A security code is a three- or four-digit number printed on your card that proves you physically hold it
The security code—also called a CVV, CVC, or card verification value depending on which network issued your card—is a separate number from your card number. Visa and Mastercard print a three-digit code on the back of the card, usually near the signature strip. American Express prints a four-digit code on the front, above the card number. Discover uses a three-digit code on the back.
The code exists because someone who has only your card number and expiration date (stolen from a receipt, a data breach, or a skimmed terminal) cannot complete an online or phone purchase without it. The merchant never stores the security code after the transaction, so even if their database is breached later, a thief cannot use it. This is why merchants ask for it every time you shop online or by phone—they are checking that you have the physical card in your hand right now.
The security code is not the same as your PIN. Your PIN is what you enter at an ATM or a chip reader at a store. The security code is printed and static; your PIN is something you choose and can change.
Key Takeaways
- The security code is a three- or four-digit number printed on your card that merchants use to verify you physically possess the card during online and phone transactions.
- Visa and Mastercard place the code on the back; American Express places it on the front; the code is never stored after a transaction completes.
- You should never share your security code with anyone except the merchant you are actively paying, and never type it into a link someone sends you.
- If your card is lost or stolen, contact your card issuer immediately; the security code alone cannot be used without the card number and expiration date.
Where the security code appears on each card network
Visa and Mastercard print the three-digit code on the back of the card, to the right of the signature strip. It is the last three digits of a longer number printed there.
American Express prints a four-digit code on the front of the card, just above the embossed card number. It appears in smaller print than the main number.
Discover uses a three-digit code on the back, similar to Visa and Mastercard. Some older Discover cards may have it on the front; check your specific card.
If you cannot locate the code on your card, call the customer service number on the back of the card or log into your online account. The issuer can confirm the code without reading it aloud over the phone—they will ask you to verify it, not recite it.
When merchants ask for your security code and why
Merchants request the security code during any transaction where you are not physically swiping, inserting, or tapping your card. This includes online shopping, phone orders, mail orders, and some subscription renewals. The code tells the merchant's payment processor that you have the card in your possession at that moment.
The merchant's system sends the code to your card issuer for verification but does not store it. Payment Card Industry (PCI) rules forbid merchants from keeping the code on file, even with your permission. This is why you must enter it every time you shop online, even at stores where you have saved your card information—the merchant has your number and expiration date but not the code.
Some merchants may ask for the code when processing a refund or a recurring charge. This is normal and does not mean anything is wrong with your account.
How to protect your security code from theft
Treat your security code the same way you treat your card number: share it only with merchants you initiated contact with. Never type it into a link someone sends you via email or text, even if the message appears to come from your bank or a store you use. Legitimate companies will never ask you to enter sensitive card information through a link.
Do not photograph your card or store a picture of it on your phone. Do not write the code down or store it in an email or note-taking app. If someone calls you claiming to be from your bank and asks for the code, hang up and call the number on the back of your card instead.
When you shop in person, shield the card reader with your hand so others cannot see you enter your PIN. At online checkout, make sure the website address begins with "https://" (the "s" means the connection is encrypted) before entering any card details.
If your card is lost or stolen, contact your issuer right away. The security code alone cannot be used to make purchases without the card number and expiration date, but you should still report the loss to prevent fraud.
What happens if someone has your security code
A thief who has only your security code cannot make a purchase. They also need your card number and expiration date. If they have all three pieces of information, they can attempt online or phone transactions, but the issuer's fraud detection system may block the purchase if it looks unusual (different location, different merchant category, unusually large amount).
The security code is designed to stop fraud from stolen card numbers alone. Before the code existed, thieves could use a card number and expiration date found in a data breach or on a receipt. The code raised the bar by requiring physical possession of the card.
If you notice a charge you did not make, contact your card issuer immediately. Most issuers cover fraudulent charges under their zero-liability policy, meaning you are not responsible for the amount. Report the fraud through the phone number on your statement or the back of your card, not through a link in an email.
Security codes and recurring charges
When you set up a subscription or recurring payment (like a gym membership or streaming service), you enter your card number, expiration date, and security code. The merchant stores the card number and expiration date but not the code. Each time the charge recurs, the merchant's system processes it without asking for the code again.
If you want to stop a recurring charge, you can cancel through the merchant's website or app, or contact your card issuer and ask them to block future charges from that merchant. Canceling through the merchant is faster and cleaner, but if the merchant makes it difficult, your issuer can help.
If you update your card (because it expired or you got a replacement), you will need to enter the new security code the next time the subscription renews. The merchant cannot use the old code with your new card number.
Security codes and card replacement
If your card expires or is damaged, your issuer will send you a replacement card with a new security code. The new code will be different from the old one, even though the card number may stay the same (depending on your issuer's policy).
If you have recurring charges set up, you will need to update them with the new card details and new security code before the next charge date. Most merchants let you do this through your account settings. If you do not update in time, the charge may fail, and the merchant may contact you to ask for the new information.
If your card is lost or stolen and you request an emergency replacement, the new card will arrive with a different security code. Use the new code for all future transactions.
Frequently Asked Questions
Is the security code the same as my PIN?
No. Your PIN is a number you create and enter at an ATM or in-store chip reader. Your security code is printed on the card and used for online and phone purchases. You cannot change your security code; it is tied to the physical card.
Can I use my card online without entering the security code?
Most merchants require it for online purchases. Some may skip it if you have saved your card with them before, but this depends on the merchant and your issuer's fraud rules. If a merchant does not ask for it, that is their choice, not a sign that your card is less secure.
What should I do if I accidentally shared my security code with someone?
Contact your card issuer right away. They can monitor your account for fraud and, if needed, issue you a replacement card with a new code. If the person also has your card number and expiration date, the risk is higher, so report it immediately.
Does the security code protect me from in-person fraud?
No. The security code is only used for online, phone, and mail transactions. In-person purchases use your chip or magnetic stripe, not the security code. Fraud protection at physical stores relies on the chip, your signature, or your PIN.
Can a merchant store my security code for future use?
No. Payment Card Industry rules forbid it. Any merchant who asks to keep your security code on file is either breaking the rules or misunderstanding the policy. You should not provide it.