Your security code is a three- or four-digit number printed on your card that proves you physically have it
The security code — also called CVV, CVC, or card verification value — is a number printed on your card that you enter when you pay online or over the phone. It is not stored in the magnetic stripe or chip, so a merchant who only has your card number cannot process a payment without it. The code tells the payment system that you are the person making the purchase, not someone who found your card number online.
Where you find it depends on your card type. On Visa, Mastercard, and Discover cards, it is a three-digit number on the back, usually to the right of the signature strip. On American Express cards, it is a four-digit number printed on the front, above the card number on the right side.
Key Takeaways
- The security code is a three- or four-digit number that proves you have the physical card in your hand when you make an online or phone purchase.
- Visa, Mastercard, and Discover use a three-digit code on the back; American Express uses a four-digit code on the front.
- Never share your security code by email, text, or phone call — legitimate merchants never ask for it that way.
- The code is not the same as your PIN; your PIN is for ATM withdrawals and in-person debit transactions, while the security code is for card-not-present purchases.
How the security code protects you during online purchases
When you enter your security code at checkout, the merchant sends it to the payment processor, who checks it against the code on file with your bank. If the codes match, the transaction goes through. If they do not match — because someone has only your card number but not the physical card — the payment is declined.
This protection works only for card-not-present transactions: online shopping, phone orders, and mail orders. In a store, you swipe or insert your card, and the security code is not needed because the merchant can see you have the card. The code does not protect you against fraud if your physical card is stolen, because a thief with the card in hand can see the code and use it.
Why you should never give your security code to anyone who calls or texts you
Your bank, your credit card company, and any legitimate merchant will never ask for your security code by phone, email, or text message. If someone contacts you claiming to verify your account or process a refund and asks for this number, it is a scam.
The only time you should enter your security code is when you are the one initiating a purchase on a website you trust or over the phone to a merchant you called yourself. Even then, verify that you are on a secure website — look for "https://" and a padlock icon in your browser address bar — before you type it in.
The difference between your security code and your PIN
Your PIN (personal identification number) is a four-digit code you create when you open a debit account or request a PIN for a credit card. You use it at ATMs to withdraw cash and at store terminals when you choose "debit" instead of "credit" during checkout. Your PIN is secret and should never be written down or shared.
Your security code is printed on the card itself and is not something you create. It is meant to be seen only by you, but it is not as sensitive as your PIN because it cannot be used to withdraw cash or access your account directly. Still, treat it the same way: do not share it unless you are making a purchase you initiated.
What happens if your security code is compromised
If someone has your card number and security code, they can make online purchases in your name. However, most credit card companies offer fraud protection that covers unauthorized charges, so you are not responsible for paying them back. Your responsibility is to report the fraud as soon as you notice it.
Contact your card issuer immediately if you see charges you did not make. Tell them the specific transactions, and they will investigate. In the meantime, they will usually cancel your card and send you a new one with a new security code. The fraud investigation typically takes 30 to 60 days, and you should not be charged for the disputed amount during that time.
How to protect your security code in daily use
Do not photograph your card or store a picture of it on your phone. Do not write the code down or email it to yourself. Do not use the same password for multiple websites — if one retailer's database is breached, a thief could use your card information on other sites. When you shop online, use a password manager to create unique, strong passwords for each store.
If you are shopping on a public Wi-Fi network, use a VPN (virtual private network) to encrypt your connection. This prevents someone on the same network from intercepting your card data. On your own home network, make sure your router is password-protected and uses WPA2 or WPA3 encryption, not the older WEP standard.
Frequently Asked Questions
Can someone use my card if they only have the number and security code?
Yes, they can make online purchases. However, your card issuer covers unauthorized charges under fraud protection, so you will not pay for them. Report the fraud immediately so the issuer can cancel your card and investigate.
Is my security code the same every time, or does it change?
It stays the same for the life of your card. When your card expires or your issuer sends you a replacement, the new card will have a different security code printed on it.
What should I do if I accidentally shared my security code with a scammer?
Call your card issuer right away and tell them what happened. They will cancel your card, send you a new one, and watch your account for fraudulent charges. If charges appear before you report it, dispute them with your issuer.
Do I need to enter my security code at gas pumps or ATMs?
No. At gas pumps, you insert your card and may be asked for your PIN if you are using a debit card. At ATMs, you only need your PIN. If a machine asks for your security code, it is not a legitimate terminal — do not use it.