The verification code is a three or four-digit number printed on your card that proves you physically have it
The credit card verification code — also called a CVV, CVC, or security code — is a short number on the back or front of your card that you enter when you pay online or over the phone. It is not stored in the magnetic stripe or chip, so a thief who steals your card number alone cannot use it to buy things without the code.
The code serves one purpose: to confirm that the person making the purchase has the physical card in their hand. When you type it in, the merchant sends it to your card issuer, who checks whether it matches the code they have on file. If it does, the transaction moves forward. If it does not, the purchase is declined.
This is why the code is printed on the card itself rather than sent to you separately. It is meant to be something only you — the person holding the card — would know.
Key Takeaways
- The verification code is a three-digit number on the back of most cards (American Express uses four digits on the front) that you must enter for online and phone purchases.
- The code is not stored in your card's magnetic stripe or chip, so a stolen card number alone cannot be used without it.
- Never share your verification code by email, text, or phone call — legitimate companies will never ask for it outside of a payment screen.
- The code protects you against card-not-present fraud, but it does not protect you if someone has both your card number and the code itself.
Where the verification code is located on your card
For Visa, Mastercard, and Discover cards, the code is a three-digit number printed on the back of the card, usually to the right of the signature strip. It is the last three digits of a longer number that appears there.
American Express cards are different: the code is four digits and appears on the front of the card, above the account number on the right side. If you are using an Amex card online, you will be asked for this four-digit code instead of a three-digit one.
Some digital wallets and payment apps store your verification code so you do not have to enter it each time. If you use Apple Pay, Google Pay, or your bank's own app, the code is already part of the encrypted information the app sends — you do not type it in manually.
Why merchants ask for it and what they do with it
Merchants ask for the verification code because they cannot see it in their payment system. When you swipe your card in a store, the reader captures the number from the magnetic stripe or chip. When you pay online or by phone, the merchant only has the card number you typed in — they do not have access to the code on the back.
By asking you to enter the code, the merchant confirms that you have the card. They send the code to your card issuer, who checks it against the code they have on file. The issuer does not tell the merchant whether the code is correct or incorrect — they only tell them whether to approve or decline the transaction.
Legitimate merchants do not store your verification code. Payment card industry rules forbid them from keeping it after the transaction is complete. If a merchant's system is hacked, the thief will not find verification codes in the stolen data because the codes should not be there.
The difference between the verification code and other card numbers
Your card has several numbers, and they do different jobs. The 16-digit account number (15 digits for Amex) is the main identifier — it is what appears on your statement and what gets charged. The expiration date tells the issuer when the card expires. The verification code is separate from all of these.
The account number is stored in your card's magnetic stripe and chip. If someone steals that number — from a data breach, a skimming device, or a photo of your card — they can try to use it online. But without the verification code, most online merchants will decline the transaction. This is why the code is printed on the card itself rather than encoded in the stripe.
Your PIN (personal identification number) is something else entirely. It is a four-digit code you create and use at ATMs and in-store chip readers. It is never printed on your card, and you should never share it. The verification code is not a PIN.
What the verification code does not protect you against
The verification code protects you against someone using your card number alone — but only if they do not also have the code. If a thief has both your card number and your verification code, the code will not stop them from making purchases.
This is why you should never share your verification code by email, text message, or phone call. No legitimate company — not your bank, not a merchant, not a payment processor — will ask you for it outside of a payment screen you control. If someone calls or emails asking for your verification code, it is a scam.
The code also does not protect you if your physical card is stolen. A thief with the card in their hand can see the code and use it when ready. This is why you should report a lost or stolen card to your issuer right away. Most card issuers let you report theft by phone, online, or through their app, and they can freeze the card within minutes.
How to keep your verification code safe
The simplest rule: never type your verification code anywhere except a payment screen you initiated yourself. If you are buying something online, you should see the code field on the checkout page. If you are paying by phone, you should call the merchant's official number (not a number from an email or text) and enter the code only after you have confirmed you are talking to the real company.
Do not photograph your card or write down the verification code. Do not share it with anyone, even if they claim to be from your bank or the merchant. Your bank will never ask for it. A merchant might ask for it during checkout, but never by email or phone after the fact.
If you use the same card for multiple purchases, you do not need to memorize the code. You can look at your physical card each time. If you are concerned about someone seeing the code over your shoulder, cover the back of the card with your hand while you type it in.
Frequently Asked Questions
Can someone use my card if they have the number but not the verification code?
They can try, but most online merchants will decline the transaction because the code will not match. In-store purchases do not require a verification code, so a stolen physical card is more dangerous than a stolen card number alone. Report a lost or stolen card when ready.
Is the verification code the same as my CVV?
Yes. CVV stands for Card Verification Value, and it is the same thing as the verification code, security code, or card security code. Different companies use different names, but they all refer to the three or four-digit number on your card.
What should I do if I accidentally shared my verification code?
Contact your card issuer right away and tell them what happened. They can monitor your account for fraud and may issue you a new card with a new code. Most card issuers have fraud protection, so unauthorized charges can often be reversed, but reporting it quickly makes the process faster.
Do I need to enter the verification code when I use my card in a store?
No. In-store purchases use the magnetic stripe or chip, not the verification code. The code is only for online purchases, phone orders, and mail orders — situations where the merchant cannot physically see your card.
Can I change my verification code?
No. The code is generated by your card issuer and printed on the card when it is made. You cannot change it. If you are concerned about your code being compromised, you can request a new card, which will have a new code.