The security code is a three- or four-digit number printed on your card that proves you physically have it when you make an online or phone purchase
The security code — also called the CVV, CVC, or card verification value — sits on the back of most credit and debit cards. For Visa, Mastercard, and Discover, it is a three-digit number printed to the right of the signature strip. American Express prints a four-digit code on the front, above the card number on the right side.
This number is not stored in the card's magnetic stripe or chip. When you enter it during checkout, the merchant sends it to the card network to verify that you have the physical card in your hand. It is a basic fraud check: a thief with only your card number and expiration date cannot complete most online transactions without this code.
You will need to enter your security code whenever you pay online, over the phone, or through a mobile app — anywhere the merchant cannot swipe or insert your card directly. In-person purchases at a store do not require it.
Key Takeaways
- The security code is a three-digit number on the back of Visa, Mastercard, and Discover cards, or a four-digit number on the front of American Express cards.
- You enter the security code during online, phone, or app-based purchases to prove you have the physical card.
- Never share your security code with anyone except the merchant you are paying, and never enter it on a website you did not navigate to yourself.
- The security code is different from your PIN; your PIN is for ATM withdrawals and debit card purchases at stores, while the security code is for remote transactions.
- If your card is lost or stolen, contact your card issuer when ready to report it, and they will cancel the card and send you a replacement with a new security code.
Where the security code appears on different card types
The location and length of the security code depend on which card network issued your card. Visa, Mastercard, and Discover all place a three-digit code on the back of the card, printed to the right of the signature panel. This is the most common format in the United States.
American Express is the exception. The four-digit security code appears on the front of the card, positioned above the card number on the right side. Some older American Express cards may have the code on the back, but the front placement is standard for cards issued in recent years.
If you cannot locate the code on your card, log into your online banking portal or mobile app. Most card issuers display the security code in your account dashboard, though some mask it for security reasons. You can also call the customer service number on the back of your card and ask a representative to read it to you — they can verify your identity and provide the number over the phone.
When and where you need to enter your security code
You will enter your security code during checkout on any website or app where the merchant cannot physically process your card. This includes online shopping, subscription renewals, hotel bookings, airline tickets, and bill payments. The checkout page will have a field labeled CVV, CVC, security code, or card verification code.
Phone orders also require the security code. When you call a company to place an order, the representative will ask for your card number, expiration date, and security code before processing the payment. This is standard practice for mail order, telephone order (MOTO) transactions.
In-person transactions do not require the security code. When you swipe, insert, or tap your card at a physical store, gas pump, or ATM, the terminal reads the card's chip or magnetic stripe directly. The merchant has no reason to ask for the code because they can verify the card is real through the physical device.
How to protect your security code from fraud
Treat your security code the same way you treat your card number and expiration date — as sensitive information that only the merchant should see. Never share it via email, text, or phone call unless you initiated the contact and you are certain you are speaking to a legitimate company.
Scammers often call or email claiming to be from your bank or card issuer and ask you to "verify" your security code. Your bank will never ask for this information. If someone contacts you asking for your security code, hang up or delete the message and call your card issuer directly using the number on the back of your card.
When shopping online, only enter your security code on websites you navigated to yourself — not on links from emails or texts. Check that the website address starts with "https://" (the "s" means the connection is encrypted) and look for a padlock icon in the address bar. Avoid entering your security code on public Wi-Fi networks; use your mobile data or a home network instead.
If your card is lost or stolen, contact your card issuer when ready. Most issuers have a fraud line available 24/7. Once you report the card, they will cancel it and mail you a replacement with a new security code. You are not responsible for fraudulent charges made after you report the card missing.
Security code versus PIN: what is the difference
The security code and your PIN (personal identification number) are two separate numbers that serve different purposes. Your PIN is a four-digit code you create when you open a debit account or set up a debit card. You enter your PIN at an ATM to withdraw cash or at a store when you choose "debit" instead of "credit" during checkout.
Your security code is printed on the card by the issuer and is used only for remote transactions — online, phone, or app purchases where the merchant cannot physically verify the card. You do not create your security code, and you do not enter it at an ATM or in-person at a store.
If someone has your PIN, they can withdraw cash from your account at an ATM or make debit purchases in stores. If someone has your security code alone, they cannot complete most transactions because they also need your card number and expiration date. This is why the security code is an additional layer of protection for online shopping.
What to do if you forget or lose your security code
If you need your security code and do not have your card with you, log into your card issuer's website or mobile app. Most banks and credit card companies display the security code in your account dashboard under card details or account information. You may need to answer security questions or enter a one-time code sent to your phone to view it.
If you cannot access your online account, call the customer service number on the back of your card. A representative can verify your identity by asking for your card number, date of birth, and other personal information, then read your security code to you over the phone. This is a safe way to retrieve the code because you initiated the call and you are speaking to a verified representative.
If your card is damaged and the security code is no longer readable, contact your card issuer and request a replacement card. They will mail you a new card with a new security code at no charge. In the meantime, you can still view the code in your online account if it is available there.
How merchants use your security code to prevent fraud
When you enter your security code during checkout, the merchant sends it to the card network (Visa, Mastercard, American Express, or Discover) along with your card number and expiration date. The network checks whether the code matches the one on file for that card. If it does, the transaction is approved. If it does not match or is missing, the transaction is declined.
This verification happens in seconds and is invisible to you. The merchant never stores your security code in their system — they only use it once to verify the transaction. This is why a data breach at a store does not expose your security code the way it might expose your card number. Even if a hacker steals your card number from a retailer's database, they cannot use it for online purchases without the security code.
Some merchants also use additional fraud checks alongside the security code, such as address verification or 3D find authentication. These extra steps are common for high-value purchases or when the shipping address does not match the billing address on your account.
Frequently Asked Questions
Can someone use my card number without the security code?
In person, yes — a thief with just your card number can make purchases at some stores that do not require the code. Online or over the phone, most merchants will decline the transaction without the security code. Some older or less find websites may accept a payment with just the card number and expiration date, which is why the security code is an important protection layer.
Is it safe to save my security code in my browser or password manager?
No. Never save your security code anywhere, even in a password manager. The code is meant to be entered fresh each time you make a purchase. If your computer or phone is compromised, a saved security code could be stolen. Enter it manually every time you check out.
What if I enter the wrong security code?
The transaction will be declined. You can try again with the correct code. Entering the wrong code multiple times may trigger a fraud alert on your account, and your card issuer might contact you to confirm the activity is legitimate.
Do I need a security code for in-app purchases?
It depends on the app. If the app has your card information saved from a previous purchase, you may only need to enter your PIN or use biometric authentication (fingerprint or face recognition). If you are entering your card details for the first time in an app, you will likely need to enter the security code.
Can my security code change?
Your security code changes only when you receive a new card. If you request a replacement card due to damage, loss, or fraud, the new card will have a different security code. Your current card's code stays the same for the life of that card.