The security code is a three- or four-digit number printed on your card, separate from your account number
The security code — also called the CVV, CVC, or card verification value — is not embossed into your card like your account number. It is printed on the surface, and its location depends on which side of the card you look at.
For Visa, Mastercard, and Discover cards, the code is a three-digit number on the back of the card, printed to the right of the signature strip. For American Express, it is a four-digit number on the front of the card, printed above and to the right of your account number.
The code serves one purpose: to verify that you physically have the card in your hand when you make an online or phone purchase. A merchant who has only your account number and expiration date cannot process the transaction without it.
Key Takeaways
- Visa, Mastercard, and Discover cards have a three-digit code on the back, to the right of the signature strip.
- American Express cards have a four-digit code on the front, above the account number.
- The code is printed, not embossed, so it can wear off or become hard to read over time.
- Never share your security code with anyone except the merchant you are paying, and never enter it on a website you do not trust.
- The code is not stored in the card's magnetic stripe or chip, so thieves who steal your card number alone cannot use it online.
Why merchants ask for the security code
When you swipe or insert your card in person, the merchant reads your account number and expiration date from the magnetic stripe or chip. They do not need the security code because they can verify the card is real by processing it through their terminal.
When you shop online or by phone, the merchant cannot read the stripe or chip. They have only the information you type or say: your account number, expiration date, and name. The security code is the only piece of information that proves you have the physical card. Without it, anyone who found your account number could make purchases.
Merchants are required by card networks to request the code for online and phone transactions. Some merchants store it temporarily to process the transaction, but they are not allowed to keep it on file for future purchases. If a merchant asks you to save your security code for next time, that is a sign the merchant is not following the rules.
What happens if your security code is worn or missing
The security code is printed on the surface of the card, not embedded in it like your account number. Over time, especially if you carry the card in a wallet with other cards or in a pocket, the printing can fade or wear away.
If you cannot read your code, contact your card issuer — the bank or company that issued the card. They can read the code from their records and tell you what it is. You can also request a replacement card, which will have a new code printed on it. There is usually no charge for a replacement card.
Do not try to guess the code or ask the merchant to process the transaction without it. If the code does not match what the card issuer has on file, the transaction will be declined.
How to protect your security code
Your security code is not secret in the same way your PIN is. It is printed on your card for a reason — you are supposed to use it. But you should still treat it as sensitive information.
Never type your security code into a website unless you initiated the transaction and you trust the site. Never read it aloud to someone who called you, even if they claim to be from your bank or the merchant. Your bank will never call you and ask for your security code.
If you are shopping on a public computer or a phone that is not yours, do not enter your security code. Use your own device, or wait until you can. If a website does not have a secure connection — you will see a padlock icon in the address bar — do not enter your code there.
If your card is lost or stolen, contact your card issuer right away. They will cancel the card and issue a replacement. The old security code becomes useless because the card is no longer active.
Security code versus other card numbers
Your card has several numbers on it, and they serve different purposes. Your account number is the 15- or 16-digit number that identifies your account. Your expiration date is when the card stops working. Your security code is the three- or four-digit number that proves you have the card.
A thief who has your account number and expiration date can make phone purchases or try to use the card online, but they will be stopped at checkout if the merchant asks for the security code. A thief who has your account number, expiration date, and security code can make online and phone purchases, but they still cannot use the card in a store because they do not have the physical card.
Your card issuer can see all of these numbers in their system, but they do not store your security code the way they store your account number. This is intentional — it limits the damage if a merchant's database is hacked.
What to do if someone asks for your security code in person
If a cashier, gas station attendant, or anyone else asks you to read your security code aloud or show them the back of your card, do not do it. Legitimate in-person transactions do not require the security code. The merchant's terminal reads the information from the stripe or chip.
If a merchant insists on the code for an in-person purchase, you can refuse and use a different payment method. If you are at a gas pump and the screen asks for your security code, that is unusual — most pumps do not ask for it. If it does, you can go inside and pay the attendant instead.
Scammers sometimes pose as merchants or bank employees and ask for your security code over the phone or in text messages. Legitimate companies will never do this. If someone calls or texts asking for your code, hang up or delete the message and contact your card issuer directly using the number on the back of your card.
Frequently Asked Questions
Can I use my card online without a security code?
Most online merchants require it, but some do not. If a website does not ask for your security code, that does not mean it is unsafe — it means the merchant has chosen not to request it. You can still use your card. However, if a website asks for your code and you cannot provide it, the transaction will be declined.
Is the security code the same as my PIN?
No. Your PIN is a number you create and memorize to withdraw cash or check your balance at an ATM. Your security code is printed on your card and is used only for online and phone purchases. They are separate and serve different purposes.
What if I enter the wrong security code?
The transaction will be declined. You can try again with the correct code. If you enter an incorrect code multiple times, some merchants may temporarily block your card to prevent fraud. Contact your card issuer if this happens.
Do I need to memorize my security code?
No. You only need to read it from your card when you make an online or phone purchase. Do not write it down or save it in your phone. If you need it, look at your card.
Can a merchant store my security code for future purchases?
No. Card networks prohibit merchants from storing your security code. If a merchant asks you to save it for next time, that is against the rules and a sign you should shop elsewhere. Legitimate merchants use tokenization instead — they store a temporary code that works only for your account with them.