A security code is a 3- or 4-digit number printed on your credit card that proves you physically have the card when you make a purchase
The security code sits separate from your card number. On the front of most cards, it's the last three digits printed to the right of your card number. On American Express cards, it's a four-digit code on the front, above the card number. You'll also see it called a CVV (Card Verification Value), CVC (Card Verification Code), or CID (Card Identification)—these names all mean the same thing.
The code exists because online and phone purchases can't use the physical card itself as proof you own it. A thief who steals your card number alone can't complete most online transactions without this code. It's a second checkpoint that makes fraud harder, though not impossible.
Key Takeaways
- A security code is a 3- or 4-digit number that proves you have the physical card in your hand when making an online or phone purchase.
- Visa and Mastercard use a 3-digit code on the back; American Express uses a 4-digit code on the front.
- Never share your security code via email, text, or phone call—legitimate companies will never ask for it that way.
- The code protects you from fraud but is not a may provide; monitor your statements regularly for unauthorized charges.
Where the security code appears on your card
The location and length depend on your card brand. Visa, Mastercard, and Discover all print a three-digit code on the back of the card, usually in the signature panel on the right side. American Express is different: it prints a four-digit code on the front, above the card number on the right.
The code is not embossed like your card number—it's printed flat on the surface. This matters because it means the code cannot be read by the old mechanical card readers that some older stores still use. Only you, the merchant, and your bank should ever see this number.
Why merchants ask for it during online and phone purchases
When you swipe or insert your card in person, the card reader confirms the card is real and hasn't been reported stolen. Online and phone purchases can't do that. A thief who has only your card number and expiration date can still attempt a purchase. The security code adds a second layer: the person making the purchase must also have the physical card in hand to read the code.
This is why the code is printed on the card itself rather than encoded in the magnetic stripe or chip. The merchant's system checks the code against your bank's records. If the code doesn't match, the transaction is declined. It's not foolproof—a stolen card will have the correct code—but it stops many fraud attempts that rely on stolen numbers alone.
What you should never do with your security code
Do not share your security code via email, text message, or phone call. Legitimate companies—your bank, your credit card issuer, retailers—will never ask you to provide it this way. If someone calls claiming to be from your bank and asks for your security code, hang up and call your bank directly using the number on the back of your card.
Do not write the code down or store it anywhere except in your memory. Do not photograph it. Do not give it to anyone who contacts you unsolicited. If you're making a purchase on a website you don't recognize or trust, do not enter the code. The only time you should provide it is when you are the one initiating a purchase on a website or over the phone with a merchant you chose to contact.
How the security code protects you—and what it doesn't protect
The code reduces the risk of "card-not-present" fraud, which is fraud that happens online or by phone. It makes it harder for someone with only your card number to complete a purchase. However, the code does not protect you if your physical card is stolen, because a thief with the card in hand can read the code directly.
The code also does not protect you from phishing scams or data breaches at retailers. If a website you trust is hacked and your card information is stolen, the thief now has both your number and your code. This is why monitoring your statements matters more than the code itself. Check your credit card statement at least monthly for charges you don't recognize, and report any unauthorized transactions to your bank when ready.
What happens if your card is lost or stolen
Call your card issuer right away—the number is on the back of your card or on your statement. Your bank can freeze the card so no new purchases can be made, even if someone has your number and security code. You are not responsible for unauthorized charges if you report the loss promptly, though the exact timeline varies by card issuer and state law.
Once your card is reported stolen, the security code becomes irrelevant because the card itself is no longer valid. Your issuer will send you a replacement card with a new number and a new security code. Until it arrives, you can still make purchases online using your account number and a temporary code, or by calling the merchant directly.
Security codes and your credit report
Your security code does not appear on your credit report and does not affect your credit score. It is used only to verify purchases at the moment you make them. Your credit report contains your payment history, the amount you owe, and the length of your credit history—not the security details of your cards.
If fraudulent charges do appear on your statement and you report them, your bank will investigate and remove them from your bill. This process does not damage your credit as long as you report the fraud within the timeframe your card issuer requires, usually 60 days from when you receive your statement.
Frequently Asked Questions
Can someone use my card number without the security code?
It's harder, but not impossible. Many online retailers require the security code before processing a purchase. However, some merchants—particularly subscription services or repeat customers—may store your card on file without the code, or a thief might attempt a purchase and hope it goes through. This is why monitoring your statement matters more than relying on the code alone.
Is it safe to enter my security code on any website?
Only enter it on websites you trust and that you initiated contact with. Look for "https://" in the address bar and a padlock icon, which indicate the site uses encryption. Never enter your security code on a website you reached by clicking a link in an email or text message, even if the message appears to come from your bank.
What if I can't find the security code on my card?
Contact your card issuer. Some older or specialty cards may have the code in a different location, or it may not be visible if the card is worn. Your issuer can provide the code over the phone after confirming your identity, though they will not ask you to provide it to them.
Does the security code change?
No. The code stays the same for the life of the card. It only changes when you receive a replacement card—either because yours expired, was damaged, or was reported stolen. A new card gets a new number and a new security code.
Can I use my credit card safely online if I know my security code is find?
The security code is one layer of protection, but not the only one that matters. Use strong, unique passwords for online shopping accounts, enable two-factor authentication when available, and monitor your statements regularly. The security code reduces fraud risk, but your own habits—like not reusing passwords and checking your bill—matter just as much.