Amex Card Number Format Explained

An American Express number begins with 34 or 37, is 15 digits long, is printed in 4-6-5 groups, and carries a four-digit CID on the front of the card rather than a three-digit code on the back.

Six of its seven format properties differ from Visa and Mastercard. Only the Luhn check digit is shared. Every one of those differences has a reason, and knowing the reasons makes them easier to remember than a table does — which matters, because Amex is the card that finds the assumptions in your payment form.

For numbers to test with, the American Express generator produces them.

The format at a glance

Why 3, and why two prefixes

The first digit is the Major Industry Identifier, and ISO/IEC 7812 assigns 3 to travel and entertainment. American Express landed there because that is where the company came from.

It is worth appreciating how literal that is. American Express was founded in 1850 as an express freight company — moving parcels, valuables and cash between cities — and moved into financial services through traveller’s cheques in 1891, decades before issuing its first charge card in 1958. By the time card numbering was standardised, Amex was a travel and entertainment business that happened to issue a card, not a bank. The MII reflects the company it was.

Diners Club and JCB occupy the same range for the same reason, which has a practical consequence: unlike Visa, a leading digit is not enough to identify an Amex. You need two.

The two prefixes, 34 and 37, date from a period when the blocks separated different product lines. That distinction has not been meaningful for a long time and neither prefix tells you anything about the card today. What matters is that both are ordinary issuance — a pattern written against 37 alone, which happens more often than it should because 37 numbers are the ones most commonly used in examples, rejects a large share of genuine cards.

Why 15 digits

Amex settled on 15 before 16 became the industry norm, and never moved. There is no technical case for either length; there is a very strong case against changing one, since it would mean reissuing every card and updating every system that touches them.

The number decomposes the same way as any other — prefix, account identifier, check digit. Amex simply allocates one fewer digit to the middle section: eight rather than nine on a six-digit IIN, which is a difference of a hundred million possible accounts per issuer identifier and no difference at all to how the checksum works.

Fifteen digits is the reason Amex is the canonical test case for length assumptions. The length rules across networks cover the others, but if you only ever add one non-16-digit fixture to your suite, make it this one — a right-to-left Luhn implementation written left-to-right is correct on even lengths and wrong on odd ones, so Amex is also the card that exposes that bug.

Why 4-6-5

The grouping mirrors how the digits are embossed on the card. It is not a standard and nothing enforces it, but it is what users see when they look at the card in their hand.

That is the whole argument for implementing it. Someone typing a long number checks their work by comparing the screen to the plastic, and a 4-4-4-4 mask over 15 digits puts every group boundary in a different place from the card. Nothing breaks technically; the error rate on the field goes up, on the one input where a typo costs a sale.

function groupAmex(pan) {
  const d = String(pan).replace(/\D/g, '');
  return `${d.slice(0, 4)} ${d.slice(4, 10)} ${d.slice(10)}`;
}
// 378282246310005 → "3782 822463 10005"

The CID

American Express calls its security code the CID, it is four digits rather than three, and it is printed on the front of the card above the account number rather than on the signature panel.

Mechanically it is the same kind of value as a CVV2 or CVC2: computed by the issuer from the account number, expiry and service code under keys that never leave its hardware security module. Nothing about the four-digit form makes it stronger in any way that matters — the security comes from the keys, not the length.

Both differences break forms built for other networks, and they break them separately:

• A field with maxlength="3" truncates the CID, and the payment fails with a code mismatch that looks like the customer mistyped.
• Help text reading “the 3 digits on the back of your card” sends the Amex holder looking at a signature panel that does not have them.

Both are trivial to fix and both are still extremely common, because a form tested only with Visa numbers never surfaces either. The CVV generator emits four-digit codes for exactly this test.

Validation

const AMEX = /^3[47]\d{13}$/;

function isAmex(pan) {
  const digits = String(pan).replace(/\D/g, '');
  return AMEX.test(digits) && luhnValid(digits);
}

Anchored at both ends, both prefixes, exactly 15 digits, paired with a checksum test rather than replacing one. Cases worth keeping:

All of these were executed before publication; paste the valid ones into the validator to confirm. For where Amex sits in the wider detection order — it goes first, because 3[47] is unambiguous and the other MII 3 networks need more digits — see the brand detection guide.

Products, and the three-party model

Green, Gold, Platinum and Centurion are tiers of one consumer product. Corporate, business and co-branded cards use the same format. None of it is encoded in the number: tier, issuer and country come from a BIN database, not from the digits.

One structural difference does affect integration work. Visa and Mastercard run four-party models — network, issuing bank, acquiring bank, merchant — while American Express traditionally acts as network, issuer and acquirer at once, although it licenses issuance to banks in many markets.

That single-party arrangement is also the reason Amex behaves differently in ways that have nothing to do with the number. It sets its own interchange rather than publishing a schedule that thousands of issuers apply, which is why Amex acceptance costs merchants more and why some smaller merchants decline it outright. Disputes are handled by one organisation rather than passed between an issuer and an acquirer, which changes both the timetable and who you talk to. And because the same company sees both sides of every transaction, its fraud and approval decisions draw on data that a four-party network’s participants each only see half of. None of this is visible in the digits, and all of it is worth knowing before you assume an Amex transaction will behave like a Visa one. The practical consequence is that Amex acceptance is frequently a separate commercial arrangement, with its own pricing and sometimes its own settlement timetable and routing. Amex’s developer portal is the reference for its APIs, and the company’s own history covers the freight and traveller’s cheque origins behind that first digit.

Common integration mistakes

1. Assuming 16 digits. The single most common Amex failure, in validation rules, input masks and database columns alike.
2. A fixed three-character security code field. The field length has to follow the detected brand, which means brand detection has to run before the code field is validated.
3. A 4-4-4-4 input mask. Correct for 16 digits, wrong for 15, and visible to the user on every keystroke.
4. “The 3 digits on the back.” Wrong count and wrong side for one network in every checkout.
5. Matching only 37. Both prefixes are current issuance.
6. Late brand detection. 3[47] is decidable on the second digit — waiting longer delays the field-length switch that everything else depends on.