The security code is a number printed on your card that proves you physically have it when you shop online or over the phone

The security code — also called a CVV, CVC, or card verification value — is a 3 or 4-digit number printed on your credit card. It lives in a specific spot: on the back of Visa and Mastercard, usually in the signature strip; on the front of American Express, above the card number on the right side. Amex codes are 4 digits; most other cards use 3.

The code exists because online and phone transactions can't read your chip or magnetic stripe the way a store terminal can. When you type your card number into a website or give it to a customer service agent, the merchant has no way to know you're the actual cardholder — you could be reading a stolen number off a receipt. The security code is your proof that you're holding the physical card right now.

This is why merchants ask for it during online checkout and phone orders, and why you should never give it to anyone who calls you claiming to be from your bank. Your bank already has your card on file and never needs to ask for the code.

Key Takeaways

  • The security code is a 3 or 4-digit number that proves you have the physical card when shopping online or by phone.
  • Visa and Mastercard print the code on the back in the signature strip; American Express prints it on the front above the card number.
  • Merchants use the code to verify the transaction, but it is not the same as your PIN and does not protect you from fraud if your card number is stolen.
  • Never give your security code to someone who calls you, even if they claim to represent your bank or card issuer.
  • The code changes only if you get a replacement card; it is not a temporary number that rotates.

Where to find your security code on different card types

The location matters because merchants need to know where to look, and you need to know you're giving them the right number.

Visa and Mastercard: Turn the card over and look at the back. In or just above the signature strip (the white or gray area where you sign), you'll see a 3-digit number. That's your CVV. It's printed, not embossed, so you can feel the difference between it and the raised card number on the front.

American Express: Flip the card to the front. Above the card number on the right side, you'll see a 4-digit code. This is the CID (Card Identification Number). Amex uses 4 digits instead of 3 because the code is printed on the front where it's more visible to thieves, so the extra digit adds security.

Discover: Like Visa and Mastercard, the 3-digit code is on the back in the signature strip.

Why merchants ask for it, and what it actually protects

When you enter your card number, expiration date, and security code into a website checkout, the merchant's system sends that information to the card network (Visa, Mastercard, etc.) to verify the transaction. The security code is the merchant's way of confirming that you have the card in your hands right now — not just that you know the number.

This protects merchants more than it protects you. If someone steals your card number from a data breach or a receipt, they can't complete an online purchase without the security code. The merchant won't process the transaction if the code doesn't match. But if a thief has your card in their hands, they have the code too, so it won't stop them from using the physical card in a store.

The security code is also not the same as your PIN. Your PIN is a number you create and memorize to withdraw cash or check your balance at an ATM. Your security code is printed on the card and you don't memorize it — you read it off when you need it. They serve different purposes and protect different types of transactions.

What happens if your security code is compromised

If your security code is exposed in a data breach or you accidentally share it with someone, contact your card issuer right away and ask for a replacement card. The issuer will mail you a new card with a new security code printed on it. You'll get a new card number too, which is the more important part — the security code alone is less useful to a thief without the full card number.

If you notice fraudulent charges on your statement, report them to your card issuer. You're not responsible for unauthorized charges under federal law, and the issuer will investigate and reverse them. The process usually takes 10 business days, though some issuers move faster. While the investigation is open, you'll typically get a temporary credit so you're not out the money.

Never give your security code to someone who calls you, texts you, or emails you claiming to be from your bank or card issuer. Your bank already has your card information on file and will never ask you to provide the security code over the phone or through email. If someone asks for it, hang up or delete the message and call your card issuer directly using the number on your statement.

When you do and don't need to provide the security code

You should provide it: Online checkout (websites and apps), phone orders with a merchant, mail orders where you're filling out a form yourself. In these situations, the merchant can't read your chip or swipe your card, so they need the code to verify you have it.

You should not provide it: In a physical store when you're swiping or inserting your card — the terminal reads the chip or magnetic stripe instead. At an ATM — you use your PIN instead. To anyone who calls you, even if they say they're from your bank. In an email or text message. On a website that doesn't look secure (check for "https://" and a padlock icon in the address bar).

If a website asks for your security code but you're not entering it yourself — for example, if you're reading it to a customer service agent over the phone — read it slowly and ask them to repeat it back to you to confirm they have it right. This catches mistakes and gives you a record that you provided the correct number.

The security code doesn't change unless you get a new card

Your security code is static. It's printed on your card when it's made and stays the same until you get a replacement card. It doesn't rotate, refresh, or change on a schedule like some other security features do.

If your card is lost, stolen, or damaged, you'll get a replacement card with a new security code. If your card expires, the new card your issuer sends will have a different security code even though the card number might stay the same (some issuers keep the number, others issue a new one). If you request a replacement card for any reason, assume the security code will be different and update any stored payment methods before the new card arrives.

Frequently Asked Questions

Is the security code the same as my PIN?

No. Your PIN is a number you create and memorize to use at ATMs and in-store terminals. Your security code is printed on the card and used for online and phone purchases. They protect different types of transactions and are not interchangeable.

Can someone use my card if they only have the security code?

Not easily. They would need your full card number and expiration date too. The security code alone is not enough to complete an online transaction. However, if they have all three pieces of information, they can shop online without having the physical card.

What should I do if I accidentally shared my security code?

Contact your card issuer and ask for a replacement card. The issuer will mail you a new card with a new security code and may issue you a new card number as well. Monitor your statement for unauthorized charges and report any you find.

Why does American Express use 4 digits instead of 3?

Amex prints the code on the front of the card where it's more visible, so the extra digit adds an additional layer of security. Visa and Mastercard print theirs on the back where it's less exposed, so 3 digits is considered sufficient.

Do I need to memorize my security code?

No. You only need to read it off the card when you're making an online or phone purchase. Never memorize it or write it down, and don't store it in your phone or computer. The point of the code is that it's tied to the physical card, so keeping it separate from your card number adds security.