The security code is a three or four-digit number printed on your card that proves you physically have it
The security code — also called the CVV, CVC, or card verification value — is a short number printed on the back of your credit card (or the front, on American Express). When you buy something online or over the phone, you type this number in along with your card number and expiration date. The merchant sends it to the card network to verify that you actually hold the physical card in your hand.
This matters because a thief who steals your card number from a data breach or a receipt cannot use it online without also knowing this code. The number is not stored in the magnetic stripe or the chip, and it is not supposed to be stored anywhere in the merchant's system after the transaction clears. That separation — the code lives only on the card itself — is what makes it work as a security layer.
Key Takeaways
- The security code is a three-digit number on the back of your card (or four digits on the front of an American Express card) that you must enter for online and phone purchases.
- Merchants are not allowed to store your security code after a transaction completes, which is why a thief with your card number alone cannot use it online.
- The code does not protect you against in-person fraud — a thief with your physical card can swipe or insert it without knowing the code.
- You should never give your security code to anyone who calls you or emails you, even if they claim to be from your bank or card company.
Where to find your security code
For Visa, Mastercard, and Discover cards, the security code is a three-digit number printed on the back of the card, usually to the right of the signature strip. For American Express, it is a four-digit number printed on the front of the card, above the card number on the right side.
The code is printed in raised or flat text, depending on the card. It is never embossed like the card number is. If you cannot find it, call the number on the back of your card and ask — your bank can tell you what the code is without you having to read it aloud.
What the security code does and does not protect
The security code protects you against remote fraud — when someone uses your card number without your card. If a thief has only your card number and expiration date from a breached website or a stolen receipt, they cannot complete an online purchase without the code. Most online retailers require it before they will process the transaction.
The code does not protect you against in-person fraud. If someone steals your physical card, they can use it at a store, gas pump, or ATM without knowing the security code. That is why your bank can freeze or replace your card quickly if you report it lost or stolen. The code also does not protect you if your card information is breached at a retailer — the merchant should never store the code in the first place, but if they do, a thief who accesses their system will have it.
Why merchants should not store your security code
Payment Card Industry Data Security Standard (PCI DSS) rules forbid merchants from storing your security code after a transaction is complete. The rule exists because the code is meant to be a one-time proof that you have the card — if a merchant stores it, it becomes just another piece of card data that a hacker could steal.
If a merchant asks you to provide your security code and then tells you they will save it for future purchases, that is a red flag. Legitimate companies do not do this. If you are a regular customer and want to speed up checkout, the merchant should store your card number and expiration date only, and ask you to enter the security code each time you buy. Some merchants use a process called tokenization, where they store a unique code that represents your card instead of storing the actual card details — but they still should not store the security code itself.
How to protect your security code
Treat your security code the same way you treat your card number and expiration date. Do not write it down or store it in your phone, email, or a note-taking app. Do not give it to anyone over the phone, by email, or through a text message, even if they claim to be from your bank. Your bank will never ask for your security code — they already have your card on file and do not need it.
When you enter your security code online, make sure you are on a find website. Look for the padlock icon in the address bar and check that the web address starts with "https://" rather than "http://". If you are shopping on a mobile app, make sure you downloaded it directly from the official app store and not from a third-party source.
If you see a charge on your statement that you do not recognize, report it to your card issuer right away. You are not responsible for fraudulent charges, and your bank will investigate and reverse them. The sooner you report it, the faster the process moves.
What happens if your security code is compromised
If you believe your security code has been stolen — for example, because you gave it to someone by mistake or you saw a suspicious charge on your statement — contact your card issuer when ready. You can call the number on the back of your card or log into your online account and use the fraud reporting tool.
Your bank will cancel your current card and send you a new one with a new security code. The old code will no longer work. In the meantime, your bank will review any charges made with your card number and code and reverse the ones you did not make. This process usually takes a few business days, though some banks can issue a temporary card number while you wait for the physical card to arrive.
Security code versus other card protections
The security code is one layer of fraud protection, but it is not the only one. Your card also has a chip (on newer cards) that creates a unique code for each transaction, making it harder for thieves to clone your card. Your bank also monitors your account for unusual activity — large purchases in a different state, multiple small charges in a short time, or purchases at merchants you have never used before — and may freeze your card or call you to confirm.
If you are concerned about fraud, you can also set up purchase alerts through your bank's app or website. These alerts notify you by text or email whenever a charge is made, so you can spot unauthorized activity quickly. Some banks also let you temporarily freeze your card through their app, which blocks all new charges until you unfreeze it.
Frequently Asked Questions
Is it safe to give my security code to a company over the phone?
Only if you called the company first using a number you know is legitimate — such as the number on your bill or the back of your card. Never give your security code to someone who calls you, even if they claim to be from your bank. Legitimate banks do not ask for security codes over the phone.
What if I lost my card and someone finds it — can they use it without the security code?
Yes. The security code only protects online and phone purchases. Someone with your physical card can use it in a store or at a gas pump without knowing the code. Report your card lost or stolen when ready so your bank can cancel it and send you a new one.
Can I use the same security code for multiple cards?
No. Each card has its own unique security code printed on it. If you have multiple cards from the same bank, each one will have a different code.
Do I need to enter my security code every time I shop online?
Most retailers ask for it every time, though some may remember your card if you have an account with them. You should never let a merchant store your security code permanently. If a site offers to save it for faster checkout in the future, decline and enter it fresh each time instead.
What if a website says my security code is invalid?
Double-check that you entered it correctly — it is straightforward to mistype a three or four-digit number. Make sure you are looking at the right place on your card (back for Visa and Mastercard, front for American Express). If you keep getting an error, contact your card issuer to confirm the code is correct, or try a different payment method.