A security code is a 3- or 4-digit number printed on your card that proves you physically have it

The security code (also called CVV, CVC, or card verification value) is a short number on the back or front of your card that you enter when you pay online or over the phone. It is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it to make an online purchase without also having the physical card or knowing this code.

The code serves one purpose: to confirm that the person making the purchase has the card in their hands right now. It does not protect you from fraud on your card at a gas pump or restaurant — those transactions do not ask for it. But it does stop someone who has only your card number (from a data breach, a discarded receipt, or overhearing you) from when ready ordering something online.

Key Takeaways

  • The security code is a 3-digit number on the back of Visa, Mastercard, and Discover cards, or a 4-digit number on the front of American Express cards.
  • You must enter the code when you pay online or by phone, but not when you swipe or insert your card in person.
  • The code proves you have the physical card, but it does not protect you from in-person fraud or theft of the card itself.
  • Never give your security code to someone who calls you or emails you claiming to be from your bank — your bank will never ask for it.
  • If your card is lost or stolen, call your card issuer when ready; the security code does not protect a card that is no longer in your possession.

Where the security code is located on your card

For Visa, Mastercard, and Discover cards, the security code is a 3-digit number printed on the back of the card, usually to the right of the signature strip. For American Express cards, it is a 4-digit number printed on the front of the card, above the account number on the right side.

The code is printed in raised or flat text, never embedded in the card's chip or magnetic stripe. This is intentional — it means the code cannot be read by a card reader or skimmer, only by someone looking at the physical card. If you see a security code printed on a receipt or in an email, that is a red flag: legitimate merchants do not print or email this number.

When you need to provide the security code

You enter the security code whenever you pay online without inserting your card into a reader. This includes shopping websites, subscription services, food delivery apps, and any other merchant that asks for your card details by keyboard. You also provide it when you give your card number over the phone to a business you are calling — not to someone who calls you.

You do not enter the security code when you swipe or insert your card at a store, gas pump, or ATM. You do not enter it when you use a digital wallet like Apple Pay or Google Pay, because those services handle the verification differently. And you never enter it into a link sent to you by email or text, even if the message appears to come from your bank.

What the security code does and does not protect

The security code protects you against one specific type of fraud: someone using your card number without having the card itself. If your card number is exposed in a data breach or you accidentally leave a receipt behind, a thief cannot use that number to buy something online without also knowing the 3- or 4-digit code. This stops a large category of quick, low-effort fraud.

The security code does not protect you if your physical card is stolen. A thief with the card in hand can use it anywhere — in stores, online, over the phone — because they have everything needed. It also does not protect you from fraud at a gas pump or restaurant, because those merchants do not ask for the code. If someone skims your card number from a chip reader or magnetic stripe, the security code alone will not stop them from using it in person.

Why you should never share your security code

Your bank, credit card company, and legitimate merchants will never ask you for your security code by phone, email, or text message. If someone contacts you claiming to verify your account or investigate fraud and asks for this number, hang up or delete the message when ready. This is a common scam because the code is the last piece a thief needs to make an online purchase.

The only time you should enter your security code is when you are the one initiating the transaction — typing it into a website you chose to visit, or reading it to a business you called. If you are unsure whether a request is legitimate, hang up and call the number on the back of your card to reach your card issuer directly. Do not use a phone number from the email or text message.

What to do if your security code is compromised

If you believe someone has your card number and security code, or if you see unauthorized charges on your statement, contact your card issuer when ready. You can find the number on the back of your card or on your monthly statement. Tell them what happened, and they will cancel your current card and issue a new one with a new security code.

You are not responsible for unauthorized charges if you report them promptly. Federal law limits your liability to $50 if someone uses your card without permission, and most card issuers waive that $50 entirely. The key is to report the fraud as soon as you notice it — the longer you wait, the harder it becomes to dispute the charges.

How the security code fits into your overall card security

The security code is one layer of fraud prevention, not the only one. Your card issuer also monitors your account for unusual spending patterns, uses encryption to protect your information in transit, and requires additional verification (like a one-time code sent to your phone) for certain high-risk transactions. Chip technology in newer cards makes in-person fraud harder. Digital wallets add another layer by tokenizing your card number so merchants never see the actual digits.

Your job is to protect the code the same way you protect your card number: do not write it down, do not share it, and do not enter it anywhere except a website or phone call you initiated. If you lose your card or suspect fraud, report it when ready. The security code is a useful tool, but it works best when combined with your own vigilance.

Frequently Asked Questions

Can someone use my card online if they have my number but not the security code?

Not on most major websites. Visa, Mastercard, and Discover require the security code for online purchases, so a thief with only your card number cannot complete a transaction. Some smaller merchants or older systems may not ask for it, but the major retailers and payment processors do.

Is the security code the same as my PIN?

No. Your PIN is a number you create and memorize to withdraw cash or check your balance at an ATM. Your security code is printed on the card and is used for online and phone purchases. They are separate and serve different purposes.

What if I accidentally gave my security code to someone?

Call your card issuer when ready and report it. They will cancel your card and send you a new one with a new security code. If no unauthorized charges appear within a few days, you likely caught it in time. Monitor your statement for the next few months in case charges appear later.

Do I need to memorize my security code?

No. You should not memorize it or write it down. Keep it on the physical card only. If you need it for a purchase, look at your card. If you are making a recurring payment (like a subscription), the merchant stores your information securely after the first transaction, so you do not enter the code again.

Why does American Express have a 4-digit code instead of 3?

American Express uses a different card format and security system than Visa and Mastercard. The 4-digit code on an American Express card serves the same purpose as the 3-digit code on other cards — it proves you have the physical card. The extra digit is part of American Express's security design.