A security code is a three- or four-digit number printed on your card that proves you physically have it
The security code — also called a CVV, CVC, or card verification value — is not stored in the card's magnetic stripe or chip. It lives only on the physical card itself and in the card issuer's records. When you enter it during an online or phone purchase, the merchant sends it to your bank, which checks whether the number matches what they have on file. If it does not match, the transaction is declined.
This number exists because a thief who steals your card number alone cannot complete an online purchase without it. They would need to have the card in their hands. For in-person purchases at a store or ATM, you do not enter the code — the card reader already knows you have the card because you inserted it or tapped it. Online and phone transactions are where the code does its work.
The code is printed, not encoded. That means a merchant or website that stores your full card number can still see the security code if they wrote it down or took a screenshot. This is why you should never email your card number and security code together, and why you should not type it into a website that asks you to save it for future purchases.
Key Takeaways
- A security code is a three- or four-digit number on the back (or front, for American Express) of your card that only you can see without holding the card.
- The code is checked during online and phone purchases to confirm you have the physical card, but it is not required for in-person transactions.
- Never save your security code to a website, email it, or write it down; merchants should never ask you to provide it except during a transaction.
- If your card is lost or stolen, contact your bank immediately — the security code alone cannot be used without the card number, but together they can be used for fraud.
Where the security code appears on your card
For Visa, Mastercard, and Discover cards, the security code is a three-digit number printed on the back of the card, to the right of the signature strip. It is the last three digits of a longer number that appears there.
American Express cards are different. The code is a four-digit number printed on the front of the card, above the account number on the right side. American Express calls it the CID (Card Identification Number) instead of CVV, but it serves the same purpose.
The code is always printed in a different color or font than the rest of the card to make it stand out. If you cannot find it, check the back right side first; if your card is an American Express, check the front right side instead.
How merchants use the security code during checkout
When you enter your card number, expiration date, and security code into a website or give them to a customer service representative over the phone, that information travels to a payment processor. The processor forwards the security code to your card issuer (your bank or credit union) for verification.
Your bank checks the code against the one they have on file. This check takes a few seconds. If the code matches, the bank sends back an approval and the transaction goes through. If the code does not match, the bank declines the transaction and the merchant is told the card failed verification.
A mismatch usually means one of three things: you typed the code wrong, the card is counterfeit or altered, or someone is trying to use a stolen card number. In any case, the transaction stops. This is why a security code mismatch is one of the fastest ways to catch fraud before money leaves your account.
What happens if you lose your card or it is stolen
If your card goes missing, call your bank's customer service number (on your statement or their website) and report it lost or stolen. Your bank will cancel the card and issue a replacement, usually within five to ten business days. The old card number and security code become useless for new transactions.
If fraudulent charges appear on your account before you report the card missing, your bank's fraud department will investigate. Under federal law, your liability for unauthorized charges is capped at $50, and most banks waive even that if you report the fraud promptly. The investigation usually takes 30 to 60 days, during which the bank may issue a temporary credit while they verify the charges were not yours.
Do not assume that a thief needs only your card number to commit fraud. They do need the security code for online purchases, but they can also use your card number for phone orders, mail orders, or in-person fraud if they have other identifying information. Report the card immediately rather than waiting to see if charges appear.
Why you should never store or share your security code
Many websites offer to save your card information for faster checkout on future purchases. You should allow them to save your card number and expiration date, but you should never allow them to save your security code. If a website asks you to enter your security code and then offers to save it, decline that option.
The reason is simple: if that website is hacked, a thief who steals your saved card information will have everything needed to make online purchases in your name. They will have your card number, expiration date, and security code. Your bank's fraud detection may catch some of these charges, but not all of them, and you will spend time disputing them.
You should also never email your card number and security code to anyone, even if they claim to be from your bank or a merchant. Your bank will never ask for your security code by email or phone. If someone contacts you asking for it, hang up or delete the message and call your bank directly using the number on your statement.
The difference between a security code and other card numbers
Your card has several numbers, and they serve different purposes. Your account number (the long number on the front) is what identifies your account to the bank. Your expiration date tells the merchant when the card stops working. Your security code proves you have the physical card.
Your routing number and account number (if you write a check) are different from your card number entirely — they come from your checking account, not your credit card. Your PIN (personal identification number) is a separate code you create and use at ATMs and some in-person purchases; it is not the same as your security code and should never be written on your card.
When you make a purchase online, you typically enter your card number, expiration date, and security code. In person, you insert or tap your card and may enter your PIN. Over the phone, you give your card number, expiration date, and security code. The security code is the only one of these that proves you have the card in your possession at that moment.
What to do if your security code is compromised
If you believe your security code has been seen or stolen — for example, if you typed it into a suspicious website or gave it to someone you did not trust — you do not need to panic, but you should act. Call your bank and report the incident. Your bank can flag your account for fraud monitoring and watch for unusual activity.
You do not need to cancel your card just because someone saw the code. The code alone is useless without your card number and expiration date. However, if you suspect that all three pieces of information have been compromised, cancel the card and request a replacement.
While you wait for a replacement card, you can still use your account for online purchases by calling the merchant's customer service line and providing your information over the phone. You can also use your bank's mobile app or website to make payments or transfers. The card itself is just one way to access your account.
Frequently Asked Questions
Can someone use my card number without the security code?
Yes, but only for certain types of purchases. They cannot complete an online purchase without it. They can attempt a phone or mail order, though many merchants now require the code for those too. They can also attempt in-person fraud if they have a counterfeit card made with your number, though modern chip technology makes that harder. Report a stolen card number immediately.
Is the security code the same as my PIN?
No. Your PIN is a number you create and enter at an ATM or in-person purchase. Your security code is printed on the card and used for online and phone purchases. They are completely separate. Never write your PIN on your card, and never use your PIN as your security code.
What if I enter the wrong security code?
The transaction will be declined. You can try again with the correct code. If you enter it wrong multiple times, your bank may temporarily block the card to prevent fraud. Call your bank to confirm the card is still active, then try the purchase again with the correct code.
Do I need to give my security code for in-person purchases?
No. When you insert or tap your card at a store, the card reader already knows you have the physical card. You may be asked to enter your PIN or sign a receipt, but not your security code. If someone asks for your security code in person, do not give it to them — it is a sign of fraud.
What happens if my card is replaced — do I get a new security code?
Yes. When your bank issues a replacement card, it will have a new security code printed on it. The old code stops working. This is one reason why you should not save your security code to websites — when your card is replaced, the saved code will no longer work and you will have to update it anyway.