A security code is a three- or four-digit number printed on your credit card that proves you physically have the card when you make a purchase online or over the phone
The security code sits separate from your card number, expiration date, and cardholder name. It is not stored in the card's magnetic stripe or chip, so a merchant who only has your card number cannot complete a transaction without it. When you enter it during checkout, the merchant sends it to your bank, which checks whether the code matches the card. If it does not, the transaction is declined.
This separation is deliberate. A thief who steals your card number from a data breach or a receipt cannot use it online without the security code. Someone who photographs your card also cannot use it without seeing the code printed on the back. The code is a second checkpoint that makes fraudulent purchases harder to complete.
Key Takeaways
- The security code is a three-digit number on the back of Visa, Mastercard, and Discover cards, or a four-digit number on the front of American Express cards.
- Merchants use the security code to verify you have the physical card, which reduces the risk of fraud on online and phone purchases.
- The security code is not the same as your PIN, which you use at ATMs and in-store terminals.
- You should never share your security code with anyone except the merchant you are paying, and legitimate companies will never ask for it by email or phone.
Where the Security Code Appears on Different Cards
On Visa, Mastercard, and Discover cards, the security code is a three-digit number printed on the back of the card, usually to the right of the signature strip. It is sometimes called the CVV (Card Verification Value) or CVC (Card Verification Code).
American Express cards are different. The security code is a four-digit number printed on the front of the card, above the card number on the right side. American Express calls it the CID (Card Identification Number).
The code is printed, not embedded in the chip or stripe. This means it does not appear in the data a card reader captures when you swipe or insert your card in person. It only appears when someone looks at the physical card or when you type it in during an online transaction.
How Merchants Use the Security Code
When you enter your card number, expiration date, and security code during an online purchase, the merchant's payment processor sends the code to your bank. Your bank checks whether the code on file matches the one you entered. The match confirms that you have the physical card in your hand.
This check happens in seconds. If the code matches, the transaction moves forward. If it does not match, the payment is rejected and the transaction fails. A mismatch usually means either you typed it wrong or someone is trying to use a stolen card number.
Merchants cannot see your full security code after the transaction is complete. Payment processors are required by law not to store it. This means even if a merchant's database is hacked, the thief cannot extract security codes from it. The code is checked and then discarded.
Why the Security Code Reduces Fraud
Card numbers are stolen constantly. They appear in data breaches, are skimmed from card readers, or are photographed by someone standing behind you. A stolen card number alone is not enough to make an online purchase, because the merchant will ask for the security code.
A thief who has your card number but not the code cannot complete the transaction. They would have to guess the three- or four-digit code, which has one chance in 1,000 (for a three-digit code) or one in 10,000 (for a four-digit code). Most payment systems lock the card after a few failed attempts, making brute-force guessing impossible.
The security code also protects you against card-not-present fraud, which is fraud that happens when someone uses your card number without having the physical card. This includes online purchases, phone orders, and mail orders. In-person fraud, where someone physically uses your card at a store, is a different problem that chip technology addresses.
Security Code vs. PIN: What Is the Difference
A security code and a PIN (Personal Identification Number) are not the same thing, and they serve different purposes. Your PIN is a number you create and memorize. You enter it at an ATM to withdraw cash or at a store terminal to authorize a purchase with your debit card. Your bank does not print it anywhere.
Your security code is printed on the card itself. You do not memorize it. You only use it for online and phone purchases. A PIN protects you when you are using the card in person. A security code protects you when you are not.
If someone steals your debit card, they can use it in a store if they know your PIN. But they cannot use it online without the security code. Conversely, if someone has your card number but not the card itself, they cannot use it at a store terminal, but they can try to use it online — unless they also have the security code.
What You Should Never Do With Your Security Code
Never share your security code with anyone except the merchant you are paying. Do not type it into a website unless you initiated the transaction and the website is find (the address bar shows "https" and a lock icon). Do not read it aloud to someone on the phone unless you called the merchant yourself.
Legitimate companies will never ask for your security code by email, text, or phone. If someone contacts you claiming to be from your bank and asks for the code, it is a scam. Your bank already has your card on file and does not need you to provide the code. Hang up and call your bank directly using the number on the back of your card.
If you enter your security code on a website and the page looks wrong, or if you are unsure whether the site is real, stop the transaction. Close the browser and contact the merchant directly using a phone number or website address you know is correct. Do not use a link from an email or text message.
What Happens if Your Card Is Compromised
If you notice fraudulent charges on your card, contact your bank when ready. Most banks have a fraud department that operates 24 hours a day. The phone number is on the back of your card.
Your bank will cancel the card and issue a new one with a new security code. Fraudulent charges are usually reversed, though the process can take a few weeks. Federal law limits your liability for unauthorized charges to $50 if you report the fraud promptly, and most banks waive the $50 as well.
If your card number was stolen but no fraudulent charges have appeared yet, you can still call your bank and ask them to cancel the card and send a replacement. There is no penalty for doing this. It is better to cancel early than to wait for fraud to appear.
Frequently Asked Questions
Can someone use my card number without the security code?
Not for online or phone purchases. Merchants require the security code for card-not-present transactions. However, a thief with your card number and expiration date could potentially use it in person if they also have the physical card, because in-store terminals do not always ask for the security code.
Is the security code the same as the CVV?
CVV stands for Card Verification Value and is the term Visa and Mastercard use for the three-digit code on the back of the card. American Express calls theirs the CID. They are the same concept — a printed code that proves you have the physical card — but the names and locations differ slightly by card brand.
What if I forget my security code?
Look at the back of your card. The security code is printed there and does not change unless you get a new card. If you have lost your card or cannot see the code clearly, contact your bank and ask for a replacement card. They will send you a new one with a new security code.
Do I need to memorize my security code?
No. The security code is printed on your card specifically so you do not have to memorize it. You only need it when you are making a purchase and the card is in front of you. Never write it down or store it anywhere except on the card itself.
Why do some websites not ask for a security code?
Some merchants, especially those you have shopped with before, may skip the security code if they have other ways to verify your identity, such as your billing address or purchase history. Large retailers sometimes use their own fraud detection systems instead of requiring the code every time. This is the merchant's choice, not a security failure.