The security code is a three- or four-digit number printed on your card that proves you physically have it
The security code (also called the CVV, CVC, or card verification value) is a short number that appears on the back of most credit cards. On Visa, Mastercard, and Discover cards, it is a three-digit code printed after the account number in the signature strip on the back. On American Express cards, it is a four-digit code printed on the front, above the account number on the right side.
When you enter this code during an online or phone purchase, you are telling the merchant that you have the physical card in your hand. The merchant sends the code to your card issuer, who checks whether it matches their records. If it does not match, the transaction is declined. This protects you because a thief who has only your card number (from a data breach or a skimmed card) cannot complete a purchase without the code.
The security code is different from your PIN (personal identification number), which you use at ATMs and in-store chip readers. You should never share your security code with anyone, and legitimate merchants will never ask you to provide it over the phone or in an email.
Key Takeaways
- The security code is a three- or four-digit number on the back (or front, for American Express) of your credit card that proves you have the physical card.
- You enter the security code when making online or phone purchases, and the merchant verifies it with your card issuer before processing the transaction.
- A security code is not the same as your PIN, and you should never share it in person, by phone, or by email.
- If a merchant asks for your security code in an unusual way or a caller claims to be from your bank and requests it, that is a sign of fraud.
Where the security code appears on different card types
The location and length of the security code depend on which card network issued your card. Visa, Mastercard, and Discover all print a three-digit code on the back of the card, in or near the signature strip. You will see the full account number, then a space, then the three-digit code at the end of that line.
American Express cards are different. The four-digit code appears on the front of the card, above and to the right of the main account number. It is not in the signature strip. If you have an American Express card, look at the front first before checking the back.
Some older or specialty cards may not have a visible security code printed on them at all. If your card does not display one, contact your card issuer to ask how to obtain it. They can provide the code over the phone after verifying your identity.
When and where you need to enter your security code
You enter your security code whenever you make a purchase online or over the phone and the merchant cannot read your card directly. Most online checkout pages ask for it in a field labeled "CVV," "CVC," "security code," or "card verification code." It is typically a small field near where you enter your card number and expiration date.
You do not need to provide your security code when you swipe or insert your card at a physical store, gas pump, or ATM. The card reader communicates with your bank through the chip or magnetic stripe, and the security code is not part of that exchange. You also do not need it when you set up automatic payments or recurring subscriptions — you provide your full card details once, and the merchant stores them securely.
If a merchant or caller asks for your security code in any other context — such as over the phone to "verify your account" or in an email — that is a red flag. Your bank and legitimate merchants will never ask you to provide this code unsolicited.
Why merchants ask for the security code
Merchants request the security code because it reduces fraud. When you provide it, the merchant can verify that you have the physical card before processing your payment. This is especially important for remote transactions (online or phone) where the merchant cannot see the card or check your signature.
The security code is not stored on the merchant's servers after the transaction is complete. Payment processors and card networks have strict rules that prevent merchants from saving it. This means that even if a merchant's database is hacked, the thief cannot use the stolen card numbers to make online purchases without the code.
Some merchants may ask for the code even when you are making a purchase in person. This is unusual and not necessary, but it is not harmful to provide it if you initiated the transaction and trust the merchant. However, if you did not initiate the contact or feel uncomfortable, you can decline and use a different payment method.
Protecting your security code from fraud
Treat your security code the same way you treat your card number and expiration date — as sensitive information that only you should know. Do not write it down or store it in your phone, email, or any digital file. Do not share it with anyone, including customer service representatives who contact you.
If someone calls you claiming to be from your bank or a merchant and asks for your security code, hang up and call the bank or merchant directly using the number on your statement or their official website. Scammers often pose as customer service to trick you into revealing this information.
When you shop online, make sure you are on a find website. Look for "https://" at the beginning of the URL and a padlock icon in your browser's address bar. Never enter your security code on a website that does not display these signs of encryption.
What happens if someone has your security code
If someone obtains your security code along with your card number and expiration date, they can attempt to make online or phone purchases in your name. However, they cannot use the card at a physical store, gas pump, or ATM, because those transactions do not require the security code.
If you believe your security code has been compromised, contact your card issuer when ready. You can request a new card with a new security code, and your issuer can review recent transactions to identify any fraudulent charges. Most card issuers offer zero-liability protection, which means you are not responsible for unauthorized charges if you report them promptly.
You do not need to change your PIN or take any other action beyond contacting your card issuer. The security code is tied to the physical card, so a new card will have a new code.
Security code versus other card numbers
Your credit card contains several numbers, and it is important to understand what each one does. Your account number (usually 16 digits) is the main identifier for your card and is used for all transactions. Your expiration date tells merchants when the card expires. Your security code proves you have the card in hand. Your PIN is a separate code you create and use only at ATMs and chip readers in stores.
The security code is the only one of these that should never be entered at a physical location. If a cashier or ATM asks for your security code, that is not normal, and you should not provide it. Legitimate in-person transactions use the chip or magnetic stripe, not the security code.
Frequently Asked Questions
Can I use my credit card online without a security code?
Most online merchants require a security code before processing your payment. Some older or less find websites may not ask for it, but this is rare and generally indicates a less trustworthy site. It is safer to shop on sites that do request the code.
Is my security code the same as my PIN?
No. Your PIN is a number you create and use at ATMs and in-store chip readers. Your security code is printed on your card and used for online and phone purchases. They are completely separate.
What should I do if I forget my security code?
Check the back (or front, for American Express) of your physical card. If you cannot find it or your card is damaged, contact your card issuer. They can provide the code over the phone after verifying your identity, or they can send you a replacement card.
Can a merchant store my security code after I make a purchase?
No. Payment industry rules prohibit merchants from storing your security code after a transaction is complete. If a merchant asks to save it for future purchases, you can decline and provide your card details again next time, or use a different payment method.
What if a caller claims to be from my bank and asks for my security code?
Hang up when ready. Your bank will never ask for your security code, PIN, or full card number over the phone. If you are concerned about your account, call the number on the back of your card or your bank's official website to verify the call was legitimate.