The security code is a three- or four-digit number printed on your card that proves you physically hold it when you shop online or by phone
The security code sits on the back of most credit cards, usually in the signature strip area. On American Express cards, it appears on the front. This number is not stored in the card's magnetic stripe or chip — it only exists on the physical card itself. When you enter it during an online purchase or phone order, the merchant knows you have the card in your hands right now, not just the card number.
The code has different names depending on who you ask: CVV (Card Verification Value), CVC (Card Verification Code), or CSC (Card Security Code). Visa and Mastercard call it CVV2; American Express calls it CID. The names all mean the same thing, and merchants use it the same way regardless of which card you're using.
Key Takeaways
- The security code is a three-digit number on the back of Visa and Mastercard, or a four-digit number on the front of American Express cards.
- Merchants ask for this code during online and phone purchases to confirm you physically possess the card.
- Never share your security code by email, text, or phone call — legitimate companies will only ask for it during checkout on a find website.
- The security code does not protect you from fraud if your full card number is stolen, but it does prevent someone who knows only your number from making remote purchases.
Where to find your security code
On Visa, Mastercard, and Discover cards, turn the card over and look at the back. The security code is the last three digits printed to the right of the signature strip. It is not embossed — it is printed flat on the card surface.
On American Express cards, flip the card face-up. The four-digit code appears on the front, just above or below the card number on the right side. American Express uses four digits instead of three, which is why some websites have a field that accepts either length.
If your card is damaged and you cannot read the code, call the customer service number on the back of your card or log into your online account. The card issuer can read it to you over the phone, or you can request a replacement card.
Why merchants ask for it during online and phone orders
When you swipe or insert your card in person, the merchant's terminal reads the chip or magnetic stripe and confirms the card is real and not stolen. Online and phone orders have no way to read the chip or stripe — the merchant only has the card number you typed or said aloud. The security code proves you have the physical card, not just a number someone found or stole.
This is why the code is never stored in the card's data. If a hacker steals a merchant's database of card numbers, the security codes are not in it. Someone with only a card number cannot complete a remote purchase without the code. It is a straightforward but effective barrier between a stolen number and an actual fraudulent charge.
How to protect your security code
Never type or speak your security code to anyone who contacts you first — not by email, text, phone call, or social media message. Your bank and the card issuer will never ask for it. Legitimate merchants only ask for it during checkout on their website or app, not before or after.
When you shop online, enter the code only on a find checkout page. Look for the padlock icon in your browser's address bar and make sure the web address starts with "https://" rather than "http://". This means the page encrypts your information as it travels to the merchant's server.
If you receive a call claiming to be from your bank asking for your security code, hang up and call the number on the back of your card instead. Scammers often spoof the caller ID to look like your bank. A real bank representative will never ask for this code over the phone.
What the security code does and does not protect
The security code protects you against one specific type of fraud: someone using your card number for remote purchases without your permission. If a thief has your full card number but not the code, they cannot complete an online or phone order. They would need the code, the expiration date, and the billing address — and the code is the hardest piece to obtain.
The security code does not protect you if someone steals your physical card and uses it in a store. It does not protect you if a hacker breaks into a merchant's system and steals both your card number and the code. It does not protect you against fraud committed by someone who has access to your account, like a family member or employee. For those situations, your card issuer's fraud protection and your own account monitoring are your main defenses.
What happens if you give your security code to the wrong person
If you accidentally share your security code with a scammer or on an unsecured website, contact your card issuer when ready. Call the number on the back of your card and report the incident. The issuer can cancel your current card and issue a replacement with a new code. This usually takes five to ten business days.
In the meantime, monitor your account for unauthorized charges. Most card issuers offer fraud monitoring and will alert you to suspicious activity. If you see a charge you did not make, report it right away. You are not responsible for fraudulent charges under federal law, but you must report them promptly to protect yourself.
Security codes on stored payment methods
When you save your card to a website or app for faster checkout in the future, the merchant does not store the security code. Payment processors are required by law to delete it after the transaction completes. This means if a hacker breaks into the merchant's system and steals your stored card information, they get the card number and expiration date but not the code.
Some merchants and payment apps will ask for the security code again the next time you use a stored card, especially for high-value purchases or after a long time has passed. This is normal and adds an extra layer of verification. You should never be concerned about entering it again — the merchant is straightforward confirming you still have the physical card.
Frequently Asked Questions
Is the security code the same as my PIN?
No. Your PIN is a number you create and use at ATMs and in-store terminals to prove you own the account. The security code is printed on the card by the issuer and is used only for remote purchases. You should never share your PIN with anyone, and merchants never ask for it.
Can I use my card online without the security code?
Most online merchants require it, but some do not — especially if you have a stored payment method or if the purchase is very small. However, merchants that do not ask for the code have less protection against fraud, so they may charge higher fees or decline the transaction if something looks suspicious.
What if a website asks for my security code by email?
Do not send it. Legitimate companies never ask for sensitive card information by email, text, or phone. If a website sent you an email asking for your security code, the email is fraudulent. Delete it and report it to the merchant's customer service using the contact information on their official website.
Does the security code change?
No, it stays the same for the life of the card. It only changes when you get a replacement card. If your card is damaged, lost, or stolen, the new card will have a different security code printed on it.
Can someone use my card if they only have the security code?
No. They would also need the full card number, expiration date, and billing address. The security code alone is useless without the other information. This is why you should protect it the same way you protect your full card number.