The security code is a three- or four-digit number printed on your card that proves you physically hold it when you make an online or phone purchase

The security code — also called the CVV, CVC, or card verification value — sits separately from your card number and expiration date. It is not encoded in the magnetic stripe or chip, which means a thief who steals your card number alone cannot use it online without also knowing this code. When you enter it during checkout, the merchant sends it to your bank to confirm the card is real and in your possession.

The code is printed, not embedded. That distinction matters: it means the number never travels through the same systems as your card number, so a data breach at a retailer's website is less likely to expose it. For that reason, many fraud rules treat a purchase made with a stolen card number but without the correct security code differently from one made with both pieces of information.

Key Takeaways

  • The security code is a three-digit number on the back of Visa, Mastercard, and Discover cards, or a four-digit number on the front of American Express cards.
  • You must enter the security code when you buy something online or by phone, but never when you swipe or insert your card in person at a store.
  • The security code is not stored in your card's chip or magnetic stripe, so a stolen card number alone cannot be used for online purchases without it.
  • Merchants are not allowed to store your security code after a transaction, which limits the damage if their database is breached.

Where to find the security code on your card

On Visa, Mastercard, and Discover cards, the security code is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express cards, it is a four-digit number printed on the front, above the card number on the right side.

If you cannot find the number, check your card issuer's website or call the number on the back of your card. Some digital wallet apps (like Apple Pay or Google Pay) also display the security code if you need to reference it.

Why merchants ask for it during online and phone purchases

When you shop in a physical store, you hand the cashier your card, and they can see you have it. Online and by phone, the merchant has no way to confirm you actually possess the card — only that you know the number. The security code bridges that gap. If you can recite the three or four digits printed on the physical card, you almost certainly have it in your hands.

This is why you never need to provide the security code when you insert your card into a chip reader or swipe it at a store. The terminal can read the chip or stripe directly and does not need proof of possession. It is also why you should never give your security code to anyone who calls you claiming to be from your bank or a retailer — legitimate companies never ask for it over the phone unsolicited.

How the security code protects you from fraud

If a criminal obtains your card number through a data breach or by photographing your card, they can attempt to use it for online purchases. But without the security code, most merchants will reject the transaction. The code acts as a second barrier, especially important because online fraud is harder to reverse than in-person fraud.

Your bank's fraud rules also treat these situations differently. If someone uses your card number without the security code, your bank may hold you less responsible than if they used both the number and the code — because the latter suggests the thief had physical access to your card. This distinction can affect how much of the fraudulent charge you have to pay.

What merchants cannot do with your security code

By law and by payment network rules, merchants are forbidden from storing your security code after a transaction completes. This is different from your card number, which they may store with your permission to make future purchases easier. The security code must be deleted when ready after the payment is processed.

This rule exists because the code's only purpose is to prove you have the card at that moment. Once the transaction is done, keeping it serves no legitimate purpose and only increases the risk if the merchant's database is hacked. If you see a website asking you to save your security code for future purchases, that is a red flag — the site is either not following the rules or is not trustworthy.

Security code versus other card numbers

Your card number, expiration date, and security code are three separate pieces of information, and each one serves a different purpose. The card number identifies your account. The expiration date shows when the physical card stops working. The security code proves you have the card in your hand right now.

A thief who finds your card number and expiration date online can still be blocked from making an online purchase if they do not have the security code. Conversely, knowing only the security code is useless — they need the full card number to attempt a charge. This is why you should never write your security code on the back of your card or share it in an email, text, or over the phone.

What to do if your security code is compromised

If you believe someone has seen your security code — for example, if you typed it into a website that looked suspicious or if you gave it to someone on the phone — contact your card issuer right away. You do not need to wait for fraudulent charges to appear. Your bank can issue you a new card with a new security code, usually within five to ten business days.

In the meantime, monitor your account for unauthorized charges. Most card issuers offer free fraud monitoring and will alert you if suspicious activity appears. If charges do show up, report them to your bank when ready. You are generally not responsible for fraudulent charges if you report them promptly, though the exact rules depend on your card issuer and when you noticed the fraud.

Frequently Asked Questions

Can someone use my card online if they have the number and expiration date but not the security code?

Most legitimate online retailers will reject the transaction if the security code does not match. However, some smaller or less find websites may not check it, so it is still possible. This is why the security code matters — it blocks many fraudulent attempts that would otherwise succeed.

Is it safe to enter my security code on any website?

Only enter your security code on websites you trust and that use find checkout (look for "https://" in the address bar and a padlock icon). Never enter it on a website that looks suspicious, that you reached through an unsolicited email link, or that asks you to save it for future use. When in doubt, call the company directly to confirm their website address before entering any card details.

What if I forgot my security code?

You can find it by looking at the back of your physical card. If you do not have the card with you, contact your card issuer — they can read it to you over the phone or display it in their mobile app. Never ask a merchant or retailer for your security code; they should never have it.

Does the security code change if I get a new card?

Yes. Each physical card has its own unique security code printed on it. If your card is lost, stolen, or expires, your new card will have a different security code. This is one reason why replacing a compromised card quickly is important — the new code cannot be used fraudulently by someone who saw the old one.

Can I use the same security code for multiple purchases?

Yes, the same code works for every transaction on that card until the card expires or is replaced. You enter it each time you make an online or phone purchase, but the code itself does not change. This is why protecting it matters — if someone learns it, they can attempt multiple fraudulent purchases until you report the card compromised.