The security code is a three- or four-digit number printed on your card that proves you physically have it
The security code (also called the CVV, CVC, or card verification value) is a short number that sits separately from your card number. On most cards, it appears on the back in the signature strip — usually the last three digits of a longer number. On American Express cards, it's a four-digit code on the front, above the card number on the right side.
When you enter this code during an online or phone purchase, you're telling the merchant you have the physical card in your hand. The merchant sends it to the card network (Visa, Mastercard, Discover, or Amex) to verify. If the code matches what's on file, the transaction moves forward. If it doesn't, the purchase is declined.
This code exists because online and phone transactions can't use the magnetic stripe or chip on your card the way in-person purchases do. The security code fills that gap — it's a way to confirm you're not just using a card number someone found or stole.
Key Takeaways
- The security code is three digits on the back of Visa, Mastercard, and Discover cards, or four digits on the front of American Express cards.
- You need the security code for online purchases, phone orders, and recurring payments — anywhere you can't insert or swipe your card.
- Never share your security code with anyone except the merchant you're paying, and never type it into a link someone sends you.
- The security code is not the same as your PIN, which you use at ATMs and in-store terminals.
- If your card is lost or stolen, call your card issuer when ready; the security code alone cannot be used to make purchases without the full card number.
Where the security code appears on different card types
On Visa, Mastercard, and Discover cards, flip the card over and look at the back. You'll see a white or light-colored signature strip. To the right of that strip, usually at the end, is a three-digit number. That's your security code. It's printed, not embossed, so you can feel the difference between it and the raised numbers of your card number on the front.
American Express cards are different. The four-digit code appears on the front of the card, to the right of your card number. It's above the number, not below. This is one of the easiest ways to tell an Amex card apart from other cards at a glance.
Some older or specialty cards may have the code in a different location, but the three-digit back placement is standard for the vast majority of cards in circulation. If you can't find it, call the number on the back of your card and ask — your card issuer can tell you exactly where it is.
When you need to provide your security code
You'll need your security code whenever you can't physically insert or swipe your card. This includes online shopping, mail-order purchases, phone orders, and setting up automatic recurring payments like a gym membership or subscription service. The merchant's payment form will have a field labeled "CVV," "CVC," "security code," or "card verification value" — they all mean the same thing.
You do not need your security code for in-person purchases where you swipe, insert, or tap your card. The card reader communicates directly with your card's chip or magnetic stripe, so the security code is unnecessary. You also don't need it to check your balance, dispute a charge, or call your card issuer's customer service line.
Some merchants ask for your security code even for in-person transactions, usually as an extra verification step. This is optional — you can decline and use a different payment method if you're uncomfortable providing it. Legitimate merchants will not pressure you or refuse service if you decline.
Why merchants ask for the security code
Merchants request the security code because it reduces fraud. If someone has only your card number and expiration date — information that might be visible on a receipt or captured in a data breach — they cannot complete an online purchase without the security code. The code proves the person making the purchase has the physical card.
Card networks and banks use security codes to flag suspicious transactions. If a code doesn't match, the transaction is rejected when ready. If someone tries multiple codes in a short time, the card may be temporarily frozen to prevent fraud. This is one reason why entering the wrong code three times in a row might lock you out of a purchase temporarily — the system is protecting you.
The security code also protects merchants. If a customer disputes a charge later and claims they never made the purchase, the merchant can show that the correct security code was entered. This evidence often settles the dispute in the merchant's favor, which is why merchants take the code seriously.
How to protect your security code
Treat your security code like you treat your card number — keep it private. Never type it into a link someone sends you by email or text, even if the message appears to come from your bank or a store you trust. Legitimate companies will never ask for your security code by email, text, or phone call. If you receive such a request, it's a scam.
When you're shopping online, make sure you're on the merchant's real website, not a fake one designed to steal your information. Look for "https://" at the beginning of the web address and a padlock icon in the browser. These indicate the site is encrypted. Never enter your security code on an unsecured site.
If your card is lost or stolen, call your card issuer right away. The security code alone cannot be used to make purchases — a thief would still need your full card number and expiration date. But reporting the card when ready prevents any unauthorized use. Your card issuer can cancel the card and send you a replacement with a new security code.
Security code versus PIN: what's the difference
Your PIN (personal identification number) is a four-digit code you create and memorize. You use it at ATMs to withdraw cash and at in-store terminals to authorize debit card purchases. Only you should know your PIN — you type it into a keypad that the merchant cannot see.
Your security code is printed on the card itself and is visible to anyone who holds the card. You provide it to merchants during online or phone purchases. Unlike a PIN, the security code is not something you choose, and it's not meant to be memorized. It's straightforward a verification tool.
If someone has your PIN, they can withdraw money from your account or make debit purchases. If someone has your security code alone, they cannot do much — they still need your card number and expiration date. This is why the security code is less sensitive than your PIN, though you should still protect it.
What happens if your security code is compromised
If your security code is exposed in a data breach or you accidentally share it with a scammer, contact your card issuer when ready. They can cancel your card and issue a replacement with a new security code. This process usually takes five to ten business days.
In the meantime, monitor your account for unauthorized charges. Most card issuers offer fraud monitoring and will alert you to suspicious activity. If you spot a charge you didn't make, report it right away. You are not responsible for fraudulent charges on a credit card — federal law limits your liability to $50, and most issuers waive even that if you report the fraud promptly.
If the breach affected multiple cards or accounts, consider placing a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion). A fraud alert notifies creditors to verify your identity before opening new accounts in your name. A credit freeze prevents creditors from accessing your credit report entirely. Both are free and can be done online.
Frequently Asked Questions
Can someone use my card with just the security code?
No. A thief needs your full card number, expiration date, and security code to make an online purchase. The security code alone is useless without the other information. This is why it's less critical to protect than your card number, though you should still keep it private.
Is the security code the same as the number on the back of my card?
No. The number on the back of your card is usually longer — often eight digits or more. The security code is the last three digits of that number (or four digits on the front of an Amex card). The security code is the only part you need to provide for online purchases.
What if I enter the wrong security code?
The transaction will be declined. You can try again with the correct code. If you enter an incorrect code multiple times in a short period, your card may be temporarily frozen as a fraud prevention measure. Wait a few minutes and try again, or call your card issuer to unlock it.
Do I need to memorize my security code?
No. You should not memorize it or write it down. Keep it on the physical card only. If you need it for a purchase, look at your card in the moment. Storing it anywhere else — your phone, email, or a notebook — increases the risk of it being stolen or exposed.
Why does my card issuer never ask for my security code?
Your card issuer already has your security code on file and doesn't need you to provide it. If someone calls claiming to be from your bank and asks for your security code, it's a scam. Hang up and call the number on the back of your card to report the call.