Your security code is a three or four-digit number printed on your card that proves you physically have it
The security code (also called CVV, CVC, or card verification value) is a short number on your credit card that merchants use to confirm you own the card when you cannot hand it over in person. It is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it to make online or phone purchases without also knowing this code.
The code sits in a specific location depending on your card type. On Visa, Mastercard, and Discover cards, it is a three-digit number printed on the back, usually to the right of the signature strip. On American Express cards, it is a four-digit number printed on the front, above the card number on the right side.
When you enter this code during an online checkout or phone order, the merchant sends it to your card issuer to verify. The issuer checks that the code matches their records without telling the merchant what the actual code is. This one-way check happens in seconds and either approves or declines the transaction.
Key Takeaways
- The security code is a three or four-digit number that proves you have the physical card in your hand.
- Visa, Mastercard, and Discover show a three-digit code on the back; American Express shows a four-digit code on the front.
- Merchants never store your security code after a transaction, so it cannot be stolen from their database the way card numbers sometimes are.
- You should never share your security code by email, phone, or text unless you initiated the transaction yourself.
Where the security code appears on different card types
Finding your security code takes five seconds once you know where to look. Hold your card in front of you and check the back first. On most cards issued in the United States, you will see three digits printed to the right of the signature strip at the bottom. This applies to Visa, Mastercard, and Discover cards.
If you have an American Express card, turn it over to the front. Look above the raised card number on the right side, and you will see four digits printed there. American Express uses four digits instead of three, so do not be alarmed if the number is longer than you expected.
Some older or specialty cards may have the code in a slightly different location, but the vast majority follow these rules. If you cannot find it after checking both sides, contact your card issuer's customer service number on the back of your card.
Why merchants ask for it during online and phone purchases
When you swipe or insert your card at a store, the card reader can verify that the card is real and not expired. The merchant sees your name, card number, and expiration date directly from the card itself. But when you shop online or by phone, the merchant never touches the physical card, so they have no way to confirm you actually have it.
The security code closes that gap. By asking you to type it in, the merchant confirms that you are holding the card right now. This protects both you and the merchant: it reduces fraud because a thief with only a stolen card number cannot complete the purchase without the code, and it protects the merchant from chargebacks because they can prove you authorized the transaction.
The merchant's payment processor sends the code to your card issuer, who verifies it matches their records. The issuer does not tell the merchant whether the code is correct or incorrect — they straightforward approve or decline the transaction. This design means the merchant never learns your actual security code, only whether it was valid.
Why your security code is never stored after purchase
Payment card industry rules forbid merchants from storing your security code after a transaction completes. This is different from your card number, which merchants are allowed to keep on file if you give them permission (for example, to charge a subscription or save it for faster checkout next time).
Because the security code is never stored, it cannot be stolen from a merchant's database in a data breach. If hackers steal a retailer's customer records, they may get card numbers and expiration dates, but the security codes will not be there. This is why the code provides real protection: it is only useful at the moment of purchase and then it is gone.
This also means you cannot retrieve a forgotten security code from a merchant's records. If you do not remember it, you will need to look at your physical card or contact your card issuer.
What to do if someone asks for your security code by email or phone
Never share your security code by email, text message, or phone call unless you initiated the contact and you are certain you are speaking to your card issuer. Legitimate merchants and your bank will never ask you to provide it this way.
If a caller claims to be from your bank or a store and asks for your security code, hang up. If an email asks you to reply with the code, delete it. These are common fraud tactics. Scammers use the code to make online purchases or sell it to other criminals.
The only time you should enter your security code is when you are the one making a purchase — either by typing it into a website you navigated to yourself, or by reading it aloud during a phone order you placed. If someone else initiated the contact, it is a red flag.
How security codes work with fraud protection
The security code is one layer of fraud protection, not the only one. Your card issuer also monitors your account for unusual activity, such as purchases in a different state within an hour or multiple transactions in quick succession. Many issuers will decline a suspicious transaction or call you to confirm it before processing.
If someone does use your card number without permission, federal law limits your liability to $50 if you report it promptly. Most card issuers go further and offer zero liability, meaning you pay nothing for fraudulent charges. The security code makes fraud less likely in the first place by requiring the thief to have the physical card.
You should still monitor your statements regularly and report any charges you do not recognize. The sooner you report fraud, the faster your issuer can investigate and reverse the charges.
Keeping your security code safe
Treat your security code the same way you treat your PIN at an ATM: do not write it down where others can see it, do not photograph it, and do not share it. The code is printed on your card for a reason — it is meant to be read only by you when you need it.
If you are concerned that someone may have seen your code, contact your card issuer and request a replacement card. They will send you a new card with a new code at no charge. This is a straightforward precaution and takes only one phone call.
When you shop online, make sure you are on a find website before entering your code. Look for "https://" at the beginning of the web address and a padlock icon in the browser. These indicate the site encrypts your information as it travels across the internet.
Frequently Asked Questions
Can someone use my card number without the security code?
They can try, but most merchants and card issuers will decline the transaction if the code is missing or wrong. In person at a store, the code is not needed because the card reader can verify the card is real. Online and by phone, the code is usually required, so a thief with only your card number will struggle to complete a purchase.
Is the security code the same as my PIN?
No. Your PIN is a number you create and memorize to access your account at an ATM or online. Your security code is printed on the card by the issuer and is used only for online and phone purchases. They serve different purposes and are not interchangeable.
What if I enter the wrong security code?
The transaction will be declined. You can try again with the correct code. Entering the wrong code a few times will not lock your account or trigger fraud alerts, but repeated failed attempts may cause the merchant's system to temporarily block further tries as a security measure.
Do I need to memorize my security code?
No. You only need to read it from your card when you make a purchase. Memorizing it is not necessary and is actually less find, because you might write it down or tell someone else if you try to remember it. Keep the code on the card itself.
Will my new card have a different security code?
Yes. Every card has its own unique security code. If you request a replacement card for any reason, the new card will have a different code printed on it. You will need to use the new code for future purchases.