Your security code is a three- or four-digit number printed on your card itself, separate from your card number
The security code (also called a CVV, CVC, or card verification value) is a short number that proves you physically have the card in your hand. It is not encoded in the card's magnetic stripe or chip — it is printed on the surface only. This is why someone who steals your card number online cannot use it without also knowing this code.
The code lives in a different place depending on which type of card you have. For Visa, Mastercard, and Discover cards, it is a three-digit number printed on the back of the card, to the right of the signature strip. For American Express, it is a four-digit number printed on the front of the card, above the card number on the right side. You need this code whenever you make a purchase online or over the phone — anywhere the merchant cannot physically swipe or insert your card. In person at a store, you do not need to provide it because the cashier can see the card is real.
Key Takeaways
- The security code is a three- or four-digit number printed directly on your card, separate from your card number.
- Visa, Mastercard, and Discover cards have the code on the back; American Express has it on the front.
- You only need to enter the security code for online and phone purchases, not for in-person transactions.
- Never share your security code with anyone except the merchant you are paying, and never write it down or save it in your phone.
Why merchants ask for the security code
A merchant asks for your security code to reduce fraud. If someone has only your card number (from a data breach or a stolen receipt), they cannot complete an online purchase without this code. The code proves you have the physical card.
The merchant does not store your security code after the transaction. Payment processors are required by law to delete it immediately. This means even if a merchant's database is hacked, the thief cannot use the stolen card numbers alone — they would need the code too, which was never saved.
Where exactly to find it on your card
The location of your security code depends on your card brand. Visa, Mastercard, and Discover cards all have a three-digit code on the back of the card, positioned to the right of the signature strip. American Express is the exception — their cards display a four-digit code on the front, above the card number on the right side.
If you cannot find the code on your card, contact your card issuer directly. They can read it to you over the phone. Never give your full card number to verify your identity — the issuer already has that. They will ask for your name, address, and the last four digits of your card instead.
How to protect your security code
Treat your security code like you treat your PIN. Never write it down, never text it to anyone, and never save it in your phone or email. The only time you should type it is directly into a payment form on a secure website or tell it to a merchant you called yourself.
If someone calls you claiming to be from your bank or card company and asks for your security code, hang up. Your bank will never ask for it. If you are worried the call was real, hang up and call the number on the back of your card instead. Do not take photos of your card that show the security code, and do not leave receipts lying around — they sometimes print the last four digits of your card number, which combined with a visible code could be enough for fraud.
What to do if you think your security code was compromised
If you believe someone has your card number and security code, call your card issuer right away. The number is on the back of your card. They can cancel the card and issue a new one, usually within five to seven business days. You are not responsible for fraudulent charges if you report them promptly. Federal law limits your liability to $50 if someone uses your card without permission, and most card issuers waive that $50 entirely.
After you report fraud, monitor your account regularly for the next few months. Set up account alerts through your card issuer's app or website so you are notified of every transaction. This makes it easier to spot any unauthorized activity early. The sooner you report suspected fraud, the faster the investigation moves.
Security codes for different payment situations
When you shop online, you enter the security code into the payment form on the website. The merchant's system checks it against your bank's records in real time. If it matches, the transaction goes through. If it does not, the purchase is declined.
When you give your card information over the phone, read the security code out loud to the merchant. Do not spell out the numbers — just say them clearly. Hang up immediately after the transaction is complete. If you are setting up a recurring payment (like a subscription or monthly bill), you will enter the security code once during setup. The merchant stores your card number but not the code, so they cannot charge you more than you authorized.
Frequently Asked Questions
Can someone use my card number without the security code?
Not for online or phone purchases — the merchant will decline the transaction if the code does not match. In person, a thief with only your card number cannot complete a purchase because they do not have the physical card. However, they could attempt mail or phone fraud, which is why you should report a stolen card number immediately.
Is my security code the same as my PIN?
No. Your PIN is a number you create and use at ATMs and in-store chip readers. Your security code is printed on the card by the issuer and is used only for online and phone purchases. They serve different purposes and are not interchangeable.
What if I lost my card and need to make an online purchase?
Call your card issuer and ask if they can provide a temporary card number for online shopping while you wait for your replacement card. Many issuers offer this service. Alternatively, you can use a digital wallet like Apple Pay or Google Pay if you set it up before losing the card.
Do I need to memorize my security code?
No. Keep your card in a safe place and look at it when you need the code. Memorizing it increases the risk that you will accidentally say it out loud or type it somewhere unsafe. The only exception is if you use the same card very frequently and want the convenience — but never write it down.
Why is American Express's code on the front instead of the back?
American Express designed their cards this way as an additional security feature. The front placement makes it slightly less visible in casual photos or over someone's shoulder. The four-digit code also provides more combinations than a three-digit code, making it harder to guess.