The verification code is a three or four-digit number on your card that proves you physically hold it
The verification code — also called a CVV, CVC, or security code — is a short number printed on your card that you enter when you buy something online or over the phone. It is not encoded in the card's magnetic stripe or chip. Merchants cannot see it in their system after you complete the purchase. The code exists to prove you have the physical card in your hand, not just the card number.
This matters because someone who steals your card number online cannot use it without the code. They would need to have the actual card or know the number you see printed on it. It is a simple but effective barrier between your card number alone and a completed transaction.
Key Takeaways
- The verification code is a three-digit number on the back of most cards (or four digits on American Express cards on the front) that you must provide for online and phone purchases.
- The code proves you have the physical card; merchants do not store it after your purchase, so it cannot be stolen from their database.
- You should never give your verification code to anyone who calls you or emails you, even if they claim to be from your bank or card company.
- Legitimate companies will never ask for your verification code over the phone or email — they only ask for it when you initiate a purchase on their website.
Where to find your verification code
On Visa, Mastercard, and Discover cards, the code is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express cards, it is a four-digit number printed on the front, above the card number on the right side.
If your card is damaged and you cannot read the code, call your card issuer and they will provide it to you over the phone. You can also log into your online account with most banks and card companies — some display the code there, though not all do.
Why merchants ask for it during online purchases
When you enter your card number, expiration date, and billing address online, a merchant's system can check whether those details match what the card issuer has on file. But that information is all printed on the card or easily visible. The verification code is different — it is printed on the card but not encoded anywhere else, so only someone holding the physical card would know it.
This extra step catches many fraudulent transactions because a thief who obtained your card number through a data breach or phishing email would not have the code. It is not perfect protection — a thief who steals your actual card has everything — but it stops a large category of fraud that happens entirely online.
What happens to your verification code after you use it
When you complete a purchase, your card issuer (your bank or credit card company) receives the code and verifies it matches their records. After that, the merchant is not supposed to store it. In fact, payment industry rules called PCI DSS (Payment Card Industry Data Security Standard) forbid merchants from keeping the code in their system.
This is why a data breach at a store or website cannot expose your verification code the way it might expose your card number. The code was never meant to be stored anywhere except on the physical card and in your card issuer's secure system. If someone claims they need your code to look up your account or resolve a problem, that is a sign of fraud — no legitimate company stores or needs to retrieve that number.
How to protect your verification code
Treat your verification code the same way you treat your PIN at an ATM: do not say it out loud in public, do not write it down, and do not share it with anyone. The only time you should enter it is when you are the one making a purchase on a website you trust, or when you are calling a merchant to place an order yourself.
Never give your code to someone who contacts you first — not by phone, email, text, or chat. Your bank will never call you asking for it. A merchant will never email asking for it. If someone claims they need it to verify your account or process a refund, hang up or delete the message and call the company directly using the number on your card or their official website.
Verification codes and fraud protection
Having a verification code on your card does not make you responsible for fraud. If someone uses your card number without permission, your card issuer is required by federal law to limit your liability. Most cards offer zero liability for unauthorized purchases, meaning you pay nothing if fraud occurs.
That said, the verification code is one of your first lines of defense. Using it correctly — entering it only when you initiate a purchase, never sharing it — reduces the chance of fraud happening in the first place. It is a small step that works because it requires a thief to have something physical, not just information.
Frequently Asked Questions
Is the verification code the same as my PIN?
No. Your PIN is a number you create and use at ATMs or in-store to authorize transactions. Your verification code is printed on the card and used only for online or phone purchases. They are separate security features.
Can I use my card online without entering the verification code?
Most major websites require it, but some do not — particularly if you have saved your card to your account with them before. However, you should always be able to enter it if asked. If a site refuses to let you provide it, that is unusual and worth questioning.
What should I do if someone asks for my verification code over the phone?
Hang up. No legitimate company asks for this code over the phone. If you need to reach your card issuer, call the number on the back of your card, not a number the caller provided.
Does my verification code change?
No. The code stays the same for the life of the card. When you get a new card, you get a new code. If your card is replaced due to fraud or damage, the new card will have a different code.
Can someone use my card if they have the number but not the verification code?
They can try, but most online merchants will decline the transaction if the code is missing or wrong. In-person transactions do not require the code at all, so if someone has your physical card, they can use it in a store. This is why reporting a lost or stolen card immediately is important.