The security code is a three- or four-digit number printed on your card that proves you physically hold it
The security code — also called the CVV, CVC, or card verification value — is a number printed on the back of your card (or front, on American Express). It is not encoded in the magnetic stripe or chip. When you enter it during an online or phone purchase, the merchant sends it to your card issuer to confirm that you have the physical card in your hand.
The code serves one purpose: to reduce fraud on transactions where the merchant cannot swipe or insert your card themselves. If a thief has only your card number and expiration date — stolen from a data breach, for example — they cannot complete most online purchases without the security code. You do not enter it at a gas pump or in a store; you only enter it when the merchant cannot read your card directly.
The security code is not the same as your PIN. Your PIN is a number you create and use at ATMs and in-store terminals. The security code is printed by the card issuer and cannot be changed.
Key Takeaways
- The security code is a three-digit number on the back of most cards or a four-digit number on the front of American Express cards.
- You enter the security code only for online and phone purchases, never at a physical store or ATM.
- The code proves you have the physical card; it is not stored in the card's chip or stripe.
- Never share your security code with anyone, and do not store it in your phone or email.
Where the security code appears on your card
On Visa, Mastercard, and Discover cards, the security code is a three-digit number printed on the back of the card, usually to the right of the signature panel. It is the last three digits of a longer number printed there.
On American Express cards, the security code is a four-digit number printed on the front of the card, above the card number on the right side.
The code is printed in raised or flat text, depending on the card. It is never embossed (raised like the card number). If you cannot find it, call the phone number on the back of your card and ask the issuer to read it to you — never give it to anyone else over the phone.
How merchants use the security code during checkout
When you enter your card number, expiration date, and security code on a website or over the phone, the merchant's payment processor sends all three pieces of information to your card issuer. The issuer checks that the security code matches the one on file for that card number.
If the code matches, the transaction is approved. If it does not match — because a thief has the card number but not the physical card — the issuer declines the transaction. The merchant never stores the security code after the transaction is complete; payment processors are required by law to delete it immediately.
Some merchants also use the security code to verify your identity if you call to place an order or dispute a charge. They may ask you to provide the last four digits of your card number and the security code to confirm you are the cardholder.
Why the security code does not protect you at physical stores
You do not enter the security code when you swipe or insert your card at a store, gas pump, or ATM. At these locations, the merchant reads your card directly — either through the magnetic stripe, the chip, or by scanning a contactless payment. The merchant can verify that the card is genuine without needing the security code.
The security code is only useful when the merchant cannot read the card themselves. Online and phone transactions are the only common situations where you must provide it.
If a thief steals your physical card and uses it in a store, the transaction goes through because the card itself is present. This is why you should report a lost or stolen card to your issuer immediately, even if you have not seen any fraudulent charges yet.
What to do if your security code is compromised
If you believe someone has your security code — for example, because you entered it on a phishing website or gave it to someone you did not trust — contact your card issuer right away. You do not need to wait for fraudulent charges to appear.
Your issuer can issue you a new card with a new security code. The old code will no longer work, even if someone has it. There is no charge for a replacement card.
If fraudulent charges do appear on your account, report them to your issuer as soon as you notice them. Under federal law, your liability for unauthorized charges is limited to $50 if you report them within 60 days of the statement date. Most issuers waive the $50 entirely and cover the full amount of fraud.
Never share your security code with anyone
Your security code should be treated like your card number. Never share it with anyone — not a merchant, not a bank employee, not a friend. Legitimate merchants and your card issuer will never ask you to provide it over the phone or in an email.
If someone calls you claiming to be from your bank and asks for your security code, hang up. Your issuer already has this information on file and does not need you to provide it. This is a common phishing tactic.
Do not photograph your card or store the security code in your phone, email, or password manager. If your phone is lost or hacked, a thief who finds the code can use it to make online purchases.
How the security code differs from other card numbers
Your card has several numbers, and each serves a different purpose. The 16-digit card number (15 digits on American Express) is the primary account number. The expiration date tells you when the card stops working. The security code is separate from all of these.
The card number and expiration date are encoded in the magnetic stripe and chip, so a merchant can read them when you swipe or insert your card. The security code is not encoded anywhere on the card itself — it is printed only on the surface. This design means a thief who steals the card data from a merchant's database cannot use the card number online without also having the physical card to read the security code from.
Your PIN is also different. The PIN is a number you create and enter at ATMs and in-store terminals to prove you are the cardholder. It is not printed on the card and is not used for online purchases.
Frequently Asked Questions
Can I use my card online without entering the security code?
Some merchants may not ask for it, especially if you have made purchases with them before or if you are logged into your account. However, most online retailers require the security code as a fraud prevention measure. If a site does not ask for it, that does not mean it is unsafe — it means the merchant has chosen not to use that verification step.
What if I enter the wrong security code?
The transaction will be declined. You can try again with the correct code. Entering the wrong code a few times will not lock your card or trigger a fraud alert, but repeated failed attempts may cause the merchant's system to block further attempts temporarily.
Does the security code change?
No. The security code stays the same for the life of the card. It only changes when you receive a replacement card from your issuer — either because the old card expired, was lost or stolen, or was damaged.
Is it safe to enter my security code on a website?
It is safe if the website is legitimate and uses encryption. Look for "https://" in the address bar and a padlock icon, which indicate the site is encrypted. Never enter your security code on a website you do not trust or that looks suspicious. If you are unsure whether a site is real, contact the company directly using the phone number on your card or their official website.
What happens if someone uses my card number and security code?
Report the fraud to your card issuer immediately. You are not responsible for unauthorized charges under federal law, and your issuer will investigate and refund the amount. The issuer will also issue you a new card with a new security code.