The security code is a three- or four-digit number printed on your card that proves you physically have it when you make an online or phone purchase
The security code sits on the back of most cards, printed after the last four digits of your account number. On American Express cards, it appears on the front, above your account number. This number is never stored in the magnetic stripe or chip — it exists only on the physical card itself. When you enter it during checkout, the merchant confirms that someone with the actual card in hand is making the purchase, not someone who only knows your account number.
The code has different names depending on your card issuer. Visa and Mastercard call it the CVV (Card Verification Value) or CVC (Card Verification Code). American Express calls it the CID (Card Identification Number). Discover uses CVV2. All three-digit versions serve the same purpose: they reduce fraud on remote transactions where the card is not physically present.
Key Takeaways
- The security code is a three- or four-digit number on your physical card that you must enter for online and phone purchases.
- Visa, Mastercard, and Discover print the code on the back of the card; American Express prints it on the front above the account number.
- Never share your security code via email, text, or phone unless you initiated the transaction and recognize the merchant.
- The code is not stored in your card's chip or stripe, so a data breach of a retailer's system cannot expose it.
- Legitimate companies will never ask you to provide your security code through unsecured channels or before you have chosen what to purchase.
Where the security code appears on different card types
On Visa, Mastercard, and Discover cards, flip the card over and look at the signature panel on the back. The security code is the last three digits printed to the right of your account number. It appears in a separate box or as part of the embossed number sequence, depending on the card design.
American Express cards display the code differently. Look at the front of the card, above your account number on the right side. The four-digit code appears in its own box. Because American Express cards are issued directly by the bank (not through a network like Visa), they use a four-digit code instead of three.
Some business cards and specialty cards may have the code in a slightly different location, but the principle is the same: it will be printed on the card itself, separate from the main account number, and visible only on the physical card.
Why merchants ask for it and what it protects
When you shop online or by phone, the merchant cannot see your physical card. They have your account number, expiration date, and name — information that appears on receipts or statements. The security code proves you have the card in your hands right now. If a criminal has stolen your account number but not the card itself, they cannot complete the purchase without this three- or four-digit code.
The code is not stored in the card's magnetic stripe or chip. When your card is swiped or inserted at a store, the stripe or chip transmits your account number and expiration date, but not the security code. This means a data breach at a retailer's payment terminal cannot expose your security code — a thief would have to physically see your card or intercept the information you type into a website.
The code is also not stored in the merchant's system after the transaction completes. Payment processors are required by law (under PCI DSS, the Payment Card Industry Data Security Standard) to delete the security code immediately after authorization. If a hacker breaks into a merchant's database, they will find account numbers and expiration dates, but not security codes.
When you should and should not share your security code
Share your security code only when you are making a purchase from a merchant you recognize and trust, on a website or phone line you initiated. If you are buying from Amazon, your bank's website, or a retailer you know, entering the code during checkout is safe and expected.
Never share your security code via email, text message, or over the phone unless you called the merchant first. Legitimate companies will never ask you to provide it through unsecured channels. If someone emails you claiming to be from your bank and asks for your security code, it is a phishing attempt — your bank already has your account information and will never ask for your code by email.
Be cautious if a merchant asks for your security code before you have selected items or agreed to a price. Legitimate checkout processes ask for the code at the final step, after you have reviewed the total. If a website asks for it earlier or in an unusual way, stop and contact the merchant directly using a phone number from their official website.
What to do if your security code has been compromised
If you believe someone has your security code — for example, you provided it to a website that turned out to be fraudulent — contact your card issuer immediately. You can find the number on the back of your card or on your monthly statement. Tell them you suspect fraud and ask them to monitor your account.
Your card issuer can issue you a new card with a new security code. The old code will no longer work, even if someone has written it down. This is one of the main reasons the code exists: it can be changed without changing your account number or expiration date.
You are not liable for fraudulent charges made with your card, even if the thief has your security code. Federal law (the Fair Credit Billing Act) limits your liability to $50 if you report the fraud promptly. Most card issuers waive even this $50 and cover the full amount. Report the fraud in writing to your card issuer as well as by phone, and keep copies of all correspondence.
How security codes differ from other card numbers
Your account number is the 16-digit (or sometimes 15-digit) number that identifies your specific card account. It is printed on the front of the card, appears on receipts, and is stored in merchant databases. Thieves who have only your account number and expiration date cannot make online purchases without the security code.
Your expiration date tells the merchant when your card stops being valid. It is printed on the front of the card and is required for any purchase. The expiration date changes when your card issuer sends you a replacement card, but your account number usually stays the same.
The security code is the only number that exists only on the physical card and is never stored anywhere else. This makes it the strongest protection against fraud when you cannot hand the card to someone in person. It is also the only number you should never write down or store in your phone or computer.
Frequently Asked Questions
Can someone use my card if they have my account number and expiration date but not the security code?
Not for online or phone purchases. In-person transactions do not require the security code because the merchant can see the physical card. But for any remote purchase — online, by phone, or by mail — the security code is required. Without it, the transaction will be declined.
Is it safe to enter my security code on a website?
Yes, if the website is legitimate and uses encryption. Look for "https://" at the beginning of the URL and a padlock icon in your browser's address bar. These indicate the connection is encrypted. Never enter your security code on a website that does not have these signs, or on a website you reached by clicking a link in an email.
What if I forgot my security code?
Look at the back of your physical card — it is printed there. If you do not have your card with you, contact your card issuer. They can tell you the code over the phone after verifying your identity. You can also log into your online account with most card issuers and view an image of your card that shows the code.
Do I need to memorize my security code?
No. You should never memorize it or write it down. The code is meant to prove you have the physical card in your hands at the moment of purchase. If you need it, look at the card itself. Memorizing it defeats the purpose and increases the risk if someone learns it.
Can my security code be stolen from a data breach?
Not from a merchant's database. Payment processors are required to delete the security code immediately after the transaction is approved. If a retailer's system is breached, hackers will find account numbers and expiration dates, but not security codes. The code can only be compromised if you share it directly with a fraudster or enter it on a fake website.