The security code is a three or four-digit number printed on your card that proves you physically have it in your hand

When you buy something online or over the phone, the merchant can't swipe your card or see your face. The security code — also called a CVV, CVC, or card verification value — is their way of checking that you're not just using a stolen card number. You read it off the back (or front, depending on the card type) and type it in. If the number matches what the card issuer has on file, the transaction goes through. If it doesn't, the purchase gets declined.

This code exists because a thief who steals your card number online might have the number itself, but they won't have the physical card. They can't see the security code without it. That three or four-digit barrier stops a lot of fraudulent purchases before they happen.

Key Takeaways

  • The security code is a three-digit number on the back of Visa, Mastercard, and Discover cards, or a four-digit code on the front of American Express cards.
  • You should never share your security code with anyone — not customer service, not friends, not anyone claiming to verify your account.
  • The code is printed on your card, not encoded in the magnetic stripe or chip, so it only exists if you have the physical card.
  • Online and phone purchases require the security code; in-person purchases at a store do not.

Where to find your security code

For Visa, Mastercard, and Discover cards, the security code is a three-digit number printed on the back of the card, usually to the right of the signature strip. You'll see it after the last four digits of your card number.

American Express cards are different. The four-digit code appears on the front of the card, above the card number on the right side. Some older Amex cards have it on the back instead, so check both places if you're unsure.

The code is printed, not embossed. You can't feel it when you run your finger across the card — you have to look at it. That's intentional. It makes the code harder to read from a distance or in a photo.

Why merchants ask for it but shouldn't store it

When you enter your security code during checkout, the payment processor checks it against the code on file with your bank. If they match, it's a strong signal that you authorized the purchase. The merchant gets a response — approved or declined — but they're not supposed to keep the code itself.

In fact, payment card rules forbid merchants from storing your security code after the transaction is complete. If a merchant's database gets hacked, the thief gets your card number, expiration date, and name — but not the security code. That code only lives on your physical card and in your bank's system.

This is why you have to enter the code every time you shop online, even at stores where you've bought before. It's also why you should never type it into an email, text message, or phone call, even if someone claims to be from your bank. Your bank already has it on file and will never ask you for it.

What the security code does and doesn't protect

The security code stops a specific kind of fraud: someone using your card number without your card. If a thief has your number but not the physical card, they can't complete an online or phone purchase without guessing the code. The odds of guessing a three or four-digit number are low enough that most fraudsters don't bother trying.

What it doesn't protect against: a thief who steals your actual card, a data breach where both your number and code are exposed, or someone who watches you enter the code in person. It also doesn't protect you if you give your information to a scammer willingly — if you type your code into a fake website or read it to someone on the phone, the code can't save you.

The security code is one layer of fraud protection, not the only one. Your bank also watches for unusual purchases, your card issuer can reverse fraudulent charges, and many online retailers use additional verification methods like address matching or 3D Secure passwords.

How to keep your security code safe

Treat your security code like you treat your PIN. Don't write it down. Don't photograph your card. Don't text it to anyone or type it into an email. Don't read it to someone on the phone unless you initiated the call to a merchant you trust.

If you're shopping online, only enter your code on a secure checkout page — look for the padlock icon in your browser's address bar and make sure the web address starts with "https" (the 's' means encrypted). Never enter your code on a pop-up window or a page that looks unusual.

If your card is lost or stolen, call your card issuer right away. They'll cancel the card and issue you a new one with a new security code. You don't need to worry about the old code — once the card is reported missing, it's worthless to a thief.

When you don't need to enter the security code

In a physical store, you never enter your security code. You swipe, insert, or tap your card. The merchant can see your card in person, so the code isn't needed. This is one reason why in-person purchases are generally safer than online ones — the merchant has more ways to verify you're the real cardholder.

Some recurring payments — like a subscription service or gym membership — may not ask for the code after the first purchase. The merchant has already verified the code once, and the payment is set up in their system. You can usually change or cancel these payments through your account with the merchant.

If a merchant asks for your security code in person, or asks you to read it over the phone when you didn't call them, that's a red flag. Hang up or walk away. Legitimate merchants don't need it in those situations.

What to do if your security code is compromised

If you think someone has your security code — because you typed it into a suspicious website, read it to a scammer, or saw it in a data breach notification — contact your card issuer immediately. Tell them you believe your code may be compromised and ask them to monitor your account for fraudulent activity.

Your bank can't change your security code without issuing you a new card, because the code is printed on the physical card itself. But they can flag your account, watch for unusual purchases, and reverse any fraudulent charges that do go through. They may also send you a replacement card with a new code as a precaution.

If fraudulent charges appear on your statement, report them to your card issuer. You're not responsible for unauthorized charges — federal law limits your liability to $50, and most card issuers waive that fee entirely. The bank will investigate and refund the money while they issue you a new card.

Frequently Asked Questions

Can someone use my card number without the security code?

Not for online or phone purchases — the code is required to complete those transactions. But if someone has your physical card, they can use it in a store without needing the code. If your card is lost or stolen, call your issuer immediately to cancel it.

Is it safe to save my security code when I shop online?

No. Don't let websites save it, and don't save it yourself in a note or photo. You'll have to enter it each time you shop, but that's the trade-off for security. Merchants aren't allowed to store it anyway, so any site that keeps it is breaking the rules.

What if I forget my security code?

Look at the back (or front, for Amex) of your physical card. The code is printed there. If you don't have your card with you, you can't complete an online purchase without it. You'll need to use a different payment method or wait until you can see your card.

Do I need to memorize my security code?

You don't need to memorize it, but you do need to have your card in front of you to enter it during checkout. This is intentional — it's another way to verify you actually have the card. If you could shop without seeing the code, the protection would be weaker.

What's the difference between CVV and CVC?

They're the same thing — different card companies use different names. Visa calls it CVV (Card Verification Value), Mastercard calls it CVC (Card Verification Code), and Discover uses CVV. American Express calls theirs CID (Card Identification). They all work the same way.