The security code is a three- or four-digit number printed on your card, separate from your account number
The security code (also called CVV, CVC, or card verification value) is a short number that proves you physically have the card in your hand. It is not encoded in the magnetic stripe or chip — it is printed on the surface only. This means someone who has stolen your account number alone cannot use it online or over the phone without this code.
The location and length depend on which card network issued your card. Visa, Mastercard, and Discover cards have a three-digit code on the back. American Express cards have a four-digit code on the front, above the account number. Some older or specialty cards may have codes in different locations, but these two layouts cover the vast majority of cards in use.
Key Takeaways
- Visa, Mastercard, and Discover security codes are three digits printed on the back of the card, usually to the right of the signature panel.
- American Express security codes are four digits printed on the front of the card, above and to the right of the account number.
- The security code is required for most online and phone purchases, but not for in-person transactions where the card is swiped or inserted.
- Never share your security code via email, text, or phone call — legitimate merchants only ask for it during checkout or payment processing.
- The security code changes only if you request a replacement card; it does not rotate or expire on its own.
How to locate the code on Visa, Mastercard, and Discover cards
Turn the card over so you are looking at the back. On the right side of the signature panel (the white or light-colored strip where you sign), you will see a series of numbers printed in a different style or color than the rest of the back. The last three digits of this sequence are your security code. This number is sometimes called the CVV2 (Visa), CVC2 (Mastercard), or CID (Discover), but the location and length are the same across all three networks.
The full sequence on the back may be longer — it could be the last four digits of your account number followed by the three-digit code, or other variations depending on the card issuer. The security code is always the rightmost three digits of whatever number appears in that area.
How to locate the code on American Express cards
American Express cards print the security code on the front, not the back. Look at the front of your card, above the account number (which runs across the middle). You will see four digits printed in a smaller font or slightly raised. This four-digit number is your Card Identification Number (CID). Because American Express is both the card network and the issuer, they use a different standard than Visa and Mastercard.
The four-digit code on an American Express card is always in the same location and is never part of the account number itself. If you see only three digits in that area, you may have an older or specialty American Express card, but four digits is the current standard.
When merchants ask for the security code
Online retailers ask for the security code during checkout, usually in a field labeled "CVV," "CVC," "security code," or "card verification number." This is a normal part of the payment process and does not indicate fraud. The merchant uses it to verify that you have the physical card and to reduce the risk of a stolen account number being used without authorization.
Phone orders also require the security code. When you call a merchant to place an order, they will ask you to read the code aloud. This is standard practice and is not a sign that the call is fraudulent — though you should always initiate the call yourself rather than responding to an unsolicited call claiming to be from a merchant.
In-person transactions at a store, gas pump, or ATM do not require the security code. When you insert or swipe your card, the merchant reads the chip or magnetic stripe, which does not contain the security code. This is one reason why the code is printed separately — it protects you in situations where your card information could be intercepted electronically.
What the security code does and does not protect
The security code protects you against card-not-present fraud — situations where someone has your account number but not your physical card. If a thief steals your account number from a data breach or a receipt, they cannot complete an online or phone purchase without also knowing the security code. Because the code is printed on the card itself and not stored in any database, it is much harder for a thief to obtain.
The security code does not protect you against in-person fraud if your physical card is stolen. A thief who has your card can use it at a store or gas pump without needing the code. It also does not protect you if someone gains access to your online account through a password breach — once they are logged in, they can change your payment methods or place orders without the code.
The code also does not prevent fraud if you give it to someone you should not trust. If a scammer calls you claiming to be from your bank and asks for the code, they can use it to make purchases. Legitimate banks and card issuers will never ask you to provide your security code over the phone or email.
Why you should never share the security code
Your security code should be treated like a password. Share it only with merchants during a transaction you initiated yourself — either by entering it on a website you navigated to directly, or by calling a merchant whose number you looked up independently. Do not type or read it aloud to anyone who contacts you, even if they claim to be from your bank, the card network, or a merchant.
Scammers often call or email claiming there is a problem with your account and asking you to "verify" your information by providing the security code. This is a common fraud tactic. Your bank and card issuer already have your account number and can verify your identity through other means — they will never ask for the security code itself.
If you have given your security code to someone you do not trust, contact your card issuer immediately. You can request a replacement card, which will have a new security code. The old code will no longer work once the new card arrives.
What happens if your card is lost or stolen
If your physical card is lost or stolen, the security code becomes less relevant because the thief has the card itself. Your priority should be to contact your card issuer and report the card missing. They will cancel the card and issue a replacement. The new card will have a different account number and a new security code.
Until the replacement arrives, your old card should not be used. If you need to make purchases, ask your issuer whether they can issue a temporary card number or virtual card number for online shopping. Many card issuers now offer this option through their mobile app or website.
If you notice fraudulent charges on your account, report them to your card issuer as soon as possible. You are not responsible for unauthorized charges, but you must report them within a specific timeframe — usually 60 days from when the charge appears on your statement. The sooner you report, the faster the investigation can begin.
How the security code differs from your account number and PIN
Your account number is the 15- or 16-digit number that identifies your card and appears on the front. It is encoded in the magnetic stripe and chip, so it is transmitted whenever you swipe or insert your card. The security code is printed only on the surface and is never transmitted electronically — you must provide it manually.
Your PIN (personal identification number) is a four-digit code you create and use at ATMs and some in-person transactions. It is not printed on your card and is known only to you. The PIN protects you against someone using a stolen card in person; the security code protects you against someone using a stolen account number online or over the phone.
All three pieces of information are separate and serve different purposes. Losing one does not compromise the others. If your account number is breached, your security code is still safe because it was never stored in the database that was hacked. If your PIN is compromised, your security code is still safe because they are unrelated.
Frequently Asked Questions
Does the security code change over time?
No. The security code stays the same for the life of your card. It changes only when you request a replacement card — either because your card was lost, stolen, or expired. A new card will have a new security code printed on it.
Can I find my security code online or in my account?
No. Your card issuer does not store the security code in their online banking system or app. This is intentional — it means that if someone hacks your online account, they cannot see the code. You must look at the physical card to find it. Some issuers may show a masked version (like the last digit only) for reference, but you will always need the card itself to see the full code.
What if I can't read the security code on my card?
If the code is worn, faded, or damaged, contact your card issuer and request a replacement card. They can issue a new card with a clearly printed security code. You do not need to wait for the replacement to arrive before making purchases — you can use your account number and the old code for most transactions, though some merchants may decline if the code appears invalid.
Is it safe to type the security code on a website?
Yes, as long as the website is legitimate and uses encryption. Look for "https://" at the beginning of the web address and a padlock icon in your browser. These indicate that the connection is encrypted and your information is protected in transit. Never enter your security code on a website that does not use encryption, or on a website you reached through a suspicious link.
What should I do if I see charges I don't recognize?
Contact your card issuer immediately and report the unauthorized charges. Provide the date, amount, and merchant name for each charge. Your issuer will investigate and typically remove the charge from your account while the investigation is underway. You are protected against unauthorized charges by federal law, so you will not be held responsible for fraud.