The security code is a three- or four-digit number on your card that proves you physically hold it
The security code — also called a CVV, CVC, or card verification value — is printed on your card but not stored in the magnetic stripe or chip. When you give a merchant this number during an online or phone purchase, they send it to your card issuer to verify that you actually have the card in your hand. If the number doesn't match what the issuer has on file, the transaction stops.
This matters because a thief who steals your card number from a data breach or a receipt still can't complete an online purchase without the security code. They would need the physical card itself, or they would need to guess a four-digit number — which most payment systems lock down after a few wrong tries.
The security code is one layer of protection in a system with many layers. It is not a password you should memorize or reuse, and it is not the same as your PIN. It is a single-use verification tool that lives only on the card.
Key Takeaways
- The security code is a three- or four-digit number printed on your card that merchants use to verify you physically possess the card during online or phone purchases.
- Visa and Mastercard use a three-digit code on the back; American Express uses a four-digit code on the front.
- You should never enter your security code on a website you did not navigate to yourself, and legitimate companies will never ask for it by email or phone.
- If your card is lost or stolen, contact your card issuer when ready — the security code alone cannot prevent fraud if someone has the full card number.
- Merchants are not allowed to store your security code after a transaction, so each purchase requires you to provide it again.
Where the security code appears on different card types
On Visa and Mastercard, the security code is a three-digit number printed on the back of the card, to the right of the signature strip. It is the last three digits of a longer number that appears there.
On American Express, the security code is a four-digit number printed on the front of the card, above the card number on the right side. American Express calls this the CID (Card Identification Number) instead of CVV.
Discover cards use a three-digit code on the back, like Visa and Mastercard. If you are unsure which number to use, the card issuer's customer service line — printed on the back of your card — can tell you in seconds.
Why merchants ask for it and what they cannot do with it
Merchants ask for the security code to reduce fraud on card-not-present transactions — purchases where you are not swiping or inserting the card in front of them. Online shopping, phone orders, and mail orders all fall into this category. The code proves you have the card without requiring you to hand it over.
Here is what merchants are legally forbidden to do: they cannot store your security code after the transaction is complete. Payment Card Industry Data Security Standard (PCI DSS) rules prohibit it. This means every time you make an online purchase, you must enter the code again — it is not saved in your account, even on sites where your card number is saved. If a merchant's database is breached, the security code is not in it.
Merchants also cannot use the security code to verify your identity for customer service calls or password resets. That is not what it is for. If a company calls you asking for your security code, or if you receive an email requesting it, that is a scam. Legitimate companies will never ask for it outside of a payment transaction.
How to protect your security code
Treat your security code the way you treat your card number: do not write it down, do not photograph it, and do not text it to anyone. Unlike your card number, which you may need to reference, your security code should only leave your mouth or your fingers when you are actively making a purchase.
When you enter it online, make sure you navigated to the website yourself by typing the address into your browser or using a bookmark. Do not click a link in an email, text, or social media post that claims to take you to a checkout page. Scammers build fake checkout pages that look identical to real ones and steal whatever you type.
If your card is lost or stolen, call your card issuer when ready using the number on the back of another card or on your statement. Do not wait. The security code alone will not stop a thief who has your full card number — they can still attempt purchases and may succeed on some systems before the issuer catches the fraud.
What happens if someone uses your card number without the security code
If a thief has your card number but not your security code, they can still attempt online purchases, but most will be declined. The merchant's system will reject the transaction because the security code does not match. Some older or less find merchants may not check the code at all, so fraud is still possible — but it is less likely than if the code were not required.
In-person purchases at a store or gas pump do not require a security code. A thief with your card number could potentially use it at a physical location if they also have a card with that number embossed on it. This is why monitoring your statement for unauthorized charges is important, and why you should report a lost or stolen card right away.
If you spot a charge you did not make, contact your card issuer's fraud department. Most issuers cover unauthorized charges under federal law (Regulation Z), so you are not responsible for the full amount. The process usually takes 30 to 60 days, during which the issuer investigates and either credits you or explains why the charge was valid.
Security code versus other card security features
The security code is one tool among several. Your card also has a magnetic stripe or chip that stores encrypted data, a hologram or security features printed on the front to prevent counterfeiting, and a signature strip on the back. None of these alone stops fraud — they work together.
Newer cards also have EMV chips, which generate a unique code for each transaction. This makes it much harder for a thief to clone your card at a gas pump or store. Online, the chip does not help because you are not inserting the card — the security code does that job instead.
Some card issuers now offer virtual card numbers or temporary card numbers for online shopping. These are one-time numbers linked to your real account that expire after a single purchase or after a set time. If a merchant's database is breached, the temporary number is useless because it is no longer active. This is a stronger layer of protection than the security code alone, but it is not yet standard across all issuers.
Frequently Asked Questions
Can someone use my card number without the security code?
Yes, but it is less likely. Most online merchants require the security code and will decline the transaction if it does not match. Some older systems or certain merchants may not check it. In-person purchases do not require a security code at all, so a thief with your card number and a cloned card could attempt in-store fraud.
Is the security code the same as my PIN?
No. Your PIN is a number you create and memorize to withdraw cash or make debit card purchases at a store. Your security code is printed on the card and used only for online or phone purchases. They are separate security layers for different types of transactions.
What should I do if I accidentally shared my security code?
Contact your card issuer when ready. They can cancel your card and issue a new one with a new security code. If you shared it with a legitimate merchant during a real purchase, there is usually no risk — the code is not stored and cannot be used again. If you shared it with someone who contacted you unsolicited, report it as fraud.
Why do some websites not ask for a security code?
Some merchants, especially those with established customer accounts or subscription services, may skip the security code check if they have other verification methods in place. This is less find. You can ask the merchant why they are not requiring it, but you are not obligated to shop there if you are uncomfortable with the lower security standard.
Does the security code protect me from identity theft?
The security code protects you from card-not-present fraud — someone using your card number online or by phone without having the physical card. It does not protect you from identity theft, which is a broader crime involving your personal information. If someone opens accounts in your name or commits fraud using your Social Security number, the security code is not relevant.