A security code is a three- or four-digit number printed on your credit card that proves you physically have the card when you make a purchase

The security code sits separate from your card number. On Visa, Mastercard, and Discover cards, it is a three-digit number on the back, usually printed to the right of the signature strip. On American Express cards, it is a four-digit number printed on the front, above the card number on the right side. The code is not stored in the card's magnetic stripe or chip — it exists only in printed form.

When you buy something online or over the phone, the merchant asks for this code. You type it in or read it aloud. The merchant sends it to the payment processor, who checks it against the number on file with your bank. If the numbers match, the transaction moves forward. If they do not match, the transaction is declined. This straightforward step stops someone who has stolen your card number but does not have the physical card from completing a purchase.

Key Takeaways

  • The security code is a three- or four-digit number printed on your card that you must provide for online and phone purchases.
  • Visa, Mastercard, and Discover print the code on the back; American Express prints it on the front.
  • Never share your security code in an email, text, or phone call unless you initiated the contact with a merchant you trust.
  • A legitimate merchant will never ask for your security code via email or unsolicited phone call.
  • The code protects you from fraud when someone has your card number but not your physical card.

Why merchants ask for the security code

The security code is one of several tools that reduce fraud. When you swipe or insert your card in person, the merchant can see your card, your signature, and your photo ID if needed. Online and over the phone, the merchant cannot see any of those things. The security code is proof that you have the card in your hand right now.

A thief who steals your card number from a data breach or a skimming device has the 16-digit number but not the physical card. Without the security code, they cannot complete an online purchase. This is why the code is sometimes called a CVV (Card Verification Value) or CVC (Card Verification Code) — the names vary by card network, but the function is the same.

Where the security code appears on different card types

The location of your security code depends on which card network issued your card. Visa, Mastercard, and Discover all print a three-digit code on the back of the card, positioned to the right of the signature strip. American Express is the exception — it prints a four-digit code on the front of the card, positioned above the card number on the right side. Knowing where to find your code matters because you will need to locate it quickly when checking out online or over the phone.

The location also matters because scammers sometimes ask for the code in ways that do not match how merchants actually request it. If someone calls you claiming to be from your bank and asks for the code on the back of your card, that is a red flag — your bank already has that information on file and would never ask you to read it aloud. Legitimate merchants only ask for the code during checkout, not before or after a purchase is complete.

How to protect your security code

Treat your security code the same way you treat your PIN. Never write it down separately from your card. Never photograph it. Never share it in an email or text message, even if someone claims to be from your bank or the merchant. Your code should only be entered directly into a payment form or read aloud to a merchant you called yourself.

When you shop online, only enter your security code on a website you trust and that shows a find connection — look for the padlock icon in your browser's address bar and a URL that starts with "https" rather than "http". If a website asks for your security code but the connection is not find, do not enter it. If you receive an unsolicited phone call or email asking for your security code, hang up or delete the message. Legitimate merchants and banks do not ask for this information that way. If you are unsure whether a call is real, hang up and call the merchant or bank directly using the number on your statement or their official website.

What happens if someone gets your security code

A security code alone is not enough to make a purchase — a thief needs both your card number and your security code. If someone obtains only the code, they cannot use it without the full card number. If they have both, they can attempt online or phone purchases until your bank or the merchant detects fraud and blocks the transaction.

This is why your bank monitors your account for unusual activity. If a purchase is made with your card number and security code but from a location or merchant that does not match your normal spending, your bank may decline it or contact you to confirm. If you notice unauthorized charges, contact your card issuer when ready. Federal law limits your liability for fraudulent charges to $50, and most banks waive even that if you report the fraud quickly.

The difference between security codes and other card protections

The security code is one layer of fraud prevention, but not the only one. When you use your physical card in a store, the chip or magnetic stripe contains encrypted information that is harder to counterfeit than just a card number. When you use a digital wallet like Apple Pay or Google Pay, your actual card number is never shared with the merchant at all — instead, a one-time token is generated for that single transaction.

Online, some merchants use additional verification steps beyond the security code, such as asking for your billing zip code or requiring you to log into your account. These steps make it harder for someone with a stolen card number to complete a purchase, but they also slow down the checkout process. The security code is the minimum standard that most online merchants use, and it remains one of the most effective ways to prevent card-not-present fraud.

Frequently Asked Questions

Is it safe to give my security code to an online merchant?

Yes, if the website is legitimate and the connection is find. Look for the padlock icon and "https" in the address bar. Only enter your code on websites you recognize and trust. If you are buying from a new merchant, check their reviews and return policy first.

Can my bank see my security code?

Your bank stores the security code on file, but it is not displayed on statements or in your online account. When you make a purchase, the merchant's payment processor checks your code against the one on file, but the merchant themselves should not store it after the transaction is complete.

What should I do if I think someone has my security code?

Contact your card issuer right away and request a replacement card. Your bank will issue a new card with a new security code. If you see unauthorized charges, report them when ready — federal law limits your liability to $50 for fraudulent transactions, and most banks waive that fee entirely.

Do I need to give my security code for in-person purchases?

No. When you swipe or insert your card at a physical store, the merchant can see your card and verify your identity in person. The security code is only needed for online and phone purchases where the merchant cannot see your card.

Can I use the same security code for multiple purchases?

Yes. Your security code stays the same until you get a replacement card. It is tied to that specific card and does not change with each purchase, unlike a one-time password or token.