The security code is a three- or four-digit number on your card that proves you physically hold it when you shop online or by phone
The security code (also called CVV, CVC, or card verification value) is printed on your card itself, not encoded in the magnetic stripe or chip. When you enter it during an online purchase or phone order, the merchant sends it to your card issuer to verify that you actually have the card in your hand. The issuer checks the number against their records but does not tell the merchant whether it matches — they only say "yes" or "no" to the transaction.
This matters because a thief who steals your card number from a data breach or a skimming device may not have the physical card. The security code is one of the few pieces of information that stays off receipts, email confirmations, and most merchant databases, so it is harder to intercept than your card number alone.
Key Takeaways
- The security code is a three-digit number on the back of Visa, Mastercard, and Discover cards, or a four-digit number on the front of American Express cards.
- You must enter the security code for most online and phone purchases, but not for in-person transactions where you swipe or insert the card.
- The security code is not stored in the card's chip or magnetic stripe — it is only printed on the card itself.
- Merchants cannot store your security code after a transaction, so thieves who steal card data from a store database cannot use it to make online purchases.
Where the security code is located on your card
The location depends on your card brand. On Visa, Mastercard, and Discover cards, the security code is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express cards, it is a four-digit number printed on the front, above the card number on the right side.
The code is always printed in a different color or font than the rest of the card to make it stand out. If you cannot find it, call the number on the back of your card and ask — the issuer can tell you what it is without reading it aloud over the phone (they will ask you to verify it instead).
When merchants ask for the security code and why
You will be asked for the security code in three situations: online checkout, phone orders, and mail orders. In all three cases, the merchant cannot see your card in person, so the security code is one of the few ways to confirm you are the cardholder.
You should never be asked for the security code in a store when you are paying in person. If a cashier or attendant asks for it, that is a sign of fraud or a scam — legitimate in-person transactions do not require it. You also should not enter the security code on a gas pump, ATM, or any machine where you insert the card yourself; those devices have no legitimate reason to ask for it.
Why merchants cannot keep your security code
Payment card networks (Visa, Mastercard, American Express, and Discover) have strict rules that forbid merchants from storing your security code after a transaction is complete. This rule exists precisely because the code is meant to prove you have the card — if merchants could save it, the code would lose its purpose.
If a merchant's database is hacked and your card number is stolen, the thief will have your number, expiration date, and name, but not your security code. Without it, they cannot make online or phone purchases. This is why the security code is one of the most important anti-fraud tools you have, even though it only takes a few seconds to enter.
What to do if your security code is compromised
If you suspect someone has your security code — for example, you gave it to a merchant you no longer trust, or you entered it on a website that looked suspicious — you do not need to panic or request a new card immediately. The code is only useful if the thief also has your card number and expiration date, and even then, it only works for remote purchases.
The best step is to contact your card issuer and describe what happened. They can flag your account for fraud monitoring and watch for suspicious activity. If you see unauthorized charges, report them right away — your issuer will investigate and remove fraudulent charges under federal law. You can also request a replacement card if you want a fresh start, though it is not always necessary.
Security code versus other card numbers
Your card has several numbers, and each one serves a different purpose. Your card number (the 16 digits on the front) identifies your account to the merchant and the payment network. Your expiration date tells the issuer when the card is no longer valid. Your security code proves you have the physical card. Your PIN (if your card has one) proves you are the cardholder when you use an ATM or debit card at a store.
Merchants are required to ask for the security code during remote transactions, but they are forbidden from asking for your PIN. If anyone — online, by phone, or in person — asks for your PIN, that is always a scam. Your PIN should never leave your hands or your memory.
How the security code protects you from fraud
The security code is not perfect protection, but it raises the bar for thieves. A criminal who buys a stolen card number on the dark web can test it at some merchants, but they cannot use it for most online shopping without the security code. This forces them to either find a merchant with weak fraud checks or move on to easier targets.
The security code also protects you because merchants who ask for it are following payment network rules, which means they are legitimate businesses. Scammers often skip the security code requirement because they do not have the infrastructure to process it correctly — if a website does not ask for it during checkout, that is a red flag that something is wrong.
Frequently Asked Questions
Can someone use my card number without the security code?
Yes, in some cases. A thief with your card number and expiration date can make in-person purchases at stores that do not check the security code, or they can try to use it at merchants with weak fraud detection. However, most online and phone merchants require the security code, which blocks most remote fraud.
Is it safe to give my security code over the phone?
It is safe if you called the merchant yourself using a number you know is legitimate. Never give your security code to someone who called you, even if they claim to be from your bank or card issuer. Your issuer will never call and ask for it.
What if I enter the wrong security code?
The transaction will be declined. You can try again with the correct code. If you keep entering it wrong, the merchant's system may lock you out temporarily as a fraud prevention measure, but this does not affect your card or account.
Do I need to memorize my security code?
No. You should keep your card in a safe place and refer to it when you need the code. Do not write it down or store it separately from the card, and do not take a photo of it. The only time you should memorize sensitive card information is your PIN.
Why do some websites not ask for the security code?
Some merchants use other fraud detection methods, like address verification or 3D Secure (a system that redirects you to your bank to confirm the purchase). However, if a website never asks for the security code and has other red flags — like poor design or suspicious pricing — that is a sign to shop elsewhere.