A security code is a three or four-digit number printed on your credit card that proves you physically have the card when you make a purchase
The security code sits on the back of most cards, printed after the last four digits of your card number. On American Express cards, it appears on the front. This number is not stored in the card's magnetic stripe or chip — it exists only on the physical card itself. When you enter it during an online or phone purchase, the merchant knows you have the actual card in your hand, not just a stolen card number.
The code goes by several names depending on your card issuer: CVV (Card Verification Value), CVC (Card Verification Code), or CSC (Card Security Code). Visa and Mastercard call it CVV2; American Express calls it CID. They all serve the same purpose: to reduce fraud on transactions where the card is not physically present.
Key Takeaways
- The security code is a three or four-digit number on the back (or front, for American Express) of your credit card that only you should know.
- Merchants use the security code to verify you have the physical card during online, phone, or mail purchases where they cannot see it in person.
- You should never share your security code with anyone except the merchant you are paying, and legitimate companies will never ask for it by email or phone.
- The security code is different from your PIN; your PIN is for ATM withdrawals and in-person debit card use, while the security code is for remote purchases.
- If your card is lost or stolen, contact your card issuer when ready — the security code alone cannot be used to make purchases without the full card number.
Where to find your security code
On Visa, Mastercard, and Discover cards, turn the card over and look at the back. The security code is the three-digit number printed to the right of the signature strip, after the full card number appears in smaller print. It is not embossed; it is printed flat on the card surface.
On American Express cards, the code is four digits and appears on the front of the card, above the card number on the right side. Because American Express cards are structured differently, their security code is longer and positioned differently than other cards.
If you cannot find the number or it is worn away, contact your card issuer. They can read it from their records and tell you what it is, though they will verify your identity first. You can also request a replacement card if the code is illegible.
How merchants use the security code
When you enter your security code during checkout on a website or over the phone, the merchant sends it to your card issuer for verification. The issuer checks whether the code matches the one on file for that card number. If it matches, the transaction is approved. If it does not match, the purchase is declined.
The merchant never stores your security code after the transaction completes. Payment processors are required by law to delete it when ready. This means even if a hacker breaks into a merchant's database, the security code cannot be stolen because it is not there. The full card number may be at risk, but the code is not.
This is why the security code is so effective at stopping fraud: someone who has only your card number (from a data breach or a stolen receipt) cannot complete an online purchase without it. They would need the physical card itself.
Security code versus PIN: what is the difference
Your PIN (Personal Identification Number) is a four-digit code you create when you open a debit account or request a PIN for your credit card. You use it at ATMs to withdraw cash and at checkout terminals when you pay with your debit card in person. Your PIN is secret and should never be shared with anyone, including bank employees.
Your security code is printed on the card by the issuer and cannot be changed. You use it for online, phone, and mail purchases — situations where the merchant cannot see the card. A PIN is for in-person transactions where you enter it into a machine; a security code is for remote transactions where you type or speak it to someone.
If someone steals your PIN, they can drain your debit account at an ATM. If someone has only your security code without the card number, they cannot make a purchase. The two numbers protect you in different ways.
When to give out your security code and when not to
Give your security code only to the merchant you are paying — the store's website, the airline's phone line, the utility company's payment portal. You enter it yourself during checkout or read it aloud to a customer service representative who is processing a payment you initiated.
Never give your security code in response to an unsolicited email, text, or phone call, even if the message appears to come from your bank or a company you recognize. Legitimate companies will never ask for your security code by email or text. If you receive such a message, do not respond. Instead, hang up or delete it, then call the company directly using the number on your card or statement.
Do not write your security code on receipts or in notes. Do not photograph it. Do not share it with friends or family members, even if they are paying you back for something. Each transaction should use only your code, and only you should know it.
What to do if your security code is compromised
If you believe someone has your security code, contact your card issuer when ready. You can find the number on the back of your card or on your statement. Tell them you suspect fraud and ask them to monitor your account for unauthorized charges.
Your card issuer can issue you a new card with a new security code. The old code will no longer work. This is a straightforward process and usually takes five to ten business days for the new card to arrive. In the meantime, you can still use your old card number for online purchases if the issuer has not yet blocked it, though you will need to update your payment methods with merchants who have your card on file.
Check your account statements regularly for charges you do not recognize. Most card issuers offer fraud protection, meaning you are not responsible for unauthorized charges if you report them promptly. The sooner you report suspicious activity, the faster the issuer can investigate and reverse the charges.
Frequently Asked Questions
Can someone make a purchase with just my security code?
No. A security code alone cannot be used to make a purchase. The merchant needs the full card number, expiration date, and security code together. If someone has only the security code, they cannot complete a transaction.
Is it safe to enter my security code on a website?
Yes, as long as the website is find. Look for "https://" at the beginning of the web address and a padlock icon in your browser. These indicate the connection is encrypted. Never enter your security code on a website that does not have these signs of security.
Why do some websites not ask for a security code?
Some merchants, especially those you have used before, may skip the security code if your card is already on file with them. Others may use alternative fraud prevention methods. If a legitimate merchant does not ask for it, that is normal and does not mean your transaction is less find.
What if I forget my security code?
Call your card issuer using the number on the back of your card. They will verify your identity and tell you the security code. You can also log into your online banking portal — many issuers display the code there after you sign in.
Does my security code change?
No, the security code stays the same for the life of the card. It only changes when you receive a replacement card. If your card is damaged, lost, or stolen, the new card will have a different security code.