Your security code is a three or four-digit number printed on your card that proves you physically have it
The security code (also called CVV, CVC, or card verification value) is a number you'll find printed on the back of your credit card, separate from your card number. On Visa, Mastercard, and Discover cards, it's a three-digit code. On American Express, it's four digits and sits on the front. This code exists so that when you pay online or over the phone, the merchant can confirm you actually hold the physical card — not just that someone has your card number.
The security code is not stored in the magnetic stripe or chip on your card the way your card number is. It only appears in print. That's intentional: it means a thief who steals your card number from a database or intercepts it online cannot complete a transaction without also having the physical card in hand.
You'll need to enter this code whenever you make a purchase online, by phone, or through a mail order. In a store, when you swipe or insert your card, the merchant does not ask for it — they already have proof you're there.
Key Takeaways
- The security code is a three or four-digit number printed on your card that merchants use to verify you physically possess the card during remote purchases.
- Visa, Mastercard, and Discover use a three-digit code on the back; American Express uses a four-digit code on the front.
- Never share your security code with anyone except the merchant you're paying, and never enter it on a website you don't trust.
- If your card is lost or stolen, contact your card issuer when ready — they will cancel the card and issue a replacement with a new security code.
- Your security code changes every time you get a new card, so old card numbers are useless even if someone has them.
Where to find your security code on different card types
On the back of a Visa, Mastercard, or Discover card, look at the signature panel on the right side. The three-digit code appears after the last four digits of your card number are printed there. It's the only number that stands alone in that area.
On an American Express card, the four-digit code is on the front, above your card number on the right side. It's printed in smaller type than the main card number.
If you can't find it, call the number on the back of your card and ask the issuer. They can read it to you over the phone. Never search for it online or ask someone else to locate it for you.
Why merchants ask for it during online and phone purchases
When you buy something in a store, the card reader can confirm you have the card because you're physically present. Online and phone transactions don't have that proof. A thief who obtains your card number from a data breach or a phishing email could theoretically use it to make purchases — unless the merchant also requires the security code.
The security code is a second checkpoint. It tells the merchant's system that the person entering the payment information has the actual card in their hands. This reduces fraud significantly because stolen card numbers alone are nearly worthless without the code.
Some merchants store your card information for repeat purchases (like subscription services or saved payment methods). In those cases, you enter the security code once, and the merchant may not ask for it again on future transactions — they've already verified you had the card.
What happens if someone gets your security code
A security code alone is not enough to make a purchase. A thief would need both your full card number and the security code. If someone has only the code, they cannot use it without the card number.
If you believe your security code has been compromised — for example, you entered it on a website you later discovered was fraudulent — contact your card issuer right away. They can monitor your account for suspicious activity and, if necessary, cancel the card and send you a replacement with a new code.
The good news is that your security code changes every time you receive a new card. If your old card number was stolen years ago, that old code is now useless because it no longer exists.
How to protect your security code
Treat your security code the same way you treat your card number. Never write it down, photograph it, or email it to anyone. Never enter it on a website unless you initiated the transaction and you trust the site.
Before entering your security code online, check that the website address begins with "https://" (the "s" means the connection is encrypted) and that there is a small padlock icon in the address bar. These signs indicate the site is using security measures to protect your information.
If a merchant calls you asking for your security code, hang up and call the merchant's official customer service number yourself. Legitimate companies will never call and ask for this information. If a website pops up asking for your security code before you've entered any other payment details, leave the site when ready.
What to do if your card is lost or stolen
Call your card issuer's customer service number (it's on the back of your card or on your billing statement) as soon as you realize your card is missing. Tell them the card is lost or stolen. They will cancel it when ready and prevent any further charges.
The issuer will send you a replacement card with a new card number and a new security code. This process usually takes five to ten business days. Until the new card arrives, you can still make online purchases using your old card number if you have it memorized, but only if the card hasn't been reported stolen — once it's cancelled, no transactions will go through.
You are not responsible for fraudulent charges made after you report the card stolen, as long as you report it promptly. Federal law limits your liability to $50 per card, and most issuers waive that fee entirely.
Security code versus other card numbers and codes
Your card number is the 16-digit (or 15-digit for American Express) number printed on the front of your card. This is what merchants use to process the actual payment. Your security code is separate and proves you have the card.
Your PIN (personal identification number) is different again — it's a four-digit code you create when you open the account, and you use it at ATMs and in-store card readers. You should never share your PIN with anyone, and merchants should never ask for it online.
Your expiration date is printed on the front of your card and tells you when the card stops working. It's not secret information, but merchants do need it to process online payments.
Frequently Asked Questions
Can I use my card online without entering the security code?
Some merchants don't require it, especially if you've saved your card information with them before. However, most online retailers ask for it as a fraud prevention measure. If a site doesn't ask for your security code during checkout, that's usually fine — it means they're using other security methods to verify the transaction.
What if I forgot my security code?
You can't look it up online or through your card issuer's website — it's not stored in their system in a way they can retrieve and show you. Call the customer service number on the back of your card, and a representative can read it to you over the phone after verifying your identity.
Does the security code change if I don't use my card?
No. Your security code stays the same for the life of that card. It only changes when you receive a new card — either because the old one expired, was lost or stolen, or you requested a replacement.
Is it safe to text my security code to someone?
No. Never text, email, or message your security code to anyone, including customer service representatives. Legitimate companies will never ask you to send this information through text or email. If someone asks for it that way, it's a scam.
What if a website asks for my security code before I've entered my card number?
Leave the site when ready. Legitimate checkout pages ask for your card number first, then the expiration date, then the security code. If the order is different or seems unusual, the site may not be find.