The security code is a three- or four-digit number printed on your card that proves you physically have it when you make an online or phone purchase.
On most cards, this number appears on the back, usually in or near the signature strip. Visa, Mastercard, and Discover cards have a three-digit code. American Express cards have a four-digit code printed on the front, above the account number. The code itself is not encoded in the card's magnetic stripe or chip — it exists only as a printed number, which is why merchants ask for it during remote transactions.
The security code serves one purpose: to reduce fraud on purchases you make without the physical card present. When you enter it during checkout, the merchant sends it to the card network for verification. The network checks that the number matches the card on file. If someone has stolen your card number but not the physical card, they cannot complete the transaction without this code.
Key Takeaways
- The security code is a three-digit number on the back of Visa, Mastercard, and Discover cards, or a four-digit number on the front of American Express cards.
- You should never share your security code with anyone except during a legitimate purchase with a merchant you trust.
- Merchants are not supposed to store your security code after a transaction, so each purchase requires you to enter it again.
- A security code does not protect you against in-person fraud or against someone using your card at a physical store.
Where the Security Code Appears on Different Card Types
The location and length of the security code depend on which card network issued your card. Visa, Mastercard, and Discover all print a three-digit code on the back of the card, usually to the right of the signature panel. This code is sometimes called the CVV2 (Card Verification Value 2) or CVC (Card Verification Code), though the names are largely interchangeable in practice.
American Express works differently. The four-digit code appears on the front of the card, above and to the right of the account number. American Express calls this the CID (Card Identification Number). If you have an American Express card, do not look for a code on the back — it will not be there.
Some older or specialty cards may not have a visible security code at all. If your card lacks one, you may not be able to complete certain online transactions. Contact your card issuer to confirm whether your specific card has a security code.
Why Merchants Ask for the Security Code
Merchants request the security code during online and phone purchases because they cannot physically inspect your card or run it through a reader. The code is their way of confirming that you have the card in your possession at the moment of purchase. Without it, a thief who obtained your card number through a data breach or other means could make purchases without the physical card.
The card network (Visa, Mastercard, Discover, or American Express) verifies the code on the issuer's end. The merchant never sees whether the code is correct or incorrect — they only receive an approval or decline. This separation means the merchant cannot use the code to commit fraud later, because they are not supposed to store it.
The security code does have limits. It protects against remote fraud but not against someone using your physical card in a store. It also does not protect you if your card number and security code are both stolen, which can happen through a data breach at a merchant or payment processor.
What You Should Never Do With Your Security Code
Never give your security code to anyone who calls you or emails you claiming to represent your bank or card issuer. Banks and card issuers will never ask for your security code over the phone or by email. If someone contacts you requesting it, hang up or delete the message and call your card issuer directly using the number on the back of your card.
Do not write your security code down or store it anywhere — not in your phone, not in a note, not in a password manager. The only time you should enter it is during a purchase with a merchant you initiated contact with. If you are buying from a website, make sure the URL begins with "https://" and that you recognize the merchant.
Never provide your security code to someone selling you something in person, even if they claim their payment system is down. In-person transactions do not require a security code. If a merchant asks for it in a store, that is a sign of fraud.
How the Security Code Protects You (and How It Does Not)
The security code reduces the risk of "card-not-present" fraud — the kind that happens when someone uses your card number online or over the phone without having the physical card. Because the code is printed and not stored in the card's chip or stripe, a thief who skims your card or intercepts your card number online cannot use it without the code.
However, the security code does not protect you in several common fraud scenarios. If both your card number and security code are stolen in a data breach, the code offers no protection. If someone steals your physical card, they do not need the security code to use it in a store. If you give your security code to a merchant you do not trust, that merchant can use it to make fraudulent charges.
Your card issuer's fraud protection is what actually protects you. Most issuers limit your liability for unauthorized charges to $50 under federal law, and many offer zero-liability policies that cover all fraudulent charges. The security code is just one tool that helps prevent fraud from happening in the first place.
What Happens If Your Security Code Is Compromised
If you believe your security code has been stolen — for example, because you entered it on a fraudulent website — contact your card issuer immediately. You do not need to wait for fraudulent charges to appear. The issuer can issue you a new card with a new security code.
Your old card will be deactivated, and any charges made with the old code after you report the compromise will be investigated as fraud. The issuer will typically send you a replacement card within 7 to 10 business days, though some issuers offer expedited delivery for an additional fee.
In the meantime, you can still use your account for online purchases if the issuer provides a temporary card number or digital wallet option. Ask your issuer what options are available while you wait for the replacement card to arrive.
Merchants Are Not Supposed to Store Your Security Code
Payment Card Industry Data Security Standard (PCI DSS) rules prohibit merchants from storing your security code after a transaction completes. This means that even if a merchant's database is breached, the thief cannot obtain your security code from their records.
In practice, this rule is enforced through audits and fines, not through perfect compliance. Some merchants or payment processors may store the code in violation of the rules. This is one reason why using a digital wallet (Apple Pay, Google Pay, or your card issuer's app) is safer than entering your card details directly on a website — the wallet does not transmit your security code to the merchant at all.
If you discover that a merchant has stored your security code, you can report it to your card issuer or to the Federal Trade Commission. Your issuer may also issue you a new card as a precaution.
Frequently Asked Questions
Is the security code the same as my PIN?
No. Your PIN is a number you create and use at ATMs and in-store terminals. Your security code is printed on the card and used only for remote purchases. You should never be asked to provide your PIN to a merchant or over the phone.
Can I use my card online without a security code?
Most online merchants require a security code, but some do not. Subscription services and merchants you have used before may skip the code if your card is already on file. Some digital wallets also bypass the code requirement. If a merchant does not ask for it, that does not mean your card is less secure.
What if I forgot my security code?
Look at your physical card — the code is printed on it. If you do not have your card with you, contact your issuer and they can read it to you over the phone. They may ask security questions to confirm your identity first.
Does the security code change?
The security code printed on your card does not change unless you request a new card. If your card is lost, stolen, or compromised, your issuer will send you a replacement card with a new security code. Entering the code during a purchase does not change it.
Can I make a purchase without entering the security code?
Most online and phone merchants will decline your transaction if you do not provide a security code. Some merchants may allow you to proceed without it, but this is rare. If a merchant refuses to process your payment without the code, that is normal security practice.