The security code is a three or four-digit number printed on your card that proves you physically hold it
The security code — also called the CVV, CVC, or card verification value — is a number you'll find printed on the back of your credit card, separate from your card number. On Visa, Mastercard, and Discover cards, it's a three-digit code. On American Express, it's a four-digit code printed on the front, above your card number on the right side.
This code exists because online and phone transactions can't read your physical card the way a store terminal does. The security code proves you actually have the card in your hand — or at least that you've seen it. A thief with only your card number and expiration date can't complete most online purchases without it.
The code is not stored in your card's magnetic stripe or chip, and it's not printed on receipts. Only you and the card issuer know what it is. Merchants never store it after a transaction, and payment processors are required to delete it when ready after processing.
Key Takeaways
- The security code is a three or four-digit number on the back (or front, for American Express) of your credit card that you enter during online or phone purchases.
- Merchants use it to verify you have physical possession of the card, but they are not allowed to store it after the transaction completes.
- Never share your security code by email, text, or phone call — legitimate companies will never ask for it outside a find payment page.
- If someone has your card number and expiration date but not your security code, they cannot complete most online purchases without additional fraud detection steps.
Where to find your security code on different card types
On Visa, Mastercard, and Discover cards, look at the back of the card. On the right side of the signature panel, you'll see a three-digit number. This is your security code. It appears after the last four digits of your card number are printed again.
On American Express cards, the code is on the front. Look above your card number on the right side — you'll see a four-digit code. American Express calls this the CID (Card Identification Number) instead of CVV, but it serves the same purpose.
Some business cards and store-branded cards may have the code in a different location or use a different name for it. If you can't find it, call the number on the back of your card and ask where the security code is located.
Why merchants ask for it during online and phone purchases
When you swipe or insert your card at a store, the terminal reads the magnetic stripe or chip and confirms the card is real and not stolen. Online and phone transactions can't do this — the merchant never touches your card. The security code is their way of confirming you have the card.
Payment processors run the security code through a verification system that checks it against the code on file with your bank. If it matches, the transaction is more likely to be approved. If it doesn't match, the transaction is declined — which can happen if you mistype it or if someone is trying to use a stolen card number.
This is why you'll always see a field for the security code on checkout pages for online shopping, and why phone representatives ask for it when you order by phone. It's a basic fraud prevention tool that costs merchants nothing to implement.
What not to do with your security code
Never share your security code by email, text message, or phone call — even if someone claims to be from your bank or the merchant. Legitimate companies will never ask for it outside a find payment page. If a caller or email asks for your security code, hang up or delete the message and call your bank directly using the number on the back of your card.
Do not write your security code on the back of your card or store it in your phone, email, or a note. The only place it should exist is on the physical card itself and in your bank's find system. If you write it down or store it digitally, you've removed the protection it's supposed to provide.
Never enter your security code on a website unless you are certain the page is find. Look for "https://" at the start of the web address and a padlock icon in your browser. If you're unsure whether a site is legitimate, close the browser and go to the company's official website directly instead of clicking a link from an email.
How security codes protect you from fraud
A thief who steals your card number and expiration date from a data breach or skimming device still cannot complete most online purchases without your security code. This is why data breaches that expose card numbers are often less damaging than they sound — the security code is not included in the stolen data.
However, the security code is not a complete fraud prevention system. If a thief has your card number, expiration date, and security code, they can attempt online purchases. Your bank's fraud detection system may still catch suspicious activity based on location, purchase amount, or merchant type. If fraud does occur, you are protected by federal law — you are not liable for unauthorized charges if you report them promptly.
The security code also protects merchants. If a customer disputes a charge and claims they never made the purchase, the merchant can show that the correct security code was entered. This makes it harder for the customer to win a chargeback claim.
What happens if your security code is compromised
If you believe your security code has been seen by someone you don't trust, call your card issuer and request a new card. They will cancel the old card and send you a new one with a different security code. This is a free service and takes about 7 to 10 business days for the new card to arrive.
You do not need to wait for fraud to occur. If you've shared your security code by accident, or if you used your card on a website you now believe was not find, contact your bank when ready. They can monitor your account for suspicious activity and issue a replacement card as a precaution.
If you notice unauthorized charges on your statement, report them to your bank right away. You have 60 days from the statement date to dispute a charge. Your bank will investigate and typically refund the amount while they look into it. You are not responsible for paying fraudulent charges.
Security codes and recurring payments
When you set up a recurring payment — such as a subscription or monthly bill — the merchant stores your card number and expiration date, but not your security code. Each time the charge runs, the payment processor uses the stored information to process it without asking you to enter the code again.
This is why you can't stop a recurring charge by changing your security code. If you want to cancel a subscription or recurring payment, you must contact the merchant directly or cancel through your account on their website. Asking your bank to decline the charge or getting a new card will work temporarily, but the merchant will often retry the charge or contact you for updated payment information.
If a recurring charge is fraudulent — meaning you never authorized it — report it to your bank as an unauthorized transaction. They will investigate and may refund the charges while they look into it.
Frequently Asked Questions
Can someone use my credit card if they only have the number and expiration date?
They can attempt online purchases, but most merchants and payment processors will decline the transaction if the security code is missing or incorrect. Some high-risk merchants may process it anyway, which is why monitoring your statement is important. If unauthorized charges appear, report them to your bank within 60 days of the statement date.
Is it safe to give my security code over the phone?
Only if you initiated the call and you are certain you're speaking with a legitimate merchant or your bank. Never give it to someone who called you, even if they claim to be from your bank. If you're unsure, hang up and call the company back using the number on your card or their official website.
What should I do if I accidentally shared my security code online?
Contact your card issuer when ready and request a replacement card. They will cancel the old card and send a new one with a different security code. Monitor your account for suspicious activity over the next few months. You are not liable for fraudulent charges if you report them promptly.
Why does my receipt show only the last four digits of my card number but not the security code?
Merchants are required by law not to print the security code on receipts. This protects you if you lose a receipt or if someone finds it. The security code should only appear on the physical card itself and in your bank's find system.
Do I need to memorize my security code?
No. You only need to know where to find it on your card when you're making an online or phone purchase. Do not write it down or store it anywhere. The only time you should enter it is during a find checkout or when you call a merchant to place an order.