
Traditionally the first 6. The standard also supports extending to 8 digits. Older systems that truncate at 6 may fail to recognize more recently allocated ranges. BIN allocation rules are defined by ISO/IEC 7812.
Can you tell whose card it is from the number?
Roughly: numbers starting with 4 are mostly Visa, 51–55 and 2221–2720 are mostly Mastercard, and 34 / 37 are American Express. This is the standard allocation of ranges, not an absolute rule.
Can a merchant know I'm using a prepaid card before charging it?
Yes. The card category (credit / debit / prepaid) is set by the issuer on the BIN range and is available as soon as the card number is read during binding. That's why some platforms decline outright at the binding stage.
May a merchant store the security code?
No. Industry rules require that sensitive authentication data not be stored in any form after authorization, with no allowance for encryption or masking. The card number may be stored masked; the security code may not: they're two different tiers.
What's the difference between CVV2, CVC2, and CID?
Same mechanism, different names: Visa calls it CVV2, Mastercard calls it CVC2, and American Express calls it CID. Length and position differ: Amex is 4 digits on the front; the common standard elsewhere is 3 digits on the back.
If the expiry date says 09/28, does it expire on September 1?
No. The expiry date means valid through the end of that month, so a card dated 09/28 remains usable until September 30, 2028.
The card number looks well-formatted, so why does the charge still fail?
The check digit can only verify that the format is valid: it can't tell whether the card really exists, has balance, or is allowed to perform this type of transaction. Those are problems that only surface at authorization.
What's the ZIP code asked for at checkout for?
It runs AVS address verification: the street number and postal code from the billing address are sent for comparison, and a degree of match comes back. It doesn't compare the full address, and it's mainly initiated by merchants in markets like the US, UK, and Canada.
Can I update only the card number after a replacement?
No. The expiry date and security code change along with a reissued card. If you only update the number, a one-off payment may pass, but a subscription with a next charge will fail at the next cycle.
Got the idea in a few minutes? Go open a card
Cards start at $1, no monthly fee; account top-up is $0 with a $20 minimum per deposit. See the pricing page for full details.