The verification code is a three- or four-digit number on your card that proves you physically have it

The credit card verification code — also called CVV, CVC, or security code — is a short number printed on your card that you enter when you pay online or over the phone. It is not encoded in the card's magnetic stripe or chip. The code exists to prove you are holding the actual card, not just using a stolen card number.

Visa and Mastercard call it CVV2 or CVC. American Express calls it CID. The number is always three digits on Visa, Mastercard, and Discover cards, and four digits on American Express. You will find it on the back of most cards, printed after the last four digits of your card number. On American Express, it appears on the front.

The merchant never stores this code after the transaction completes. Payment processors are legally required to delete it. This is why a thief who steals your card number alone cannot use it online — they do not have the code, and they cannot call the card issuer to ask for it.

Key Takeaways

  • The verification code is a three- or four-digit number printed on your card that you must provide for online and phone purchases.
  • Merchants and payment processors must delete the code after each transaction and cannot store it for future use.
  • Never give your verification code to anyone who calls you or emails you, even if they claim to be from your bank.
  • A legitimate merchant will only ask for the code during checkout, not before or after the purchase is complete.
  • The code protects you from card-not-present fraud, but it does not protect you if someone physically steals your card.

Why merchants ask for it during online checkout

When you buy something online, the merchant cannot see your card in person. They cannot verify your signature or check your ID. The verification code is their way of confirming that you have the physical card in your hands right now. If a thief has only your card number — from a data breach, a skimmed ATM, or a compromised website — they cannot complete the purchase without the code.

The code is part of what payment processors call card-not-present (CNP) fraud prevention. It is one of several checks that happen in the background. The processor also checks whether the billing address you entered matches the address on file, whether the purchase amount is unusual for your account, and whether the transaction is coming from a location where you normally shop. The verification code is the one check that requires you to take action.

What happens if you give it to the wrong person

If someone calls you claiming to be from your bank and asks for your verification code, hang up. Your bank will never ask for it. Neither will a legitimate merchant. The only time you should enter this code is when you are the one initiating a purchase on a website you trust or over the phone to a merchant you called yourself.

If a scammer gets your verification code along with your card number, they can make online purchases when ready. Unlike your card number alone, the code gives them everything they need to pass the fraud checks at most retailers. Report the code as compromised to your card issuer right away — call the number on the back of your card, not a number the caller gave you. Your issuer can cancel the card and issue a new one.

If you accidentally gave out your code to a phishing email or a fake website, do not wait. Contact your card issuer the same day. The sooner you report it, the sooner they can watch for fraudulent charges and cancel the card if needed.

The difference between the verification code and your PIN

Your PIN (personal identification number) is a four-digit code you create and use at ATMs and in-person at stores when you pay with your debit card. Your verification code is printed on your card and you use it for online and phone purchases. They are separate security layers.

If someone steals your debit card, they cannot use it at an ATM or in a store without your PIN. But they can use it online if they also have your verification code. This is one reason many people keep their debit card at home for online shopping and use a credit card instead — credit cards offer stronger fraud protection by law, and you are not liable for unauthorized charges if you report them quickly.

How the code protects you but has limits

The verification code stops a thief who has only your card number from making online purchases. It does not stop them if they have your physical card. If someone steals your wallet, they have both the number and the code, and they can use it online or in person until you call your card issuer and report it stolen.

The code also does not protect you from a merchant's own data breach. If a retailer's website is hacked and your card information is stolen, the thief gets your number but not your code — the merchant is required to delete the code after each transaction. This is why the verification code requirement exists: it shifts the burden of security from the merchant to you, the cardholder. You are the only person who should ever have it.

What to do if you see charges you did not make

If you spot a charge on your statement that you do not recognize, contact your card issuer when ready. Call the number on the back of your card. Do not use a number from an email or text message, even if it looks official. Your issuer will ask you to describe the charge and may ask whether you recognize the merchant name.

By law, credit card issuers must investigate unauthorized charges within 30 days of your report. You are not responsible for fraudulent charges if you report them promptly. Your issuer will typically cancel your card, issue a new one, and credit back the disputed amount while they investigate. Keep records of your report — the date, time, and the name of the person you spoke with — in case you need to follow up.

Frequently Asked Questions

Is it safe to give my verification code over the phone?

Only if you called the merchant yourself. Never give it to someone who called you, even if they claim to be from your bank or a store. Legitimate companies will only ask for it when you are making a purchase you initiated.

Can a merchant store my verification code for future purchases?

No. Payment processors are legally required to delete the code when ready after the transaction. If a merchant asks you to save it for next time, that is a red flag — find a different merchant.

What if I lose my card but remember my verification code?

Call your card issuer and report the card lost or stolen. The code alone does not help you — you need the card number, expiration date, and code together to make a purchase. Your issuer will cancel the card and send you a new one with a different code.

Does the verification code protect me from in-person fraud?

No. If someone steals your physical card, they have the code and can use it in stores or online. Report the card stolen when ready so your issuer can cancel it and prevent further use.

Why do some online stores not ask for a verification code?

Some merchants use other fraud-prevention methods, like address verification or phone number matching. Larger retailers sometimes have agreements with payment processors that allow them to skip the code requirement. This does not mean the transaction is less find — it means the processor is using different checks.