The security code is a three- or four-digit number printed on your card that proves you physically hold it when you make a purchase online or by phone
The security code sits on the back of most credit cards, printed separately from your card number. On American Express cards, it appears on the front. This number — also called the CVV, CVC, or card verification value — is not stored in the card's magnetic stripe or chip. When you enter it during an online checkout or phone order, the merchant sends it to your card issuer to confirm that you have the physical card in your hand.
The code does not protect you from fraud on cards you report stolen, and it does not prevent someone with your card number from using it in person at a store. Its single job is to reduce the risk of someone using your card number alone — obtained through a data breach, phishing, or a written receipt — to make a purchase without having the card itself.
Key Takeaways
- The security code is a three-digit number on the back of Visa, Mastercard, and Discover cards, or a four-digit number on the front of American Express cards.
- You are required to enter it for online and phone purchases, but not for in-person transactions at a physical store.
- The code is not stored on your card's magnetic stripe or chip, so a stolen card number alone cannot be used online without it.
- If someone obtains your security code, contact your card issuer immediately and request a new card with a new code.
- The security code changes every time you receive a replacement card, even if your card number stays the same.
Where the security code appears on your card
On Visa, Mastercard, and Discover cards, the security code is printed on the back, to the right of the signature panel. It is the last three digits of a longer number printed there. On American Express cards, the code is four digits and appears on the front, above your card number on the right side.
The code is printed in a different color or font than the rest of the card, making it slightly harder to read in photographs. This design choice is intentional — it discourages people from photographing their cards for online storage or sharing.
Why merchants ask for it during online and phone orders
When you swipe, insert, or tap your card at a physical store, the card reader communicates directly with your card issuer in real time. The issuer can verify that the card is genuine and that you are the cardholder. Online and phone orders do not have this direct connection, so merchants cannot confirm you have the card without asking you to provide information that only the cardholder would know.
The security code serves this purpose because it is not printed on receipts, not stored in databases the way your card number is, and not transmitted through the magnetic stripe. A merchant who stores your card number in their system for recurring charges still cannot use it for a new purchase without the code, because they do not have it on file.
What happens if someone gets your security code
If your security code is exposed — through a data breach, a phishing email, or a lost receipt — contact your card issuer immediately. Request a new card. Your card number may stay the same, but your security code will change. The old code becomes useless.
Do not assume that exposure of your code alone is harmless. A person with both your card number and your security code can make online purchases in your name. They cannot use the code at a physical store, because in-person transactions do not require it, but they can order goods online, set up subscriptions, or make phone purchases.
The difference between the security code and your PIN
The security code and your PIN (personal identification number) are separate. Your PIN is a number you create and memorize; you enter it at an ATM or at a store when you choose to pay with debit. Your security code is printed on the card and is used only for online and phone purchases.
If someone has your security code but not your PIN, they can make online purchases but cannot withdraw cash from an ATM or use your debit card at a store. If someone has your PIN but not your security code, they can use your debit card in person but cannot make online purchases with a credit card.
Security codes on replacement cards and account changes
Every time your card issuer sends you a replacement card — whether because yours expired, was damaged, or was reported lost — the new card has a new security code. The code is unique to that physical card. If you have multiple cards on the same account, each one has its own code.
If you have set up a recurring charge (a subscription, monthly bill, or automatic payment) and your card is replaced, that recurring charge may fail on the next billing date because the merchant's system still has the old code. You will need to update your payment information with that merchant, providing the new code from your replacement card.
Why you should never share your security code
Never give your security code to anyone who calls you, emails you, or texts you claiming to represent your bank or card issuer. Your card issuer already has your security code on file — they do not need you to provide it. If someone asks for it unsolicited, they are attempting fraud.
Do not photograph your card with the security code visible and store the photo in your phone, email, or cloud storage. Do not write it down and keep it with your card. Do not give it to a merchant in person — if you are at a physical store, the card reader does not need it. The only time you should enter your security code is when you are making an online or phone purchase and the merchant's checkout page or customer service representative asks for it.
Frequently Asked Questions
Can someone use my card number without the security code?
In person at a store, yes — the card reader does not ask for the code. Online or by phone, no — the merchant will ask for it before processing the charge. This is why the code exists: to prevent online fraud when only your card number is known.
Does the security code change if I don't get a new card?
No. The code printed on your card stays the same for the life of that card. It only changes when you receive a replacement card from your issuer. If your card expires, the replacement card will have a different code.
What should I do if I accidentally shared my security code?
Contact your card issuer immediately and request a replacement card. Explain that your security code may have been compromised. Your issuer will send you a new card with a new code, usually within 7 to 10 business days. Monitor your account for unauthorized charges while you wait.
Is the security code the same as the number on the back of my card?
The security code is part of the number on the back of your card, but not the whole thing. On Visa, Mastercard, and Discover cards, the back shows a longer number; the security code is the last three digits of that number. On American Express, the four-digit code appears separately on the front.
Can I use my card online without entering the security code?
Most merchants require it, but some do not — particularly if you have saved your card information with them for a recurring charge or if you are logged into your account with them. However, merchants who do not ask for the code are taking on more fraud risk themselves, so the practice is less common.