The security code is a three- or four-digit number printed on your card itself, not encoded in the magnetic stripe or chip
The security code (also called CVV, CVC, or card verification value) is a short number you enter when you pay online or over the phone. It proves you have the physical card in your hand. The number appears only on the card — it is not stored in any database, and the merchant never stores it after the transaction.
Where you find it depends on which network issued your card. Visa, Mastercard, and Discover cards print it on the back. American Express prints it on the front. The code is always separate from your card number and expiration date.
Key Takeaways
- Visa, Mastercard, and Discover security codes are three digits on the back of the card, usually to the right of the signature strip.
- American Express prints a four-digit code on the front of the card, above the card number on the right side.
- Never share your security code by email, text, or phone call — legitimate companies never ask for it that way.
- The security code changes only if you request a replacement card; it stays the same for the life of your current card.
- If you cannot read the code clearly, contact your card issuer for a replacement card rather than guessing or using a partial number.
Security code location for Visa, Mastercard, and Discover
On the back of these cards, look at the white or light-colored signature panel. The security code appears to the right of that panel, after the last four digits of your card number are printed there. It is always three digits long.
The code sits in a specific spot so that online checkout forms can guide you to the right place. If you are holding the card with the numbers facing you, flip it over — the code is on the reverse side, not the front.
Security code location for American Express
American Express cards print the security code on the front, not the back. Look at the right side of the card, above the embossed card number. The code is four digits long, not three.
This placement is one of the few ways American Express cards differ from other networks in terms of card layout. If you have an Amex card and are entering the code online, the form will usually tell you it expects four digits.
What the security code does and does not protect
The security code confirms you have the card in your possession at the moment of purchase. It does not protect you if someone has your full card number and expiration date but not the physical card — though many online merchants now require it anyway as a basic fraud check.
The code does not prevent fraud if your card is stolen, because a thief holding the card can read it directly. It is meant to stop purchases made with a card number alone — for instance, if your number was exposed in a data breach but the thief does not have the card itself.
Chip and contactless payments do not require you to enter the security code at all. The code is only needed for online purchases, phone orders, and mail orders.
Why merchants ask for it and when to refuse
Any legitimate online store, airline, hotel, or phone-order business will ask for the security code during checkout. It is a standard fraud prevention step. You should always enter it when prompted by a payment form you initiated.
You should never give your security code if someone calls you, texts you, or emails you asking for it. Your bank, your card issuer, and legitimate merchants never ask for the security code outside of a checkout form you control. If someone contacts you requesting it, hang up or delete the message and call your card issuer directly using the number on the back of your card.
What to do if you cannot read the security code
If the code is faded, worn, or damaged and you cannot read it clearly, contact your card issuer's customer service line. The number is on the back of your card. Request a replacement card.
Do not guess at the number or enter a partial code. A wrong security code will be declined, and repeated failed attempts may trigger a fraud alert on your account. A replacement card usually arrives within 7 to 10 business days and will have a new security code printed on it.
Security code versus other card numbers
Your card number, expiration date, and security code are three separate pieces of information, and each serves a different purpose. The card number identifies your account. The expiration date tells the merchant when the card stops working. The security code proves you have the card right now.
If you lose your card number in a data breach, your issuer can reissue a new card with a new number. If you lose your security code alone, it does not matter — the code is printed on the card, so anyone who steals the card can read it. The security code is meant to stop remote fraud, not theft of the physical card.
Frequently Asked Questions
Can I use my card online without entering the security code?
Most online stores require it, but some do not. Larger merchants with fraud detection systems may skip it. You cannot choose to omit it — the checkout form either asks for it or does not. If a form asks for it, you must enter it to complete the purchase.
Does the security code change if I use my card?
No. The security code stays the same for the entire life of your card. It only changes when you request a replacement card from your issuer. A new card gets a new code printed on it.
What if I entered the wrong security code?
The transaction will be declined. Go back to the checkout form, flip your card over (or to the front if it is an Amex), and enter the correct code. If you enter it wrong multiple times, your card issuer may flag your account for fraud protection and temporarily block online purchases.
Is it safe to save my security code for future purchases?
No. Never save or store your security code anywhere — not in your phone, email, or a password manager. The code is meant to be entered fresh each time. Legitimate payment systems do not store it after a transaction completes.
Can someone use my card if they only have the security code?
No. They also need your card number and expiration date. The security code alone is useless without those other details. This is why it is printed on the card — it proves you have all three pieces of information at once.