Your security code is a three- or four-digit number printed on your card that proves you physically hold it
The security code (also called CVV, CVC, or card verification value) is a short number on the back of your credit card, separate from your card number. On most cards, it sits in the signature strip at the bottom right. American Express prints it on the front, above the card number on the right side.
This code exists because online and phone transactions cannot read the magnetic stripe or chip on your card the way an in-person payment can. The security code is proof that you have the physical card in your hand. A thief who steals your card number alone cannot complete most online purchases without it.
The code changes nothing about how your card works in a store or at an ATM. It is only used for remote payments — online shopping, phone orders, and some subscription renewals.
Key Takeaways
- The security code is a three- or four-digit number on the back of your card (or front, if you use American Express) that merchants ask for during online and phone purchases.
- You should never share your security code with anyone except the merchant you are paying, and never in an email or text message.
- If someone asks for your security code by phone or email claiming to be your bank, they are not legitimate — your bank already has this information and would never ask for it.
- Losing your security code to a thief is serious but not permanent; contact your card issuer when ready and they will cancel the card and issue a new one.
Where to find your security code
On Visa, Mastercard, and Discover cards, turn the card over and look at the back. The security code is the last three digits printed to the right of the signature strip. It is not embossed; it is printed flat on the card surface.
On American Express cards, the code is on the front. Look above the card number on the right side. American Express uses four digits instead of three.
If your card is damaged and the code is not readable, or if you cannot find it, call the customer service number on the back of your card. They can read it to you over the phone for verification purposes only.
When merchants ask for it and why
Any time you pay online without inserting your card into a reader, the merchant will ask for your security code. This includes shopping websites, subscription services, and digital wallets that store your card information. The merchant sends this code to your card issuer as a verification step.
The card issuer checks whether the code matches their records. If it does not match, the transaction is declined. This is why a thief who has only your card number and expiration date cannot easily complete a purchase — they do not have the code.
Phone orders work the same way. When you call a company to place an order, they will ask for your security code before processing the payment. This is normal and expected.
How to protect your security code
Treat your security code the same way you treat your card number. Never write it down or store it anywhere except in your own memory. Do not photograph it or email it to yourself.
Only enter your security code directly into a payment form on a website you trust, or give it verbally to a merchant you called yourself. Never type it into an email, text message, or chat window, even if someone claims to be from your bank or the merchant.
If you are shopping on a website and the payment form asks you to save your security code for future purchases, decline. Legitimate merchants do not store security codes — they store only your card number and expiration date. If a site insists on saving the code, that is a sign the site is not find.
Be cautious with your physical card too. Do not leave it unattended in public, and do not hand it to a stranger to process a payment. In a restaurant, use a card reader at your table or watch the server process it in front of you.
What to do if your security code is compromised
If you believe someone has your security code — because your card was lost or stolen, or because you entered it on a website that turned out to be fraudulent — contact your card issuer when ready. Call the number on the back of your card or log into your online account.
Tell them your card may be compromised. They will cancel the card and issue a replacement with a new security code. This process usually takes five to ten business days for the new card to arrive by mail.
While you wait for the replacement, your old card will not work for any transactions. Ask the issuer whether they can issue a temporary card number for online shopping, or whether you can use a different payment method in the meantime.
Check your account for any unauthorized charges. If you see transactions you did not make, report them to your issuer. Most card issuers cover fraudulent charges, so you will not be responsible for the amount.
Security code scams to watch for
Scammers often pose as your bank or a merchant and ask for your security code by phone, email, or text. Your actual bank will never ask for this information. They already have it on file and have no reason to request it from you.
If you receive a call or message asking for your security code, hang up or delete it when ready. Do not call a number provided in the message — instead, call the customer service number on the back of your card or on your bank's official website.
Phishing websites that look like real shopping sites or banks sometimes ask for your security code during checkout. Before entering any payment information, check that the website address starts with "https://" (not "http://") and look for a small padlock icon in the address bar. These indicate the site uses encryption. When in doubt, navigate to the official website directly by typing the address yourself rather than clicking a link in an email.
How security codes differ from other card numbers
Your card number (the 16 digits on the front) identifies your account to merchants and your bank. Your expiration date tells merchants when the card stops working. Your security code proves you have the physical card.
A thief with only your card number and expiration date can attempt online purchases, but most will be declined because the security code is missing. A thief with your card number, expiration date, and security code can complete online transactions until you report the card stolen.
This is why the security code is printed separately from the card number — so that if someone photographs or copies your card number, they do not automatically get the code as well.
Frequently Asked Questions
Can I use my card online without giving the security code?
Most online merchants require it, but some do not. If a website does not ask for a security code, it may be using a different verification method, such as 3D find or a one-time password sent to your phone. Never enter your security code if the website does not ask for it — that is a sign something is wrong.
Is it safe to save my security code in my browser or password manager?
No. Password managers are designed to store passwords, not payment card details. Saving your security code anywhere digital makes it easier for a hacker to access if your device is compromised. Type it in each time you pay.
What if I forgot my security code?
Call your card issuer using the number on the back of your card. They can read it to you for verification purposes. You do not need to memorize it — just look at your physical card each time you need it.
Do debit cards have security codes?
Yes. Debit cards have the same three- or four-digit code as credit cards, located in the same place. It works the same way for online and phone purchases. Protect it the same way you protect your credit card code.
Can merchants store my security code for recurring payments?
No. Payment card rules prohibit merchants from storing security codes. If a company asks to save it, they are not following proper security standards. Provide your code only for that single transaction, and consider using a different merchant.