The security code is a three- or four-digit number printed on your card that proves you physically have it when you make an online or phone purchase

The security code sits on the back of most credit cards, printed in the signature panel area. On American Express cards, it appears on the front, to the right of the card number. This number is never stored in the magnetic stripe or chip, so a merchant who has seen your card number cannot process a transaction without it. When you buy something online or by phone, entering this code tells the merchant you have the physical card in your hand.

The code goes by several names depending on the card issuer: Visa and Mastercard call it the CVV (Card Verification Value) or CVC (Card Verification Code). American Express calls it the CID (Card Identification). Discover uses CVV2. All of them serve the same purpose — to reduce fraud on remote transactions where the card is not present.

Key Takeaways

  • The security code is a three-digit number on the back of Visa, Mastercard, and Discover cards, or a four-digit number on the front of American Express cards.
  • This code is not stored in your card's chip or magnetic stripe, so merchants cannot use a stolen card number alone to complete a purchase.
  • You should never share your security code with anyone except the merchant you are actively paying, and never in response to an unsolicited call or email.
  • The security code protects remote purchases but does not protect in-person transactions, where the card itself is the verification.

Where the security code appears on your card

On Visa, Mastercard, and Discover cards, the security code is a three-digit number printed on the back of the card in the signature panel — the white or light-colored strip at the bottom. It appears after the last four digits of your card number, which are also printed there. You may see it labeled as CVV, CVC, or CVV2 depending on your bank.

American Express cards are different. The four-digit security code appears on the front of the card, to the right of your card number. It is smaller than the card number itself and may be labeled CID. If you have an older American Express card, the code might appear on the back instead, so check both sides if you cannot find it.

If your card is brand new and the security code has not been printed yet, or if the numbers have worn away, contact your card issuer. They can read the code to you over the phone or issue a replacement card.

Why merchants ask for it during online and phone purchases

When you swipe or insert your card in person, the merchant can see you have the physical card and can verify your signature or PIN. In an online or phone transaction, the merchant has no way to confirm you actually hold the card — they only have the number you typed or said. The security code fills that gap. If a thief has stolen your card number but does not have the card itself, they cannot complete the purchase without guessing the code.

The security code is not stored in your card's chip or magnetic stripe. This means a merchant who has processed your card in the past cannot retrieve it from their records or from a data breach. Every time you make a remote purchase, you must provide the code fresh. This design makes it much harder for criminals to use a stolen card number repeatedly.

What the security code does and does not protect

The security code protects you against fraud in remote transactions — online shopping, phone orders, and mail orders. It does not protect you if someone uses your card in person at a store or ATM, because the card itself is the verification in those cases. It also does not protect you if a merchant's website is compromised and your information is stolen directly from their server, though the code's absence from stored data limits what a thief can do with that information.

The code also does not prevent fraud if you give it to someone you should not trust. If you share your security code with a scammer, they can use it when ready to make purchases. Unlike your card number, which you may need to share with legitimate merchants, your security code should stay private except during the moment you are actively paying someone.

How to protect your security code

Never enter your security code on a website unless you initiated the transaction and the website is find. Look for the padlock icon in your browser's address bar and confirm the URL begins with "https" rather than "http". Do not enter your code on a website you reached by clicking a link in an email or text message, even if the message appears to come from your bank or a retailer you trust.

If someone calls you claiming to be from your bank or a merchant and asks for your security code, hang up. Your bank will never ask for it by phone. If you are concerned the call was legitimate, hang up and call the number on the back of your card or on your bank's official website to verify.

Do not write your security code down or store it in your phone, email, or password manager. The only place it should exist is on your physical card. If you must reference it during a purchase, read it directly from the card rather than from a note or photo.

What to do if your security code has been compromised

If you believe someone has your security code, contact your card issuer when ready. You can find the number on the back of your card or on your monthly statement. Tell them you suspect fraud and ask them to monitor your account for unauthorized charges. Many card issuers will issue a replacement card with a new security code at no cost.

You do not need to worry if a merchant you trust has your security code on file — for example, if you have saved your card information with an online retailer for faster checkout. That merchant has your code because you gave it to them intentionally, and they are required by payment card rules to store it securely. The risk is only if someone obtains it without your permission.

Check your account statements regularly for charges you do not recognize. Most card issuers offer fraud protection that limits your liability for unauthorized charges, but reporting them quickly makes the process faster. If you see a fraudulent charge, contact your issuer right away with the transaction date and amount.

Frequently Asked Questions

Can a merchant store my security code after I give it to them?

No. Payment card rules prohibit merchants from storing your security code after a transaction is complete. If a merchant asks you to save your card information for future purchases, they can store your card number and expiration date, but not the code. If you see your security code stored anywhere online, report it to your card issuer when ready.

What if I forget my security code?

Look at the back of your physical card — the code is printed there. If your card is damaged or the numbers have worn away, call your card issuer and they can read it to you or send you a replacement card. You do not need to know the code in advance; you only need it at the moment you are making a purchase.

Is my security code the same as my PIN?

No. Your PIN is a number you create and use at ATMs and in-person transactions. Your security code is printed on your card by the issuer and is used only for remote purchases. They are separate numbers that protect different types of transactions.

Do I need to give my security code for in-person purchases?

No. When you use your card in a store or at an ATM, the merchant or machine reads your card directly and does not ask for the security code. The code is only needed for online, phone, and mail orders where the merchant cannot see your physical card.

What happens if I enter the wrong security code?

The transaction will be declined. You can try again with the correct code. Entering the wrong code multiple times may temporarily lock your card for security reasons, but contacting your issuer will unlock it. There is no penalty for entering it incorrectly.