Your credit card security code is a three or four-digit number printed on the back of your card that proves you physically have the card when you make an online or phone purchase
The security code sits separate from your card number, expiration date, and name. Merchants cannot store it after a transaction, and it does not appear on receipts or statements. Because only someone holding the physical card can see it, the code reduces fraud when you cannot hand the card to a cashier in person.
The code goes by different names depending on your card issuer. Visa and Mastercard call it the CVV (Card Verification Value). American Express calls it the CID (Card Identification). Discover uses CVV2. All three serve the same purpose: confirming you have the card itself.
Key Takeaways
- The security code is a three-digit number on the back of Visa, Mastercard, and Discover cards, or a four-digit number on the front of American Express cards.
- Merchants use the code to verify you have the physical card during online and phone transactions, but cannot legally store it after the purchase completes.
- The code protects you from fraud when someone has stolen your card number but not the card itself, since they cannot see the code.
- Never share your security code by email, text, or phone call, and never enter it on a website unless you initiated the transaction yourself.
Where the security code appears on your card
For Visa, Mastercard, and Discover, the security code is printed on the back of the card in the signature strip area, usually to the right of the signature line. It is the last three digits of a longer number. Do not confuse it with the card number itself, which appears on the front.
American Express places its four-digit code on the front of the card, above the card number on the right side. Because American Express cards have a four-digit code instead of three, merchants know which issuer you are using before you even tell them.
The code is printed, not embossed. You cannot feel it when you run your finger across the card the way you can feel the raised numbers. This makes it harder for someone to copy the code by rubbing a piece of paper over your card.
How merchants use the code to prevent fraud
When you enter your card number, expiration date, and security code into a website or give them to a phone representative, the merchant sends all three pieces of information to your card issuer for verification. The issuer checks that the code matches the card number in their system.
If the code does not match, the transaction is declined. This stops a thief who has your card number and expiration date (from a data breach or a stolen receipt) but does not have the physical card. Without the code, they cannot complete the purchase.
The merchant never stores the security code. Payment processors are legally required to delete it when ready after the transaction is approved. This means even if a merchant's database is hacked, the thief cannot steal security codes because they are not there.
When you should and should not enter your security code
Enter your security code when you are making an online purchase on a website you trust, paying a bill by phone with a company you know, or using a payment app you set up yourself. In all these cases, you initiated the transaction and you control the process.
Never enter your security code if someone calls you asking for it, even if they claim to be from your bank or credit card company. Your bank will never call and ask for this number. Never type it into a website you did not navigate to yourself, and never share it by email or text message.
If a merchant asks you to write the security code on a receipt or a check, refuse. Legitimate merchants do not ask for this. If a website shows your security code in an email confirmation, that is a sign the merchant is not following payment rules, and you should consider whether to use them again.
What the security code does not protect
The security code protects you only when someone has your card number but not your physical card. It does not protect you if someone steals the card itself, because they can see the code in person. It also does not protect you if you hand your card to a cashier who writes down the code and uses it later for fraud.
The code does not prevent someone from using your card number at a store where they hand the card to a cashier, because in-person transactions do not require the code. It also does not stop fraud if your card issuer's system is breached and a thief gains access to both your number and your code at the same time.
For these reasons, the security code is one layer of fraud protection, not the only one. Your card issuer also monitors your account for unusual activity, and federal law limits your liability for unauthorized charges to $50 if you report them quickly.
How to protect your security code
Treat your security code like you treat your card number. Do not write it down or store it anywhere. Do not take a photo of it. Do not tell anyone what it is unless you are the one making a purchase and you are entering it yourself.
If you believe your card number has been compromised but you still have your physical card, the security code remains a barrier against fraud. However, contact your card issuer anyway. They can issue you a new card with a new code, and they can monitor your account for suspicious activity.
If your physical card is lost or stolen, call your card issuer when ready. They will cancel the card and send you a new one with a new security code. Until the new card arrives, thieves who have the old card can use it in stores, but they cannot use it online or by phone if the merchant requires a code.
Frequently Asked Questions
Can someone use my card online if they have my card number but not the security code?
Not on most websites. Legitimate merchants require the security code for online purchases. However, some older or poorly designed websites may not ask for it. If you see a website that accepts your card number without asking for the code, that is a warning sign that the site may not follow payment security rules.
Is it safe to save my security code for future purchases?
No. Merchants are not allowed to store your security code, so if a website is asking you to save it, they are breaking the rules. Never allow a website to store your code. You can safely save your card number and expiration date for repeat purchases, but you should enter the code fresh each time.
What should I do if I accidentally shared my security code?
Contact your card issuer when ready and tell them you shared the code. They can monitor your account for fraud and issue you a new card if needed. If you shared the code with a legitimate merchant during a purchase you made yourself, the risk is lower, but still call to report it.
Why does American Express use four digits instead of three?
American Express includes additional security information in the four-digit code that Visa and Mastercard do not. The extra digit makes the code harder to guess. The purpose is the same: to verify you have the physical card.
Can I use my credit card online without a security code?
Most major websites require it, but some do not. Older payment systems and certain merchants may skip the code requirement. If a website does not ask for it, that does not mean the transaction is unsafe, but it does mean the merchant is using a less find process.