The security code is the three or four-digit number printed on your card that proves you physically have it when you make an online or phone purchase
The security code (also called CVV, CVC, or card verification value) is a separate number from your card number. It lives on the back of most cards as a three-digit code printed after the signature strip. American Express cards print a four-digit code on the front, above the card number on the right side.
When you buy something online or over the phone, the merchant asks for this code to confirm you actually hold the physical card. A thief who steals your card number alone cannot complete a purchase without it — they would need to see the card itself or know the code. This is why merchants require it for remote transactions but not for in-person swipes or chip reads, where the card is present.
The code is not stored in the card's magnetic stripe or chip. It exists only on the card's surface, which means it cannot be read by a card reader or ATM. Only you can see it.
Key Takeaways
- The security code is a three-digit number on the back of your card (or four digits on the front of American Express cards) that you enter for online and phone purchases.
- Merchants use the code to verify you have the physical card, not just the card number.
- The code is printed only on the card surface and is not stored in the chip or magnetic stripe, so it cannot be stolen through a data breach of a store's system.
- Never share your security code via email, text, or phone call — legitimate companies will never ask for it outside a checkout page.
- If your card is lost or stolen, contact your card issuer immediately; the security code alone does not prevent fraud if someone has the full card number.
Where the security code appears on different card types
Most Visa, Mastercard, and Discover cards print the three-digit code on the back, to the right of the signature strip. It is the last three digits of a longer number printed there. Look for a box or underline containing just those three digits.
American Express cards are different. The four-digit code appears on the front of the card, above the card number on the right side. It is printed in smaller text and is sometimes called the CID (Card Identification Number) instead of CVV.
Some older or specialty cards may not have a visible security code. Store cards, prepaid cards, or cards issued outside the United States occasionally omit it. If your card has no code, you may not be able to complete certain online purchases, and you should contact your card issuer to understand your options.
Why merchants ask for it and what they can and cannot do with it
When you enter your security code during checkout, the merchant's payment processor checks it against the code on file with your card issuer. The processor does not store the code after the transaction — it is used only to verify the purchase and then discarded. This is why a hacker who steals a merchant's database of card numbers cannot use those numbers to make purchases without the code.
Legitimate merchants never ask for your security code outside of a checkout page. If someone calls you claiming to be from your bank or a store and asks for the code, hang up and call the official number on the back of your card. Banks and stores already have your card information on file and have no reason to ask you for the security code over the phone or email.
The code is one layer of fraud protection, but it is not complete. If someone has your full card number, expiration date, and security code, they can make online purchases. This is why monitoring your statements and reporting unauthorized charges quickly matters as much as keeping the code private.
What to do if your security code is compromised
If you believe your card number and security code have been exposed — for example, through a data breach at a store where you shopped — contact your card issuer immediately. You can find the number on the back of your card or on your statement.
Your issuer can cancel the card and issue a replacement with a new number and a new security code. This process usually takes five to ten business days. In the meantime, ask about a temporary card number or digital wallet option so you can continue shopping online.
You are not responsible for fraudulent charges reported within 60 days of the statement date they appear on, under federal law. Report them as soon as you notice them. Your card issuer will investigate and typically issue a temporary credit while they do.
Security code versus other card numbers
Your card has several numbers, and each serves a different purpose. The 16-digit card number (15 for American Express) is the main account identifier. The expiration date tells you when the card stops working. The security code is separate and proves physical possession.
The card number alone is not enough to make an online purchase at most merchants — they require the expiration date and security code too. Together, these three pieces of information are sometimes called the "card not present" data because they are what you provide when the card is not physically swiped or inserted.
Your PIN (personal identification number) is different again. It is a four-digit code you create and use at ATMs and in-store chip readers. It is never printed on the card and should never be shared with anyone, including customer service representatives.
How to protect your security code
Treat your security code the same way you treat your card number: keep it private. Do not write it down or store it in your phone. Do not share it via email, text, or phone call. Do not read it aloud to someone else unless you are certain you are speaking to a legitimate merchant's checkout system.
When shopping online, enter the code only on a secure checkout page — look for "https://" in the address bar and a padlock icon in your browser. Avoid entering it on public Wi-Fi networks, though the encryption on the checkout page itself protects the code even on unsecured networks.
If you use a digital wallet like Apple Pay, Google Pay, or your card issuer's app, the security code is not transmitted to the merchant at all. The wallet handles the verification instead. This is one reason digital wallets are considered safer for online shopping.
Frequently Asked Questions
Can someone use my card with just the security code?
No. They need the full card number, expiration date, and security code together to make an online purchase. The security code alone is useless without the other numbers. However, if someone has all three pieces of information, they can shop online without having the physical card.
Is the security code the same as my PIN?
No. Your PIN is a four-digit code you create and use at ATMs and in-store chip readers. Your security code is printed on the card and used for online and phone purchases. They are completely separate, and you should never share either one.
What if I can't find the security code on my card?
Check the back of the card to the right of the signature strip (for Visa, Mastercard, or Discover) or the front above the card number (for American Express). If it is not there, contact your card issuer — some older or specialty cards do not have one, and your issuer can explain your options for online shopping.
Do I need to memorize my security code?
No. You should not memorize it or write it down. Keep it private and enter it only when you are making a purchase. If you are asked to provide it outside of a checkout, that is a sign of fraud.
Does the security code protect me from in-store fraud?
No. The security code is used only for online and phone purchases. In-store transactions use your card's chip or magnetic stripe instead. For in-store protection, watch your card during the transaction and monitor your statements for unauthorized charges.