The security code is a three- or four-digit number printed on your card that proves you physically have it

The security code (also called CVV, CVC, or card verification value) is a short number that lives on your card itself, separate from your account number. When you buy something online or over the phone, the merchant asks for this code to confirm you're the person holding the card — not someone who stole your number from a receipt or a data breach.

It's a small but real layer of protection. A thief with just your card number and expiration date can't complete most online purchases without this code. That's why you're asked for it so often, and why you should never share it by email, text, or phone unless you initiated the transaction.

Key Takeaways

  • The security code is a three-digit number on the back of most cards, or a four-digit number on the front of American Express cards.
  • This code is printed on the card itself and is not stored in the magnetic stripe or chip, so it proves you physically possess the card.
  • You'll need the security code for online and phone purchases, but legitimate merchants never ask for it by email or unsolicited phone call.
  • The code changes only if you get a replacement card; it does not reset or expire on its own.

Where to find the security code on your card

For Visa, Mastercard, and Discover cards, the security code is a three-digit number printed on the back, usually to the right of the signature strip. Look for a small group of numbers — it's the last three digits of a longer number that appears there.

American Express is different. The code is a four-digit number printed on the front, above and to the right of your account number. It's smaller than the main card number and stands alone.

If your card is new or you've never looked for it before, the back is the first place to check for most cards. The number is always printed, never embossed or raised like your main account number.

Why merchants ask for it during online and phone purchases

When you swipe or insert your card in person, the merchant's machine reads the chip or magnetic stripe, which contains encrypted information that proves the card is real. Online and phone transactions don't have that option — the merchant only has the numbers you type or say aloud.

The security code fills that gap. Because it's printed on the card and not stored anywhere else, asking for it proves you have the physical card in your hand. A scammer with your number from a leaked database won't have this code unless they also have the card itself.

This is also why the code is never stored by the merchant after the transaction. Payment processors are required by law to delete it immediately after verifying the purchase. If a merchant's database is hacked later, the security code won't be there to steal.

What to do if someone asks for your security code by email or unsolicited call

Do not give it to them. Legitimate companies — your bank, your credit card issuer, a store you shop at — will never ask for your security code by email, text message, or an unsolicited phone call. If they need to verify your card, they already have it on file and don't need you to recite it.

If you receive such a request, it's a scam. Hang up or delete the message, and call your card issuer directly using the number on the back of your card to report it. Do not use a phone number from the suspicious email or call — always initiate contact yourself.

The only time you should volunteer your security code is when you are the one making a purchase online or over the phone, and you've chosen to contact the merchant.

How the security code differs from your PIN

Your PIN (personal identification number) is a four-digit code you create and memorize. You use it at ATMs and when you tap or insert your card at a store. Only you should know it, and you should never write it down or share it.

Your security code is printed on the card by the issuer and is visible to anyone holding the card. It's not a secret you create — it's a verification tool. You do need to keep it private, but it's not the same kind of secret as a PIN.

A PIN protects you at physical locations. A security code protects you during remote purchases. Both matter, but they work in different situations and are kept private for different reasons.

What happens if your card is lost or stolen

If your card goes missing, contact your card issuer immediately using the number on your statement or their website. The issuer will cancel the card and send you a replacement. The new card will have a different security code printed on it.

Until the replacement arrives, you can still make online purchases if you have the old card number and expiration date memorized, but most merchants will decline the transaction because the card is flagged as lost or stolen in the system. This is the protection working as intended.

You do not need to change your PIN or security code yourself — the issuer handles this when they issue the new card. The old security code becomes useless the moment the card is reported lost.

Security code scams and how to avoid them

The most common scam is a fake email or call claiming to be from your bank, asking you to "verify" your card by providing the security code. These messages often sound urgent and may reference a suspicious charge or account problem to pressure you into responding quickly.

Real banks never ask for your security code this way. If you're worried about fraud on your account, hang up and call the number on the back of your card directly. The bank can see your transaction history without you reciting anything.

Another scam involves a fake online store that looks legitimate but is designed to steal your card information. The best defense is to shop only at websites you recognize, look for "https://" and a padlock icon in the address bar, and use a credit card rather than a debit card when possible — credit cards offer stronger fraud protection.

Frequently Asked Questions

Can I use my card online without the security code?

Most online stores require it, but some do not — particularly if you have an account with them and your card is already saved. However, if a merchant does not ask for the security code, that's a sign the transaction may not be secure. Reputable merchants ask for it as a standard safety measure.

Does the security code change when my card expires?

No. The security code on your current card stays the same for the life of that card. When your card expires and you receive a replacement, the new card will have a different security code printed on it. You do not need to do anything — the issuer assigns it automatically.

What if I can't find the security code on my card?

Check the back of the card first, to the right of the signature strip. If the number is worn or faded, call your card issuer and they can read it to you over the phone. Never share it via email or text, even with your issuer — they already have it on file.

Is it safe to save my security code in my phone or computer?

No. If your phone or computer is hacked or stolen, the thief gains access to your security code along with everything else. It's safer to type it in each time you make a purchase, even though it takes a few extra seconds.

Do I need the security code to use my card at a store or ATM?

No. You only need the security code for online and phone purchases. At a physical store, you insert or tap your card, and the machine reads the chip. At an ATM, you use your PIN. The security code is not involved in either transaction.