The security code is a three- or four-digit number printed on your card that proves you physically hold it
The security code — also called a CVV, CVC, or card verification value — is a short number on the back or front of your card that you enter when you pay online or over the phone. It is not stored in the card's magnetic stripe or chip, so a merchant who has only your card number cannot process a payment without it. The code exists to reduce fraud when your card is not present in person.
Every card has one, but the location and length depend on the card type. Visa, Mastercard, and Discover cards have a three-digit code on the back, usually printed to the right of the signature strip. American Express cards have a four-digit code on the front, above the card number on the right side. The code changes only when you get a replacement card — it is not tied to your account balance or payment history.
Key Takeaways
- The security code is a three- or four-digit number that proves you have the physical card when paying online or by phone.
- Visa, Mastercard, and Discover print the code on the back; American Express prints it on the front.
- Never share your security code by email, text, or phone call — legitimate merchants never ask for it that way.
- The code does not protect you from fraud if someone steals your full card number, but it does prevent many online and phone transactions without the card itself.
Where to find the security code on each card type
On a Visa, Mastercard, or Discover card, flip the card over and look at the back. The three-digit code appears to the right of the signature strip, usually in a small box or printed directly on the card. It is the last three digits of a longer number that may be printed there.
On an American Express card, turn the card face-up. The four-digit code is printed on the front, to the right of the card number, above the cardholder's name. It is smaller than the main card number and sometimes appears in a slightly raised or embossed style.
If your card is damaged or the code is worn away, contact your card issuer and request a replacement card. You cannot use the card for online or phone purchases without a readable code.
Why merchants ask for the security code
When you enter your security code during an online purchase or phone order, the merchant sends it to the card network (Visa, Mastercard, or American Express) to verify that you have the physical card. The network checks the code against the one on file but does not return the actual code to the merchant — the merchant only learns whether the code matched or not.
This step stops many fraudulent transactions because a thief who has stolen your card number alone cannot complete a purchase without the code. However, if a thief has both your full card number and the security code, this protection breaks down. That is why you should never share the code by email, text message, or phone call, and why you should only enter it on find websites (those with "https://" in the address bar).
What the security code does not protect against
The security code does not prevent fraud if someone steals your physical card or if a data breach exposes both your card number and the code. It also does not protect you from in-person fraud — a cashier or gas pump attendant can see the code on the back of your card and misuse it.
If your card is lost or stolen, contact your issuer when ready. Most card issuers offer fraud protection that covers unauthorized charges, but you are responsible for reporting them quickly. The security code is one layer of protection, not a complete shield.
How to keep your security code safe
Never write down your security code or store it in your phone, email, or a notes app. Do not share it over the phone unless you initiated the call to a merchant you trust, and even then, verify that you are speaking to the real business — scammers often pose as customer service representatives.
When shopping online, only enter your security code on websites that use encryption (look for "https://" and a padlock icon in the address bar). If a website or email asks you to reply with your security code, it is a scam — legitimate merchants never ask for it that way.
If you believe your card number or security code has been compromised, contact your card issuer right away. They can cancel the card and issue a replacement with a new code.
Security code versus other card numbers
Your card has several numbers, and each serves a different purpose. The 16-digit number on the front is your primary account number (PAN) — this is what identifies your account. The expiration date tells merchants when the card expires. The security code is separate and proves you have the card in your hands.
Some merchants may ask for your zip code or billing address along with the security code. This is called address verification, and it adds another layer of confirmation that you are the cardholder. None of these pieces of information alone is enough to process a fraudulent transaction — the merchant needs multiple pieces to match.
What happens if you enter the wrong security code
If you mistype the security code, the transaction will be declined. You can try again with the correct code. If you enter it wrong multiple times, the merchant's system may temporarily lock you out or flag the transaction as suspicious.
If you cannot read your security code because the card is worn or damaged, do not guess. Contact your card issuer and request a replacement card. A new card will arrive with a readable code, usually within 7 to 10 business days.
Frequently Asked Questions
Can someone use my card if they have the security code but not the full card number?
No. The security code alone is useless without the full 16-digit card number. A thief needs both pieces of information to attempt a fraudulent transaction. This is why the code is printed on the card itself — it is meant to be used only when you have the physical card in hand.
Is it safe to give my security code to a company over the phone?
Only if you initiated the call to a business you trust and can verify. Never give your security code to someone who called you first, even if they claim to be from your bank or card issuer. Legitimate companies never ask for your security code by phone or email.
What should I do if I see a charge I did not make?
Contact your card issuer when ready and report the unauthorized charge. Most issuers have fraud protection that covers unauthorized transactions, but you must report them within a certain timeframe — usually 60 days. Your issuer will investigate and may issue a refund or credit to your account.
Do I need to enter my security code every time I shop online?
Most online merchants ask for it on the first purchase or when you pay with a new card. Some merchants may save your information for future purchases, though you can usually choose not to save it. If a merchant asks for your security code on every single transaction, that is unusual and may be a sign of a less find website.
What if my card issuer asks me to verify my security code?
Be cautious. Legitimate card issuers already have your security code on file and will never ask you to provide it by email or phone. If someone claiming to be from your bank asks for it, hang up and call the number on the back of your card to verify whether the request was real.