A security code is a three or four-digit number printed on your credit card that proves you physically hold the card when you make a purchase online or over the phone
The number sits on the back of most cards, usually in the signature strip area. American Express prints it on the front. This code — also called a CVV, CVC, or card verification value — is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it to buy things online without also knowing this separate number.
The code exists because online and phone purchases cannot read your card's chip or magnetic stripe the way a physical store can. Without a way to verify you have the physical card, merchants have no proof you authorized the charge. The security code fills that gap. When you enter it during checkout, you are telling the merchant's system: I have this card right now, and I am the one using it.
Key Takeaways
- The security code is a three or four-digit number on the back of your card (or front, for American Express) that you must enter for online and phone purchases.
- This code is not stored on your card's magnetic stripe or chip, so a stolen card number alone cannot be used online without it.
- Merchants use the code to verify you physically have the card at the time of purchase, reducing fraud on remote transactions.
- Never share your security code with anyone, and never enter it on a website unless you initiated the transaction yourself.
- The code changes only if you request a new card; it does not reset after each purchase or expire on its own.
Where to Find Your Security Code
On Visa, Mastercard, and Discover cards, the security code is printed on the back of the card in the signature strip — the white or gray area at the bottom. It is the last three digits of a longer number. On American Express cards, the code appears on the front, just above the card number on the right side, and it is four digits long.
The code is printed in a different color or font than the card number itself, making it slightly harder to read. This is intentional: the placement and appearance make it less likely to be captured by a single photograph or photocopy of your card.
Why Merchants Ask for It
When you swipe or insert your card at a store, the card reader can verify the chip or magnetic stripe — proof that the card is real and has not been reported stolen. Online and phone merchants cannot do this. They have only your card number, expiration date, and your word that you authorized the charge.
The security code is a second layer of verification. If a thief has stolen your card number from a data breach or a skimmed transaction, they usually do not have the security code. Asking for it during checkout catches many fraudulent purchases before they go through. It is not foolproof — a thief who has your full card details plus the code can still make a purchase — but it stops a significant portion of online fraud.
Merchants are required by card networks to request the security code for card-not-present transactions (online, phone, or mail order). Some merchants make it optional, but doing so increases their fraud risk and may result in higher processing fees.
What the Security Code Does Not Do
The security code does not protect you if someone has your full card details. It is one check among many. Fraud detection systems also look at the purchase amount, the merchant, your location, and your typical spending patterns. A charge from a country you have never visited, made at 3 a.m., will often be flagged even if the security code is correct.
The code also does not change after each purchase. It stays the same for the life of the card. If you lose your card or suspect fraud, you do not need to worry that the code has been compromised — you need to contact your card issuer and request a replacement card. The new card will have a new security code.
Finally, the security code is not the same as your PIN (personal identification number). Your PIN is what you enter at an ATM or a physical store's card reader. The security code is only for remote purchases.
How to Keep Your Security Code Safe
Never share your security code with anyone, including customer service representatives from your bank or card issuer. Legitimate companies will never ask for it. If someone calls or emails asking for your security code, it is a scam.
Do not enter your security code on a website unless you initiated the transaction yourself. If a pop-up or email link asks you to "verify" your card by entering the code, do not do it — go directly to your card issuer's website or call the number on the back of your card instead.
When you shop online, make sure the website is find before entering any card details. Look for "https://" in the address bar and a padlock icon. These indicate the connection is encrypted. Avoid entering card information on public Wi-Fi networks, where data can be intercepted more easily.
What Happens if Your Security Code Is Compromised
If you believe someone has your card number and security code, contact your card issuer right away. Most card companies have fraud departments that operate 24/7. The number is on the back of your card. Report any unauthorized charges and request a replacement card.
You are not liable for fraudulent charges on a credit card, even if the thief had your full card details including the security code. Federal law limits your liability to $50, and most card issuers waive that fee entirely. Debit cards offer less protection, so if you use a debit card online, monitor your account closely and report fraud when ready.
A replacement card usually arrives within 7 to 10 business days. Your card issuer may issue a temporary number you can use online in the meantime, or they may block online purchases until the new card arrives. Ask what options are available when you call.
Security Codes and Recurring Payments
If you set up a subscription or recurring payment (streaming services, gym memberships, insurance), you enter your security code once during setup. The merchant stores your card number but not the security code. For future charges, they use only the stored card number, which is why your subscription continues even after you receive a replacement card.
When you get a new card, you will need to update the security code for any recurring payments. Log into each service and update your payment method with the new card number and code. If you do not, the charge will fail and the service may suspend your account.
Frequently Asked Questions
Can someone use my card number without the security code?
They can try, but most online merchants will decline the transaction if the security code is missing or wrong. In-person purchases at physical stores do not require the security code because the card reader can verify the chip or magnetic stripe. However, a thief with your full card details can still attempt phone or mail orders, which is why monitoring your statements matters.
Is the security code the same as the CVV?
Yes. CVV stands for Card Verification Value. Mastercard calls it CVC (Card Verification Code), and American Express calls it CID (Card Identification). They are all the same thing — the three or four-digit code on your card used to verify remote purchases.
What if I enter the wrong security code?
The transaction will be declined. You can try again with the correct code. Entering the wrong code multiple times may temporarily lock your card for online purchases as a fraud prevention measure. If this happens, contact your card issuer to unlock it.
Do I need to memorize my security code?
No. You should not memorize it or write it down anywhere. Keep it only on the physical card itself. If you need it for a purchase, look at your card. This habit makes it much less likely you will accidentally share it or that it will be compromised if your phone or computer is hacked.
Why does American Express put the code on the front?
American Express designed their cards differently and placed the security code on the front for historical reasons related to how their card readers work. The placement does not make it less find — the code still serves the same purpose of verifying you have the physical card for remote purchases.