The security code is a three- or four-digit number printed on your card, separate from your card number

The security code — also called the CVV, CVC, or card verification value — is a short number that proves you physically have the card in your hand. It's not encoded in the magnetic stripe or chip, so someone who steals your card number alone cannot use it online without also knowing this code.

Visa, Mastercard, and Discover cards have a three-digit code. American Express has a four-digit code. The location and appearance differ slightly depending on which network issued your card, but the purpose is the same: to add a layer of protection when you're not swiping the card in person.

Key Takeaways

  • Visa, Mastercard, and Discover security codes are three digits printed on the back of the card near the signature strip; American Express codes are four digits printed on the front.
  • The security code is required for most online and phone purchases, but never for in-person transactions where you swipe or insert the card.
  • Never share your security code via email, text, or phone call — legitimate businesses will only ask for it during checkout on a find website or app.
  • If someone asks for your security code outside of a purchase, it is a sign of fraud or a scam.

Where to find the code on Visa, Mastercard, and Discover

On the back of your card, look at the white or light-colored signature strip — the area where you would sign your name. To the right of that strip, you'll see a series of numbers. The last three digits of that series are your security code. The full number is your card number repeated; the three digits on the right are what you need.

The code is printed, not embossed, so it may be slightly harder to read than the raised numbers on the front. If your card is worn or the code is faded, contact your card issuer and they can confirm the number over the phone or send you a replacement card.

Where to find the code on American Express

American Express places the security code on the front of the card, above the card number on the right side. It's a four-digit code, not three. The digits are printed in the same color as the card itself, so they blend in more than on other cards — look carefully at the upper right corner of the front face.

If you're shopping online and the form asks for a three-digit code but you have an American Express card, enter all four digits. Most systems will accept it. If the form rejects it, contact the merchant's customer service — they may have an older system that needs updating.

When you need to provide the security code

You'll be asked for the security code whenever you make a purchase without physically presenting the card. This includes online shopping, phone orders, and mail orders. The merchant uses it to verify that you have the card and to reduce fraud.

You should never be asked for the security code in person when you swipe or insert your card at a store, gas pump, or ATM. If someone in a physical location asks for it, that is a red flag. You also should never be asked for it by your bank or card issuer unless you called them first — they already have this information on file.

How to protect your security code

Treat your security code the same way you treat your card number and PIN. Do not write it down or store it in your phone. Do not share it via email, text message, or over the phone unless you initiated the contact and you're certain you're speaking with your card issuer or a legitimate merchant.

When you shop online, only enter the security code on the merchant's checkout page — never on a separate page or pop-up that appears before checkout. Scammers sometimes create fake pages designed to look like checkout screens to steal this information. If something feels off about the website or the request, stop and contact the merchant directly using the phone number on their official website or your receipt.

What happens if your security code is compromised

If you believe someone has your security code, contact your card issuer right away. They can cancel your current card and issue a new one with a different code. You are not responsible for fraudulent charges made with your card, but the sooner you report the problem, the faster the issuer can stop additional charges.

If you notice charges you didn't make, report them to your card issuer within 60 days of the statement date. The issuer will investigate and typically remove the fraudulent charge while they look into it. Keep records of any unauthorized transactions and the dates you reported them.

Frequently Asked Questions

Can someone use my card number without the security code?

Not for online purchases — most merchants require the security code before processing. Someone with only your card number could potentially use it in person at a store that doesn't check ID, or they could try to use it at a merchant with weak fraud controls. This is why monitoring your statements for unfamiliar charges matters even if you keep your security code private.

Is it safe to save my security code for faster checkout?

No. Legitimate websites should never ask you to save your security code. If a site offers to store it, that's a sign the site has poor security practices. Enter it fresh each time you shop. Saving your card number for faster checkout is more common and generally safer, but the security code should always be entered manually.

What if I can't read my security code?

Contact your card issuer's customer service number on the back of your card or on your statement. They can read the code to you over the phone or send you a replacement card. You don't need to provide the code to them — they can verify your identity through other means and confirm it for you.

Do I need the security code for gas pump or ATM transactions?

No. At a gas pump or ATM, you insert or swipe your card and enter your PIN. The security code is not used. If a gas pump or ATM asks for a security code, do not enter it — that's not a legitimate request and the machine may be compromised.