The security code is a three- or four-digit number printed on your card, separate from your card number, that proves you physically hold the card when you make an online or phone purchase.
On most cards, this code appears on the back, in the signature strip area. On American Express cards, it appears on the front, above the card number on the right side. The code has different names depending on the card brand — Visa and Mastercard call it the CVV (Card Verification Value) or CVC (Card Verification Code), while American Express calls it the CID (Card Identification Number) — but they all serve the same purpose.
The security code is not stored in the card's magnetic stripe or chip, which is why merchants cannot retrieve it from a card reader. This design means that someone who steals your card number alone cannot complete an online purchase without also knowing this separate number. It is one of the few pieces of card information you should never save in your browser or give to anyone except the merchant you are paying right then.
Key Takeaways
- The security code is a three- or four-digit number printed on your card: three digits on the back for Visa and Mastercard, four digits on the front for American Express.
- The code is not encoded in your card's magnetic stripe or chip, so a thief who steals your card number cannot use it online without this separate number.
- You should only enter your security code directly into a merchant's website or phone line, never into a text message, email, or link sent to you.
- If someone asks for your security code by phone or email, that is a fraud attempt — legitimate merchants never request it that way.
Why the Security Code Location Matters
The fact that the security code is printed on the card, not encoded in it, is deliberate. When you swipe or insert your card in person at a store, the merchant reads your card number and expiration date from the magnetic stripe or chip. They do not need the security code because they have verified you are holding the physical card. Online and phone purchases are different — the merchant never sees the card — so they ask for the security code as proof that you have it in your hand right now.
This separation also protects you if your card number is compromised in a data breach. Retailers are required to store card numbers for record-keeping, but they are not supposed to store security codes. If a hacker steals a retailer's database, they get card numbers and expiration dates but not the security codes. That makes the stolen numbers much harder to use for online fraud.
How to Locate Your Security Code by Card Brand
| Card Brand | Location | Number of Digits |
|---|---|---|
| Visa | Back of card, in or near the signature strip | 3 digits |
| Mastercard | Back of card, in or near the signature strip | 3 digits |
| Discover | Back of card, in or near the signature strip | 3 digits |
| American Express | Front of card, above the card number on the right | 4 digits |
On Visa, Mastercard, and Discover cards, the three-digit code sits on the back. It is usually the last three digits of a longer number printed there, or it stands alone. On American Express, the four-digit code is on the front, positioned above and to the right of your card number. The American Express code is sometimes called the CID or CVV2, depending on the context, but it works the same way as the three-digit codes on other brands.
If your card is very old or worn, the printed numbers may be hard to read. You can contact your card issuer — the bank or credit union that issued the card — and they can tell you the code over the phone after they verify your identity. Do not rely on a phone number from a text message or email; instead, call the number on the back of your card or on your statement.
When You Should and Should Not Share Your Security Code
You should enter your security code only when you are typing directly into a merchant's website checkout page or speaking directly to a merchant's customer service representative on a phone call you initiated. The code is meant to prove you have the card in your hand at that moment. Once you have completed the transaction, you should not need to provide it again for that same purchase.
You should never share your security code in response to an unsolicited email, text message, or phone call, even if the message appears to come from your bank or a merchant you recognize. Legitimate banks and merchants will never ask for your security code by email or text. If you receive such a request, it is a fraud attempt. Do not respond, and report the message to your card issuer.
You should also never save your security code in your browser's autofill feature, write it down and store it with your card, or give it to anyone else — including family members or customer service representatives — unless you are actively making a purchase with them right then. The code is a one-time proof of possession, not a permanent credential like your PIN.
What to Do If Your Security Code Has Been Compromised
If you believe someone has obtained your security code — for example, if you entered it on a website that turned out to be fraudulent, or if you see unauthorized charges on your card — contact your card issuer immediately. You can find the number on the back of your card or on your monthly statement. Tell them what happened and ask them to review your account for fraud.
Your card issuer can cancel your current card and issue you a new one with a new security code. The new code will be different from the old one, which means anyone who has the old code cannot use it. This process usually takes five to ten business days. In the meantime, your issuer may issue you a temporary card number or allow you to make purchases using your account number and a one-time code sent to your phone.
You are not responsible for fraudulent charges made with your card, as long as you report them within 60 days of the statement date on which they appear. Federal law limits your liability to $50, and most card issuers waive even that amount. The sooner you report the fraud, the faster your issuer can investigate and reverse the charges.
Security Code Scams and How to Spot Them
Scammers often pose as bank representatives or customer service agents and call or text asking for your security code. They may claim there is suspicious activity on your account, that you need to verify your identity, or that there is a problem with your payment. None of these are legitimate reasons for a bank or merchant to ask for your security code.
Another common scam involves a fake website that looks like a real retailer or bank. You enter your card information, including the security code, and the scammer captures it. To protect yourself, always check the website address before entering any card information. The address should start with "https://" (not "http://") and should match the official website of the company you are paying. If you are unsure, close the browser, go to the company's official website directly, and contact their customer service to ask if the page you saw was legitimate.
A third scam involves a text message or email that appears to come from your bank, asking you to click a link and verify your card details. These messages are called phishing attempts. Do not click the link. Instead, call the number on the back of your card to contact your bank directly.
Frequently Asked Questions
Can I use my credit card online without a security code?
Most online merchants require a security code for every purchase. Some older or less secure websites may not ask for it, but that is a sign the site may not be protecting your information well. If a major retailer does not ask for a security code, it may be a fake website. Always provide the code when asked — it is a sign the merchant is following security standards.
What if I can't read the security code on my card?
Call your card issuer using the number on the back of your card. After verifying your identity, they can read the code to you over the phone. Do not rely on a phone number from an email or text message, as those may be from scammers.
Is the security code the same as my PIN?
No. Your PIN is a four-digit number you create and use at ATMs and in-store card readers. Your security code is a three- or four-digit number printed on your card that you use for online and phone purchases. They are separate and serve different purposes. Never share your PIN with anyone.
Do I need to memorize my security code?
You do not need to memorize it, but you should not save it in your browser or write it down. Keep it as secure as your physical card. If you need it, you can look at your card or call your issuer.
What happens if I enter the wrong security code?
The transaction will be declined. You can try again with the correct code. If you enter an incorrect code multiple times, some merchants may temporarily block your card for security reasons. Check the code on your card and try once more, or contact your card issuer if you are unsure what the correct code is.