The security code is a three- or four-digit number printed on your card that proves you physically hold it when you make an online or phone purchase
The security code (also called CVV, CVC, or card verification value) sits on the back of most credit cards as a separate three-digit number. American Express prints a four-digit code on the front. This number is not stored in the card's magnetic stripe or chip — it exists only on the physical card itself. When you enter it during an online checkout or phone order, the merchant confirms you have the card in your hand, which reduces fraud.
The code serves as a fraud check because a thief who steals your card number from a data breach or receipt cannot use it without also having the physical card. Merchants are required to request it for card-not-present transactions (online, phone, mail order). In-person purchases at a store do not require it because the cashier can see your card.
You should never share your security code with anyone except the merchant you are actively paying. It should not appear in emails, texts, or over the phone unless you initiated the call to a number you know is legitimate.
Key Takeaways
- The security code is a three-digit number on the back of your card (or four digits on the front of American Express cards) that you enter during online and phone purchases.
- This code proves you physically possess the card and is not stored anywhere else on the card, so thieves cannot use a stolen card number without it.
- You should only enter your security code on secure checkout pages you trust or directly to merchants you called yourself.
- Your card issuer and legitimate merchants will never ask you to provide your security code via email, text, or unsolicited phone call.
Where the Security Code Appears on Your Card
On Visa, Mastercard, and Discover cards, the security code is printed on the back of the card, usually to the right of the signature strip. It is the last three digits of a longer number. On American Express cards, the four-digit code appears on the front, above the card number on the right side.
The code is printed in raised or flat text depending on the card design. It does not appear on receipts, statements, or anywhere else — only on the physical card itself. If you cannot see it clearly, hold the card under good light or contact your card issuer to confirm the number.
Why Merchants Ask for It During Online Purchases
When you shop online, the merchant cannot see your card or verify your identity in person. The security code is one of several checks they use to confirm you are the cardholder. Other checks include your billing address, ZIP code, and the card's expiration date, but the security code is the most direct proof that you hold the physical card.
Merchants are not supposed to store your security code after the transaction completes. Payment processors and card networks require them to delete it immediately. This means even if a merchant's database is breached, the thief cannot retrieve your security code because it was never saved.
How to Protect Your Security Code
Treat your security code the same way you treat your PIN at an ATM. Do not write it down or store it anywhere. Do not take a photo of it. Do not share it via email, text, or phone call, even if someone claims to be from your bank or the merchant.
Your card issuer will never call you and ask for your security code. Legitimate merchants will only ask for it during checkout on their secure website or when you call them directly. If someone contacts you asking for this number, it is a scam — hang up or delete the message and call your card issuer directly using the number on the back of your card.
When entering your security code online, make sure you are on a secure page. Look for "https://" at the start of the web address and a padlock icon in your browser. Never enter it on a page that does not show these signs of security.
What Happens If Your Card Is Compromised
If your card is lost, stolen, or you suspect fraud, contact your card issuer immediately. Most issuers have a fraud line on the back of your card or on your statement. They will cancel the card and issue a replacement with a new security code.
If someone has used your card number fraudulently, you are generally not liable for unauthorized charges under federal law. Your card issuer will investigate and typically remove the fraudulent charges from your account while they verify your claim. The process usually takes 30 to 90 days, though many issuers credit you temporarily while they investigate.
Once your card is replaced, the old security code becomes useless because it is tied to the old card number. This is why replacing the card is more effective than just changing your PIN or password.
Security Code Versus Other Card Numbers
Your card has several numbers, and each serves a different purpose. The 16-digit card number (15 digits on American Express) is the main account identifier. The expiration date tells you when the card expires. The security code is separate and proves you have the physical card.
Your PIN (personal identification number) is different from your security code. The PIN is what you enter at an ATM or when you choose "credit" at a store and are asked to enter a number. The security code is only for online and phone purchases. If someone has your card number and expiration date but not your security code, they cannot complete most online purchases.
Frequently Asked Questions
Can I use my card online without entering the security code?
Most legitimate merchants require it for online purchases. Some may skip it if you have made purchases with them before or if you are using a saved payment method, but this is less common. If a website does not ask for it, that is a sign the site may not be secure — proceed with caution.
What if I forgot my security code?
You cannot look it up online or over the phone — you must have the physical card in front of you to see it. If you have lost your card, contact your issuer to report it and request a replacement. If you simply cannot find your card at the moment, you can wait until you locate it or ask your issuer to mail a replacement.
Is the security code the same as my CVV?
Yes. CVV stands for "Card Verification Value." Different card networks use different names (Visa calls it CVV2, Mastercard calls it CVC), but they all refer to the same three- or four-digit code on your card. The terms are interchangeable.
Do I need to memorize my security code?
No. You only need it when you are making a purchase, and you should have your card with you at that time. Memorizing it is unnecessary and actually increases risk — if you write it down or tell someone, you have exposed it. Keep it on the card only.
What should I do if a website asks for my security code via email?
Do not send it. Legitimate merchants and banks never ask for your security code by email, text, or unsolicited phone call. This is a phishing scam. Delete the email, do not click any links, and report it to your card issuer or the Federal Trade Commission.