The security code is a three- or four-digit number printed on the back of your card, separate from your card number
The security code (also called CVV, CVC, or card verification value) is a short number that proves you physically have the card in your hand. It lives on the back of most credit cards, printed after the last four digits of your card number. American Express cards print it on the front, above the card number on the right side.
This code exists because online and phone transactions can't read your chip or magnetic stripe the way an in-person payment does. The merchant asks for it to confirm you're not just using a card number someone found or stole — you actually possess the physical card.
You should never write this number down, store it in your phone, or give it to anyone except during a payment you initiated yourself. If someone calls you asking for it, hang up. Legitimate companies never ask for your security code over the phone.
Key Takeaways
- The security code is a three-digit number on the back of your card (or four digits on the front of American Express cards), printed separately from your main card number.
- You only need to enter it for online purchases, phone orders, or mail orders — never for in-person payments or ATM withdrawals.
- The code changes nothing about your account and is not stored by merchants, so each transaction requires you to provide it fresh.
- If someone has your card number but not this code, they cannot complete most online purchases without it.
How to locate it on different card types
On Visa, Mastercard, and Discover cards, flip the card over and look at the back. You'll see your card number printed across the front, then below that on the back is a white or light-colored signature strip. To the right of that signature strip, you'll see three digits printed in a separate box or just printed directly on the card. That's your security code.
On American Express cards, the code sits on the front. Look above your card number on the right side — you'll see four digits printed there. This is the only major card type that uses four digits instead of three.
Some business cards or specialty cards may print the code in a slightly different location, but it will always be separate from your main card number and in a smaller font. If you can't find it, call the number on the back of your card and ask customer service where it's printed on your specific card.
When you actually need to enter it
You need the security code whenever you can't swipe, insert, or tap your physical card. This includes online shopping, phone orders, mail orders, and subscription services. The merchant's payment system will have a field labeled "CVV," "CVC," "security code," or "card verification code" — that's where you enter it.
You do not need it for in-person purchases at a store or restaurant, even if you're using an older card reader that only swipes. You don't need it for ATM withdrawals. You don't need it to check your balance or make a payment to your credit card company online (you'll use your card number and expiration date instead).
If a website or phone order asks for your security code and you're not making a purchase, stop and verify you're dealing with the real company. Scammers sometimes pose as customer service to get this information.
Why merchants ask for it and what they do with it
The security code is a fraud prevention tool. When you enter it, the merchant's payment processor sends it to your card issuer (your bank or credit card company) to verify that you have the card. The issuer checks that the code matches their records and either approves or declines the transaction in seconds.
Here's the important part: legitimate merchants do not store your security code. By law and by payment industry rules, they're not allowed to keep it on file after the transaction is complete. This means even if a merchant's database gets hacked, the thief won't find your security code there. Each time you make a purchase, you have to enter it fresh.
Some merchants will ask to save your card for future purchases. When you agree, they store your card number and expiration date — but not your security code. If you use that saved card later, you may or may not be asked for the code again, depending on the merchant's system and the amount of the purchase.
What to do if your security code changes or seems wrong
Your security code does not change unless you get a new card. If you requested a replacement card because yours was lost, stolen, or damaged, your new card will have a different security code printed on it. Destroy the old card and use only the code on the new one.
If you're looking at your card and the code doesn't match what you remember entering before, you may be looking at the wrong part of the card. Double-check that you're reading the three (or four) digits in the separate box on the back, not part of your main card number.
If a merchant tells you your security code is invalid when you're certain you entered it correctly, the issue is usually a typo on your part or a problem with their payment system. Try entering it again slowly, one digit at a time. If it still doesn't work, contact your card issuer to confirm your card is active and not flagged for fraud.
Security code versus other card numbers
Your card has several numbers, and it's worth knowing what each one does. Your card number (the long number across the front) identifies your specific account. Your expiration date tells the merchant when your card stops being valid. Your security code proves you have the physical card.
A thief who has your card number and expiration date can attempt online purchases, but most merchants will decline the transaction if the security code is missing or wrong. This is why the security code matters even though it seems like just another number to remember.
Your PIN (personal identification number) is different from all of these — it's a code you create and use at ATMs and sometimes at in-person debit card purchases. It's not printed on your card and should never be shared with anyone.
Protecting your security code from fraud
The best protection is simple: never enter your security code on a website or over the phone unless you initiated the contact and you're certain you're dealing with the real company. If someone calls you claiming to be from your bank or a store, asking for your security code, they are committing fraud. Hang up and call the official number on your card or statement instead.
When you're shopping online, make sure the website is secure before you enter any card information. Look for "https://" at the start of the web address (not just "http://") and a small padlock icon near the address bar. These indicate the site is encrypted. Avoid entering card information on public Wi-Fi networks, which are easier for thieves to intercept.
If your card is lost or stolen, contact your card issuer immediately. They'll cancel the card and send you a replacement with a new security code. You're not responsible for fraudulent charges made after you report the card missing, so speed matters.
Frequently Asked Questions
Can someone use my card number without the security code?
They can attempt to, but most online merchants will decline the transaction if the security code is missing or incorrect. In-person fraud requires the physical card, so the security code doesn't protect against that. However, a thief with your card number and expiration date can still cause problems, so report a lost or stolen card immediately.
Is it safe to give my security code over the phone?
Only if you called the merchant or your card issuer first using a number you know is legitimate — from your statement, the back of your card, or their official website. Never give it to someone who called you, even if they claim to be from your bank. Real companies never ask for it unsolicited.
What if I enter my security code wrong?
The transaction will be declined. Try again, entering it slowly and carefully. If it keeps failing, contact your card issuer to make sure your card is active and not flagged for fraud. Don't attempt the same purchase more than a few times in a row, as multiple failed attempts can trigger a fraud alert.
Do I need my security code to make a payment to my credit card company?
No. When you log into your card issuer's website or app to make a payment, you'll use your card number and expiration date, but not your security code. The security code is only for purchases from merchants, not for managing your account.
Why does my American Express card have four digits instead of three?
American Express uses a four-digit code for additional security. It works the same way as the three-digit code on other cards — you enter it during online or phone purchases to verify you have the card. The extra digit doesn't make it stronger; it's just how American Express designed their system.