A Social Security card has nine digits. So do two-part Zip codes. A domestic phone number, including area code, has ten digits. Yet a complete MasterCard number has twenty digits.
Why so many?
It is not mathematically necessary for any credit-card account number to have more than eight digits. Each cardholder must, of course, have a unique number. Visa and MasterCard are estimated to have about sixty-five million cardholders each. Thus their numbering systems must have at least sixty-five million available numbers.
There are one hundred million possible combinations of eight digits- 00000000, 00000001, 00000002, 00000003, all the way up to 99999999. So eight digits would be enough. To allow for future growth, an issuer the size of Visa or MasterCard could opt for nine digits- enough for a billion different numbers.
From: Big Secrets by William Poundstone