The security code is a three- or four-digit number printed on your card that proves you physically hold it
The security code — also called a CVV, CVC, or card verification value — is a short number printed on your credit card that you enter when you buy something online or over the phone. It is not encoded in the card's magnetic stripe or chip. A merchant who asks for it is checking that you have the actual card in your hand, not just the card number.
The code lives in different places depending on your card type. On Visa, Mastercard, and Discover cards, it is a three-digit number on the back, usually near your signature. On American Express cards, it is a four-digit code on the front, above your card number. The code changes nothing about how your card works — it is purely a fraud-prevention tool.
Key Takeaways
- The security code is printed on your card but not stored in the magnetic stripe, so online merchants use it to verify you have the physical card.
- Visa, Mastercard, and Discover use a three-digit code on the back; American Express uses a four-digit code on the front.
- You should never give your security code to anyone who calls you or emails you, even if they claim to be from your bank.
- Entering a security code online does not make a transaction safer than swiping your card in person, but it does confirm you have the card.
Why merchants ask for it during online and phone purchases
When you swipe or insert your card at a store, the cashier can see you and the card at the same time. Online and phone transactions do not have that check. A thief with only your card number and expiration date can try to buy things without owning the card. The security code is a quick way for the merchant to confirm you have the physical card in front of you.
The merchant never stores the security code. Payment processors are legally forbidden from keeping it after the transaction goes through. This means even if a hacker breaks into a store's database and steals card numbers, the security codes are not there to steal. The code is checked in real time and then discarded.
How it differs from your card number and expiration date
Your card number and expiration date are printed on the front of your card and are meant to be shared — you give them to merchants every time you buy something. The security code is different: it is printed on the card but is not supposed to be stored anywhere after you use it.
If someone has your card number and expiration date, they can attempt online purchases, but most merchants will decline the transaction if no security code is provided. If someone has all three pieces of information, the risk is higher, which is why you should treat your security code as more sensitive than your card number. Never write it down, never text it, and never say it out loud to someone who calls you.
What to do if you think your security code has been compromised
If you gave your security code to someone you did not trust, or if you saw an unauthorized charge on your statement, contact your card issuer right away. Call the number on the back of your card — not a number from an email or text message. Tell them what happened and ask them to review recent transactions.
Your card issuer can cancel your current card and issue a new one with a new security code. The new code will be different from the old one, which is why replacing the card stops the old code from being useful. This process usually takes five to ten business days. In the meantime, you can still use your card online if your issuer gives you a temporary number, or you can use a different payment method.
Red flags: when someone should never ask for your security code
Your bank, credit card company, or any government agency will never call you and ask for your security code. They already have your account information and do not need it. If someone calls or emails claiming to verify your account and asks for the code, hang up or delete the message. This is a common scam.
Legitimate merchants also will not ask you to say your security code out loud over the phone. If you are making a phone purchase with a real company, they may ask you to read it, but they should not ask you to repeat it or confirm it multiple times. If something feels wrong, end the call and contact the merchant directly using a phone number from their official website.
How security codes work on different card types
Visa, Mastercard, and Discover all use the same system: a three-digit code printed on the back of the card, to the right of the signature panel. American Express works differently — the code is four digits and appears on the front of the card, above the card number on the right side. Some older American Express cards printed the code on the back, but newer ones moved it to the front.
Debit cards issued by Visa or Mastercard use the same three-digit code as credit cards. Prepaid cards and gift cards may or may not have a security code, depending on the issuer. If your card does not have one printed on it, you will not be able to enter one during online checkout, and some merchants may decline the transaction.
The limits of security codes as fraud protection
A security code is one layer of fraud prevention, but it is not a complete shield. It stops someone who has only your card number from making online purchases, but it does not protect you if your full card information — including the code — is stolen. It also does not protect you if someone uses your card in person at a physical store, because the code is not checked during in-person transactions.
The strongest fraud protection comes from monitoring your account regularly, setting up transaction alerts with your card issuer, and reporting unauthorized charges within 60 days. Many card issuers also offer zero-liability protection, meaning you are not responsible for fraudulent charges if you report them promptly. Read your card's terms to understand what protection you have.
Frequently Asked Questions
Can someone use my card if they have the number but not the security code?
They can try, but most online merchants will decline the transaction without a security code. In-person purchases do not require a code, so a thief with a physical card or a cloned card could still use it at a store. This is why monitoring your account and reporting lost or stolen cards quickly matters more than the code alone.
Is it safe to type my security code into a website?
It is as safe as any online purchase. Look for "https://" in the address bar and a lock icon, which means the connection is encrypted. Never enter your security code on a website you reached by clicking a link in an email or text message — go directly to the merchant's official website instead. Scammers often create fake checkout pages that look real.
What if I forgot my security code?
Look at the back of your physical card — it is printed there. If you do not have your card with you, contact your card issuer and they can read it to you over the phone after verifying your identity. They will not ask you to confirm it; they will tell you what it is.
Do I need to memorize my security code?
No. You should never write it down or save it anywhere, but you do not need to memorize it. Keep your physical card in a safe place and enter the code from the card itself each time you need it. This habit — looking at the card each time — also helps you notice if your card has been lost or stolen.
Can a security code prevent identity theft?
A security code only prevents someone from using your card number online without the physical card. It does not protect your Social Security number, address, or other personal information. Identity theft involves more than card fraud. Monitor your credit report and set up fraud alerts with the credit bureaus if you think your identity has been compromised.