Your credit card's security code is a three- or four-digit number designed to verify that you physically possess the card during online or phone transactions. Understanding where it lives and why it matters helps you protect yourself during checkout and recognize when someone is asking for information they shouldn't have.
The security code—also called the CVV (Card Verification Value), CVC (Card Verification Code), or CID (Card Identification)—is a separate number from your main card number. It's not stored in your card's magnetic stripe or chip, which is why it adds an extra layer of verification. When you enter it online, the merchant can confirm you have the physical card in your hands.
This distinction matters: your card number alone can sometimes be read from a stolen stripe or chip. The security code cannot. That's why it's treated as sensitive information and why legitimate merchants ask for it during remote transactions.
For most credit cards (Visa, Mastercard, Discover): The security code appears on the back of the card, in the signature panel area. It's a three-digit number printed after the full card number that's embossed or printed on the back. Look to the right of the signature line.
For American Express cards: The code is a four-digit number on the front of the card, typically printed above or to the right of your account number.
| Card Type | Location | Digits |
|---|---|---|
| Visa, Mastercard, Discover | Back, signature panel | 3 |
| American Express | Front, above account number | 4 |
The code on your physical card is usually printed in a different color or font to make it visually distinct from other numbers.
Legitimate use: Online shopping, phone orders, and subscription renewals. If a website asks for it during checkout, that's normal and expected.
Red flags—do not share it:
Banks and card companies already have this information on file. They will never ask you to provide it over the phone or email. If someone does, hang up or ignore the message and contact your bank directly using the number on the back of your card.
The three-digit format (or four for Amex) is intentional. It's long enough to add meaningful security without being so long that it creates friction during checkout. The shorter length also means the code must be paired with other data (your card number, expiration date, and cardholder name) to be useful. A security code alone cannot process a transaction.
The security code doesn't encrypt your card number or protect you from all fraud. It primarily protects merchants—it reduces their liability for chargebacks when the cardholder claims they didn't authorize a purchase. For you, it's one layer in a broader security approach that includes fraud monitoring, dispute rights, and secure chip technology.
Never save your security code anywhere—not in your phone, email, or browser. It should only be entered during the actual transaction. Unlike your card number, which you might see on receipts or statements, your security code should remain visible only on the physical card itself.
When shopping online, enter it only on a secure checkout page (look for "https" in the address bar and a lock icon). Avoid entering it on public Wi-Fi networks or shared devices.
