A security code is the 3 or 4-digit number printed on your credit card that proves you physically have the card in your hand

The security code sits on the back of most cards as a three-digit number in the signature strip, or on the front of American Express cards as a four-digit number above the account number. It is not encoded in the magnetic stripe or chip — it is printed only on the physical card itself. When you enter this code during an online or phone purchase, you are telling the merchant and the card issuer that you have the actual card, not just the number.

This code has different names depending on who is using it. Visa and Mastercard call it the CVV (Card Verification Value). American Express calls it the CID (Card Identification). Discover uses CVV2. All three serve the same purpose: to reduce fraud on transactions where the card is not physically present.

The security code does not protect you against someone using your card in a store, because they would have the physical card. It protects you against someone who has only your card number — stolen from a data breach, a receipt, or a website — and tries to buy something online or over the phone without having the card itself.

Key Takeaways

  • The security code is a 3 or 4-digit number printed on your card that merchants ask for during online and phone purchases to verify you have the physical card.
  • Visa and Mastercard call it CVV, American Express calls it CID, and Discover calls it CVV2, but they all work the same way.
  • You should never share your security code with anyone except a merchant you are actively buying from, and never store it in your phone or email.
  • A security code does not protect you against fraud if someone steals your physical card or uses it in person at a store.
  • If your card is compromised, the security code does not need to be changed separately — your card issuer will issue you a new card with a new code.

Where to find your security code

On Visa, Mastercard, and Discover cards, the security code is printed on the back of the card in the signature strip — the white or gray area on the back. It is the last three digits after the full card number. You do not need to enter the full number, only the three-digit code.

On American Express cards, the code is on the front, printed above and to the right of the card number. It is four digits instead of three. American Express prints it on the front because their cards do not have a signature strip on the back.

If you cannot find the code on your card, contact your card issuer. They can tell you the code over the phone if you verify your identity. Do not search for it online or ask someone else to look it up for you.

Why merchants ask for it during online purchases

When you buy something online, the merchant cannot see your physical card. They have your card number, expiration date, and billing address — all of which can be stolen from a database breach or phishing email. The security code is the one piece of information that only exists on the physical card itself, not in any computer system.

By asking for the security code, the merchant is running what is called a Card Not Present (CNP) transaction. The code gets sent to your card issuer, who checks whether it matches the code on file for that card number. If it does not match, the transaction is declined. If someone has your card number but not your physical card, they will not have the correct code and the purchase will fail.

This is why merchants also ask for your billing address during online checkout — it is another piece of information that only the cardholder should know. Together, the security code and address verification make it much harder for a thief to complete a purchase with a stolen card number.

What the security code does not protect against

The security code does not protect you if someone steals your physical card and uses it at a store, gas pump, or ATM. They have the card in hand, so they have the code. The fraud protection in that case comes from your card issuer's zero-liability policy, which means you are not responsible for unauthorized charges once you report the card stolen.

The security code also does not protect you against a data breach at a merchant's website. If a hacker breaks into a store's computer system and steals customer payment information, they will get your card number, expiration date, and billing address — but they should not get your security code, because legitimate merchants are not supposed to store it. However, some merchants store it anyway, which is why breaches can still be dangerous even though the code exists.

If your card number is compromised, you do not need to worry about the security code separately. Your card issuer will cancel the old card and send you a new one with a new security code printed on it.

How to protect your security code

Never share your security code with anyone except a merchant you are actively making a purchase from. Do not type it into emails, text messages, or chat windows. Do not read it to someone over the phone unless you initiated the call to a merchant you know and trust.

Do not store your security code in your phone, wallet, or anywhere else. The code is only useful if you have the physical card, so there is no reason to write it down or save it digitally. If you memorize it, that is fine, but do not rely on having it available outside of the card itself.

Be cautious about entering your security code on unfamiliar websites. Look for a padlock icon in the address bar and make sure the website address starts with "https://" rather than "http://". These indicate that the connection is encrypted. Avoid entering your code on public Wi-Fi networks, where someone could intercept the information.

If someone asks for your security code in person or over the phone without you initiating the contact, hang up or walk away. Legitimate merchants will never call you and ask for this information. If you are unsure whether a call is legitimate, hang up and call the merchant's customer service number from the back of your card.

What happens if your security code is compromised

If you believe your security code has been compromised — for example, you entered it on a website that was later hacked — contact your card issuer when ready. Tell them you want to cancel the card and receive a replacement. The issuer will issue a new card with a new security code at no cost to you.

You are not responsible for fraudulent charges made with your card number and security code, as long as you report the fraud within a reasonable time. Most card issuers have zero-liability policies that protect you against unauthorized use. However, you must report the fraud promptly — waiting weeks or months to report it can complicate your case.

Check your card statements regularly, at least once a month, to catch unauthorized charges early. Many card issuers also offer free fraud alerts or monitoring services that notify you of large purchases or purchases in unusual locations. Ask your issuer what protections are included with your card.

Security codes and card replacement

Every time your card issuer sends you a new card — whether because the old one expired, was damaged, or was compromised — the new card will have a different security code printed on it. The code is unique to each physical card, not to your account.

If you have set up automatic payments with a merchant using your card number and security code, you will need to update those payments when you receive a new card. Some merchants will automatically update the information if they have your new card on file, but others will decline the payment and ask you to provide the new code. Check your recurring payments after receiving a replacement card to make sure they go through without interruption.

If you have a business credit card or a supplementary card issued to an employee or family member, each card has its own security code. The codes are different even though they may be linked to the same account.

Frequently Asked Questions

Can someone use my card number without the security code?

Yes, but it is much harder. A thief with only your card number and expiration date can attempt to make purchases, but most online merchants will decline the transaction if the security code does not match. In-person purchases do not require the code, so a stolen physical card is a bigger risk than a stolen card number.

Should I memorize my security code or write it down?

You do not need to memorize it or write it down. The code is only useful when you have the physical card in front of you, so there is no practical reason to store it separately. If you memorize it by accident, that is fine, but do not intentionally try to remember it or save it anywhere.

Do I need to enter the security code every time I shop online?

Most merchants ask for it the first time you use a card. If you save your card information on a website for future purchases, you may not need to enter the code again for that merchant. However, some merchants ask for it every time for security reasons. You should always be prepared to provide it.

What if I enter the wrong security code?

The transaction will be declined. You can try again with the correct code. Entering the wrong code a few times will not lock your card or trigger fraud alerts, but entering it many times in a short period might. If you keep getting declined, contact your card issuer to make sure the card is not frozen.

Is the security code the same as my PIN?

No. Your PIN is a number you create and use at ATMs and in-store purchases. Your security code is printed on the card by the issuer and is used only for online and phone purchases. They are separate security features that protect different types of transactions.