The security code is on the back of your card, in the signature strip

The security code — also called the CVV, CVC, or card verification value — is a three- or four-digit number printed on your physical card. On Visa, Mastercard, and Discover cards, it sits on the back in the white signature strip, usually to the right of your account number. On American Express cards, it's a four-digit code on the front, above your account number on the right side.

This code is not encoded in the magnetic stripe or chip like your account number is. It's printed only on the card itself, which means online merchants and phone sellers can verify you actually have the physical card in your hand — they can't get it from a data breach of their own systems. That's why they ask for it when you can't swipe or insert the card in person.

The code serves one purpose: to reduce fraud on card-not-present transactions. When you type it in during an online purchase or give it over the phone, the merchant sends it to your card issuer to confirm it matches what's on file. If it doesn't match, the transaction gets declined.

Key Takeaways

  • Visa, Mastercard, and Discover cards have a three-digit security code on the back in the signature strip; American Express has a four-digit code on the front.
  • The security code is printed only on the card itself and is not stored in the chip or magnetic stripe, so merchants cannot obtain it from a data breach.
  • You should never share your security code with anyone except the merchant you are paying, and legitimate companies will never ask for it via email or phone.
  • The security code changes only when you receive a replacement card; it does not reset or update on its own.

Why merchants ask for it during online and phone purchases

When you use your card in person at a store, the cashier can see your face and verify your signature. The card reader also confirms the chip or magnetic stripe data matches the card issuer's records. Online and phone transactions have none of these checks, so the security code fills that gap.

A merchant who has your account number and expiration date from a data breach still cannot complete a transaction without the security code. This is why stolen card numbers alone are often useless — the thief would need the three- or four-digit code to make a purchase online. Requiring it shifts some fraud risk back onto the merchant, which is why most reputable online retailers ask for it.

Some merchants, particularly subscription services and repeat vendors, may store your security code after your first purchase. This is technically against payment card rules, but it happens. If you see a charge you don't recognize from a stored-card merchant, contact your card issuer immediately.

Never share it outside of a purchase

Your security code should only be entered directly into a merchant's website, a payment app, or given verbally to a merchant you called yourself. You should never type it into an email, text message, or chat window, and you should never give it to someone who called or messaged you first.

Legitimate companies — your bank, the IRS, your utility company, PayPal — will never ask for your security code via email, phone, or text. If someone contacts you asking for it, that is a scam. Hang up or delete the message. Your card issuer already has your security code on file; they have no reason to ask you for it.

If you accidentally share your security code with someone you don't trust, contact your card issuer right away. They can issue you a replacement card with a new code, usually within 5 to 10 business days. In the meantime, monitor your account for unauthorized charges.

The difference between the security code and your PIN

The security code and your PIN (personal identification number) are not the same thing. Your PIN is a four-digit number you create and use at ATMs and in-person debit transactions. Your security code is printed on the card and used for card-not-present purchases. You choose your PIN; you do not choose your security code.

If someone has both your account number and your PIN, they can withdraw cash from your account at an ATM. If they have your account number and security code, they can make online purchases. Neither one alone is enough to drain your account, but together they create serious risk. Protect both, but understand they serve different purposes.

What happens when you get a replacement card

Every time your card issuer sends you a replacement card — whether because yours expired, was lost, was stolen, or was damaged — the new card will have a different security code. The account number may stay the same, but the code printed on the back will be new.

If you have subscriptions or recurring charges set up with your old card, you will need to update them with the new security code before the next billing date. Many merchants send you a reminder email when your card is about to expire, but not all do. Check your subscription accounts a few days after you receive a replacement card to make sure the payment method is current.

If you're waiting for a replacement card and need to make an online purchase, you can use your old card's security code until the new one arrives. The old code remains valid until the card itself expires or is deactivated.

How to read your security code correctly

The security code is always printed, never embossed. On the back of most cards, it appears to the right of the signature strip, sometimes with the label "CVV" or "CVC" next to it. Make sure you're reading the right numbers — some cards print other information nearby that can be easy to confuse.

For American Express, the code is on the front right side, above the account number. It's four digits instead of three. Double-check before you enter it, because a single wrong digit will cause the transaction to be declined.

If your security code is faded or illegible because the card is old or worn, contact your card issuer for a replacement. You cannot update or change the code yourself — it's tied to the physical card.

Frequently Asked Questions

Can someone use my card if they only have the security code?

No. A security code alone is useless without the account number and expiration date. However, if someone has all three pieces of information, they can make online purchases. This is why you should never share your security code, even if you've already given someone your account number for a legitimate reason.

Is my security code the same as my CVV?

Yes. CVV stands for "card verification value." CVC ("card verification code") and CSC ("card security code") are other names for the same thing. Different card networks and issuers use different terminology, but they all refer to the three- or four-digit code printed on your card.

What if I entered my security code wrong during a purchase?

The transaction will be declined. You can try again with the correct code. If you're unsure what the code is, look at your physical card again and enter it slowly. If the transaction is declined multiple times, contact your card issuer to make sure your account hasn't been flagged for fraud.

Do I need to memorize my security code?

No. You should never memorize it or write it down. Keep it only on the physical card itself. If you need it for a purchase, look at your card in the moment. Memorizing it increases the risk that you'll accidentally share it or that someone will see you write it down.

Can the security code change without a new card?

No. The security code is printed on the card and does not change unless you receive a replacement card. Your card issuer cannot update it remotely. If you want a new security code, you must request a replacement card.