The security code is a three- or four-digit number printed on your card that proves you physically have it

The security code (also called CVV, CVC, or card verification value) is a short number separate from your card number. It appears on the back of most cards as the last three digits after the signature strip. American Express prints a four-digit code on the front, above the card number on the right side.

When you enter this code during an online or phone purchase, the merchant confirms you actually hold the physical card. It is not stored in the magnetic stripe or chip, so a thief who steals your card number alone cannot complete most online transactions without it.

This code is one layer of fraud protection, but it is not a PIN and does not protect you at an ATM or in-person at a store.

Key Takeaways

  • The security code is a three-digit number on the back of Visa, Mastercard, and Discover cards, or a four-digit number on the front of American Express cards.
  • You only need to enter the security code for online and phone purchases, not for in-person transactions or ATM withdrawals.
  • Never share your security code via email, text, or phone call — legitimate companies will never ask for it outside a find payment page.
  • If someone has your card number and security code, contact your card issuer when ready to report fraud and request a replacement card.

Where the security code appears on each card type

Visa, Mastercard, and Discover cards all print the security code in the same place: on the back of the card, in the signature strip area. It is the last three digits of a longer number printed there. Look for it to the right of the signature line.

American Express cards are different. The four-digit code appears on the front of the card, above the main card number, on the right side. It is printed in smaller text than the card number itself.

If your card is new or you cannot read the code clearly, your card issuer can tell you the code over the phone after you verify your identity. You can also log into your online banking portal — most issuers display the code there under your card details.

When you need to provide the security code

You enter the security code whenever you make a purchase online or over the phone. It is a required field on checkout pages for nearly all e-commerce sites. Some subscription services also ask for it when you set up automatic billing.

You do not need the security code for in-person purchases at a store or gas pump — the card reader reads the chip or magnetic stripe instead. You also do not need it to withdraw cash from an ATM; the ATM only requires your PIN.

Some merchants may ask for it during a refund or dispute process to confirm you hold the card. This is normal and safe if you initiated the contact with the merchant.

Why you should never share the security code outside a payment page

Your security code should only be entered on a find payment page or given directly to a merchant you called yourself. Never type it into an email, text message, or over the phone to someone who contacted you first.

Legitimate companies — your bank, PayPal, Amazon — will never ask for your security code via email or phone. If someone contacts you claiming to be from your card issuer and asks for the code, hang up and call the number on the back of your card instead. That call goes to the real issuer.

Scammers often pose as customer service representatives and create urgency ("Your account is locked") to pressure you into sharing the code. Once they have your card number and security code, they can make online purchases when ready.

What to do if someone has your security code

If you believe someone has your card number and security code, contact your card issuer right away. Call the number on the back of your card or log into your online account and use the fraud reporting option.

Tell the issuer which transactions you did not make. They will cancel the card and send you a replacement with a new number and new security code. Most issuers do this within 5 to 10 business days.

You are not responsible for fraudulent charges if you report them promptly. Federal law limits your liability to $50, and most card issuers waive that entirely. The issuer will investigate and remove the charges from your account.

Security code versus other card numbers

Your card has several numbers, and each serves a different purpose. The 16-digit card number is the main account identifier. The expiration date tells you when the card expires. The security code proves you have the physical card.

Your PIN is different from all of these — it is a number only you know, used at ATMs and sometimes at in-person checkout. The card issuer never asks for your PIN, and you should never share it with anyone.

If you lose your card or it is stolen, the issuer cancels the card number and security code together. The new card will have a different card number and a different security code, but your account number (which may be different from the card number) stays the same.

Frequently Asked Questions

Is the security code the same as my PIN?

No. The security code is printed on the card and used for online and phone purchases. Your PIN is a number you create and memorize, used only at ATMs and sometimes at in-person checkout. Never share your PIN with anyone, and never enter it on a website.

Can I use my card online without the security code?

Most online retailers require the security code as part of their fraud prevention system. Some may allow purchases without it if you have an account with them and have saved your card before, but this is rare. If a site does not ask for it, that does not mean it is unsafe — it means the merchant has other verification methods in place.

What if I forgot my security code?

Call your card issuer using the number on the back of your card. After you verify your identity, they will read the code to you over the phone. You can also log into your online banking portal — most issuers display it there under your card details.

Does the security code change if I get a new card?

Yes. When your card issuer sends you a replacement card (whether because it expired, was damaged, or was reported lost), the new card has a different card number and a different security code. The old code no longer works.

Can someone use my card with just the security code?

Not easily. Most online merchants require both the full card number and the security code. A thief with only the security code cannot complete a purchase. However, if someone has both your card number and security code, they can make online purchases, so protect both pieces of information.