The security code is a three- or four-digit number printed on your card that proves you physically hold it
The security code (also called CVV, CVC, or card verification value) is a number printed on your card itself, separate from your card number. It appears on the back of most cards as the last three digits after the signature strip. American Express prints a four-digit code on the front, above the card number.
When you enter this code during an online or phone purchase, the merchant sends it to your card issuer to verify that you actually have the physical card in your possession. The issuer checks the code against their records but does not store it after the transaction clears. This is why a thief who steals your card number alone cannot complete most online purchases without also knowing this code.
The security code is not the same as your PIN (the number you enter at an ATM or in-store terminal). Your PIN is encrypted and stored by your bank. Your security code is not stored after use, which is why it is printed on the card itself rather than memorized.
Key Takeaways
- The security code is a three- or four-digit number printed on your card that merchants use to verify you physically possess the card during online or phone transactions.
- Visa and Mastercard print the code on the back after the signature strip; American Express prints it on the front above the card number.
- Never share your security code with anyone except the merchant you are paying, and never enter it on a website unless you initiated the transaction yourself.
- If your card is lost or stolen, contact your issuer immediately; the security code alone cannot be used to make purchases without the full card number.
- Your issuer does not store the security code after a transaction, so a data breach of merchant records cannot expose it the way it can expose your card number.
Where the security code appears on your card
On Visa, Mastercard, and Discover cards, the security code is printed on the back of the card in the signature panel area. It is the last three digits of a longer number printed there. You will see it to the right of the signature line, usually in a small box or just printed directly on the card back.
American Express cards display the code differently: it is a four-digit number printed on the front of the card, above and to the right of the main card number. This is one of the few ways to tell an Amex card apart from other cards at a glance.
If your card is damaged and the security code is no longer readable, contact your card issuer and request a replacement card. You cannot use the card for online purchases without a readable code, and the issuer will not provide the code over the phone for security reasons.
How merchants use the security code during checkout
When you make a purchase online or by phone, the merchant asks you to enter your security code as part of the payment information. The merchant's payment processor sends this code to your card issuer along with your card number and the transaction amount.
Your issuer verifies that the code matches the one on file for that card number. If it matches, the transaction is approved. If it does not match or is missing, the transaction is declined. This verification happens in seconds, and you see the result immediately.
The merchant does not store your security code after the transaction. Payment Card Industry (PCI) rules prohibit merchants from keeping it on file, even with your permission. This means that if a merchant's database is breached, the thief cannot obtain your security code from their records—only your card number and expiration date.
Why you should never share your security code
Your security code is as sensitive as your card number itself. Never enter it on a website you did not navigate to yourself, never give it to someone over the phone unless you initiated the call to a merchant you trust, and never type it into a text message or email.
Scammers often call or email claiming to be from your bank or a retailer, asking you to "confirm" your security code. Your bank will never ask for this information. If someone contacts you requesting it, hang up or delete the message and call your card issuer directly using the number on the back of your card.
If you accidentally share your security code with someone you do not trust, contact your card issuer immediately. They can cancel your card and issue a replacement. Because the code is not stored anywhere except on the physical card, replacing the card eliminates the risk.
What happens if your card is lost or stolen
If your card goes missing, call your card issuer right away using the number on your statement or the back of another card. The issuer will freeze the account and issue a replacement card with a new security code.
A thief who finds your card can use it in person at stores without needing the security code. However, they cannot complete most online or phone purchases without knowing the three- or four-digit code printed on the card. If the card is stolen before you notice, the thief has only a limited window to use it online before you report it missing and the issuer blocks it.
Once you report the card lost or stolen, you are not responsible for unauthorized charges made after that point. Charges made before you reported it may be disputed, and your issuer will investigate. Keep your replacement card in a safe place and monitor your account regularly for unfamiliar transactions.
Security code versus other card numbers
Your card has several numbers, and each serves a different purpose. Your card number (the 16-digit number on the front) identifies your account. Your expiration date tells merchants when the card expires. Your security code proves you have the physical card. Your PIN (if you have one set up) proves your identity at ATMs and in-store terminals.
The security code is unique because it is printed on the card but not stored in merchant databases. Your card number and expiration date are stored by merchants you have paid before, which is why you do not have to re-enter them every time. Your security code must be entered fresh each time because it is not kept on file anywhere.
If you see a charge on your statement that you do not recognize, you do not need your security code to dispute it. Contact your issuer and describe the transaction. They will investigate and reverse it if it was unauthorized, regardless of whether you can provide the security code.
Protecting your security code in daily life
When you receive a new card, write down the security code in a secure location separate from the card itself—a locked drawer, a password manager, or a safe at home. Do not photograph it or store it in your phone, email, or cloud storage. If someone gains access to your phone or email, they would have both the code and potentially your card number.
When entering your security code online, make sure you are on a legitimate merchant website. Check that the URL begins with "https://" (the "s" indicates encryption) and that there is a padlock icon in the address bar. Never enter it on a website that looks unprofessional, has spelling errors, or asks for information that seems unnecessary.
If you shop regularly with the same merchant, many will ask if you want to save your card for future purchases. When you do this, the merchant stores your card number and expiration date but not your security code. You will still need to enter the code for each transaction, or the merchant may use a different verification method.
Frequently Asked Questions
Can someone use my card online if they only know the security code?
No. A merchant needs your full card number, expiration date, and security code to process an online transaction. Knowing only the security code is useless without the card number. However, if someone has all three pieces of information, they can make purchases, so treat your security code as carefully as you treat your card number.
What should I do if I accidentally gave my security code to a scammer?
Call your card issuer immediately using the number on the back of your card or on your statement. Tell them you shared your security code with an unauthorized person. They will cancel your card and send a replacement with a new code. You are not liable for fraudulent charges made after you report the incident.
Why does American Express put the security code on the front instead of the back?
American Express uses a different card format and security model than Visa and Mastercard. The four-digit code on the front (called the CID) serves the same purpose as the three-digit CVV on the back of other cards. Both are printed on the card and not stored in merchant databases.
Do I need to enter my security code at a gas pump or ATM?
No. At a gas pump, you enter your PIN or swipe your card without entering a security code. At an ATM, you use your PIN. The security code is only used for online purchases, phone orders, and mail orders where the merchant cannot physically see your card.
If my card is damaged and the security code is worn off, can I still use it online?
No. Most online merchants require the security code, and you cannot complete the transaction without it. Contact your card issuer and request a replacement card. They will not provide the code over the phone, so a replacement is your only option.