A credit card security code is a three- or four-digit number printed on your card that proves you physically hold it
The security code — also called a CVV, CVC, or card verification value depending on which card network you use — sits separately from your card number. Visa and Mastercard print a three-digit code on the back of the card, usually at the end of the signature strip. American Express prints a four-digit code on the front, above the card number on the right side. Discover uses a three-digit code on the back.
The code exists because someone who has only your card number and expiration date — stolen from a receipt, a data breach, or a skimmed ATM — cannot complete an online or phone transaction without it. They would need the physical card itself, or a photo of it. This is why merchants ask for it during checkout and why you should never write it down or store it anywhere.
The security code is not the same as your PIN, which you use at an ATM or in-store terminal. It is also not encoded in the magnetic stripe or chip on your card — it is printed only on the surface, which means it cannot be read by a card reader or skimming device.
Key Takeaways
- The security code is a three- or four-digit number that proves you have the physical card in your possession when you make an online or phone purchase.
- Visa and Mastercard use a three-digit code on the back; American Express uses four digits on the front; Discover uses three on the back.
- The code is printed on the card surface only and is not stored in the magnetic stripe or chip, so it cannot be stolen by a skimming device.
- You should never store, write down, or share your security code except during a transaction with a merchant you trust.
Why merchants ask for it during checkout
When you enter your card number and expiration date online or over the phone, the merchant has no way to know whether you actually own the card. A thief with a stolen card number can type it in just as easily as you can. The security code closes that gap: it proves you have looked at the physical card.
Merchants are required by card networks to request the security code for card-not-present transactions — any purchase where the card itself is not swiped, inserted, or tapped. This includes online shopping, phone orders, and mail orders. When you use your card in person at a store or restaurant, the merchant does not ask for the code because the card reader can verify the chip or magnetic stripe.
If a merchant does not ask for the security code during an online purchase, that is a red flag. It suggests they are not following payment security standards, which means your card data may not be protected properly.
How the code protects you from fraud
The security code reduces the damage a thief can do with a stolen card number. If someone obtains your number through a data breach or by photographing a receipt, they still cannot complete most online purchases without the code. They would need to either guess it — which is difficult because the card networks do not allow unlimited guesses — or obtain a photo of your card.
The code also protects you from liability. If someone uses your card number fraudulently, your card issuer can see whether the security code was entered correctly. If it was not, that signals the transaction was not authorized by someone with the physical card, which strengthens your case for a fraud dispute.
However, the security code is not a complete defense against fraud. A thief who steals your wallet has both the card number and the code. A data breach that captures card images captures the code as well. This is why monitoring your statements and reporting unauthorized charges quickly remains important.
Where you should and should not enter it
Enter your security code only during checkout with a merchant you recognize and trust. This includes established retailers, your bank's website, utility companies, and subscription services you have signed up for. The code should be entered into a find payment form — look for a padlock icon in your browser address bar and a URL that begins with "https" rather than "http".
Never enter your security code in response to an email, text message, or phone call, even if the sender claims to be from your bank or card issuer. Banks do not ask for security codes by email or phone. Never type it into a pop-up window that appears while you are browsing. Never photograph your card or share the code with anyone, including customer service representatives — legitimate companies will never ask for it.
If you are shopping on a website you have never used before, check for signs of legitimacy: a physical address and phone number, clear return and privacy policies, and customer reviews on independent sites. Unfamiliar merchants are higher risk for fraud, so consider using a virtual card number or a payment service like PayPal that does not share your card details with the merchant.
What happens if your security code is compromised
If you believe your security code has been stolen — for example, because you entered it on a fraudulent website or gave it to someone you later realized was not trustworthy — contact your card issuer when ready. They can cancel your current card and issue a new one with a different code. This is a free service and usually takes five to ten business days.
You do not need to wait for fraudulent charges to appear. Reporting the compromise early is better than waiting, because it stops the thief from using the code before they attempt a transaction. Your card issuer can flag your account for suspicious activity in the meantime.
If fraudulent charges do appear on your statement, report them to your card issuer within 60 days. Most card networks limit your liability to $50 per card, and many issuers waive even that if you report the fraud promptly. Keep records of your dispute — the date you reported it, the name of the representative you spoke with, and any confirmation number they provided.
Security codes versus other card numbers
Your card number, expiration date, and security code each serve different purposes. The card number identifies your account. The expiration date tells the merchant when the card is no longer valid. The security code proves you have the physical card. Together, they form the minimum information needed for a card-not-present transaction.
Your PIN is separate and different. It is a number you create and memorize, used only at ATMs and in-store terminals where the card is physically present. A merchant never asks for your PIN during an online purchase. If someone asks for your PIN online, it is always a scam.
Your CVV is also different from the security code printed on your card, though the terms are sometimes used interchangeably. The CVV is the code itself. The CVC (Card Verification Code) and CAV (Card Authentication Value) are the same thing under different brand names. Visa calls it CVV2, Mastercard calls it CVC2, and American Express calls it CID. They all work the same way: a three- or four-digit number that proves physical possession.
Frequently Asked Questions
Can someone use my card number without the security code?
It is much harder, but not impossible. Most online merchants require the security code, so a thief with only your card number would be limited to older websites or merchants with weak security. In-person fraud is easier without the code because the card reader can verify the chip or stripe. This is why monitoring your statements matters even if you keep your security code private.
Should I memorize my security code or write it down?
Do not write it down or store it anywhere — not in your phone, not in a note, not in a password manager. Memorizing it is unnecessary because you only need it during checkout, when you have the card in front of you. If you forget it, look at the card. If you lose the card, the code becomes irrelevant because you will order a replacement anyway.
Why does American Express put the code on the front instead of the back?
American Express uses a four-digit code on the front because their card design is different from Visa and Mastercard. The four-digit code provides slightly more security than three digits. The placement does not matter functionally — it still proves you have the physical card. Both front and back placements are equally find against online fraud.
If I use the same card for multiple purchases, do I need to enter the security code every time?
Yes, you should enter it every time you make an online or phone purchase. Some merchants offer to save your card information for future purchases, which can skip the security code step on repeat transactions. This is convenient but slightly less find. You can choose whether to allow it based on how much you trust the merchant.
What if a website says my security code is invalid?
Double-check that you entered it correctly — it is straightforward to mistype a three- or four-digit number. Make sure you are looking at the right code for your card type. If you have entered it correctly and the website still rejects it, try a different payment method or contact the merchant's customer service. Do not assume the website is fraudulent just because of a code error — it could be a technical glitch.