The verification code is a three or four-digit number printed on your card, separate from your account number
Your credit card verification code — also called a CVV, CVC, or security code — is printed on the physical card itself, not embedded in the magnetic stripe or chip. The location and length depend on which card network issued it.
For Visa, Mastercard, and Discover cards, the code is a three-digit number printed on the back of the card, to the right of the signature panel. For American Express cards, it is a four-digit number printed on the front, above the account number on the right side. This code is never stored in the card's magnetic stripe or chip, which is why merchants cannot read it from a swipe or tap — you must read it aloud or type it in manually.
The verification code serves one purpose: to confirm that you physically possess the card when you make a purchase online or over the phone. A merchant who has only your account number and expiration date cannot complete a transaction without this code, because they cannot obtain it from the card's electronic data alone.
Key Takeaways
- Visa, Mastercard, and Discover cards display a three-digit code on the back, to the right of the signature strip.
- American Express cards display a four-digit code on the front, above the account number on the right side.
- The verification code is printed only on the card itself and is never stored in the chip or magnetic stripe.
- Merchants use the code to confirm you have the physical card when you pay online or by phone.
- You should never share your verification code with anyone except the merchant you are paying directly.
Why the code is in different places on different cards
Card networks designed their verification codes at different times and made different choices about where to print them. Visa, Mastercard, and Discover all chose the back of the card, which keeps the code out of sight during everyday transactions and reduces the chance a bystander will see it. American Express placed theirs on the front because the company wanted the code visible during the cardholder verification process, which was more common in American Express's early card-present transactions.
The location matters when you are reading the code to someone over the phone or typing it into a website. If you are unsure where to look, check the back first — that is where the code sits on the majority of cards in circulation.
What the code does and does not protect
The verification code protects you against one specific risk: a thief who has stolen your account number and expiration date but does not have the physical card. Without the code, they cannot complete an online or phone purchase. This is why the code is required for card-not-present transactions — situations where the merchant cannot see or swipe the card in person.
The code does not protect you against a thief who has the card itself. If someone steals your physical card, they have the code and can use it immediately. The code also does not protect you against a data breach at a merchant's website or a compromised payment processor. If a hacker breaks into a retailer's system and steals thousands of card records, they may obtain the verification code along with the account number and expiration date.
For this reason, you should never type or speak your verification code to anyone who contacts you first — not by phone, email, or text. Your bank and card issuer will never ask for it. If someone claims to represent your bank and requests the code, hang up or delete the message and call your bank directly using the number on the back of your card.
When you need to provide the code
You provide the verification code whenever you make a purchase without showing the physical card to the merchant. This includes online shopping, phone orders, and mail orders. The merchant's payment form will have a field labeled CVV, CVC, security code, or card verification code — the exact label varies, but the field is always asking for the same three or four digits.
You do not need to provide the code when you swipe or insert your card in person at a store, gas station, or restaurant. The merchant can read the code from the card itself during those transactions, so they do not ask you to type it. If a merchant asks for the code during a card-present transaction, that is unusual and you should ask why before providing it.
How to read the code if it is worn or faded
If the numbers on your card have worn away or faded and you cannot read the verification code, contact your card issuer's customer service line. The number is on the back of your card or on your monthly statement. Tell them you need to confirm your verification code for an online purchase.
Your issuer will verify your identity — usually by asking for your account number, date of birth, and the last four digits of your Social Security number — and then read the code to you over the phone. They will not ask you to provide the code; they will provide it to you. This is a legitimate reason to call, and it takes only a few minutes.
Do not attempt to guess or estimate the code if you cannot read it clearly. An incorrect code will be declined, and multiple declined attempts may trigger a fraud alert on your account. It is faster and easier to call your issuer.
What happens if you enter the wrong code
If you type an incorrect verification code into a payment form, the transaction will be declined immediately. The merchant's system checks the code against the card network's records before sending the charge to your bank, so the decline happens in seconds.
A single incorrect entry does not harm your account. However, if you enter the wrong code multiple times in a short period — usually three or more attempts within a few minutes — your card issuer may temporarily lock the card as a fraud prevention measure. When this happens, you will need to call your issuer to unlock it before you can use the card again.
If you are having trouble reading the code, stop trying and call your issuer instead. It is much faster than entering it wrong repeatedly and triggering a lock.
Protecting your verification code from theft
The verification code is printed on your card, so anyone who sees the card can see the code. Protect it the same way you protect the card itself: do not leave the card unattended, do not photograph it or write the number down, and do not share a photo of your card with anyone.
When you provide the code online, make sure you are on a secure website. Look for the padlock icon in your browser's address bar and confirm that the web address begins with "https://" rather than "http://". These signs indicate the website is using encryption to protect the information you type.
If you are paying a merchant you have never used before, verify that the website is legitimate before entering any card information. Check the company's phone number or physical address on their website and call to confirm they are real. Scam websites often look nearly identical to legitimate ones, and the verification code is one of the few pieces of information a thief needs to make a fraudulent purchase.
Frequently Asked Questions
Can someone use my card number without the verification code?
Not for online or phone purchases — those require the code. However, if someone has your card number and expiration date, they can attempt in-person purchases at merchants who do not check the code or use older payment systems. They can also use the number for fraudulent transactions at merchants who do not require the code, though this is becoming less common as security standards improve.
Is the verification code the same as my PIN?
No. Your PIN is a four-digit number you create and use at ATMs and some in-person transactions. Your verification code is printed on the card and used for online and phone purchases. They are separate security measures protecting different types of transactions.
What if I see charges I did not make?
Contact your card issuer immediately using the number on the back of your card or on your statement. Report the unauthorized charges and request a dispute. Your issuer will investigate and typically issue a temporary credit while the dispute is pending. You are not responsible for fraudulent charges, but you must report them within the timeframe stated in your cardholder agreement — usually 60 days from the statement date.
Do I need to memorize my verification code?
No. You only need to read it from the card when you make a purchase. Do not memorize it or write it down. If you need it and cannot read the card, call your issuer.
Will my issuer ever ask me for the verification code?
No. Your bank and card issuer will never ask you to provide the verification code, either by phone, email, or text. If someone claiming to represent your issuer asks for it, that is a scam. Hang up or delete the message and call your issuer directly using the number on your card.