A security code is a three- or four-digit number printed on your credit card that proves you physically have the card when you make a purchase
The security code sits on the back of most cards, printed after the last four digits of your account number. On American Express cards, it appears on the front. This number does not appear in your card's magnetic stripe or chip, so a merchant or thief who has only your card number cannot complete an online or phone purchase without it.
The code exists because online and phone transactions cannot verify your signature or scan your chip the way in-person purchases can. Merchants use it as a basic check that you own the physical card. It is not a password you set — the card issuer prints it during manufacturing, and you should never share it with anyone except the merchant processing your payment.
Key Takeaways
- Security codes are three or four digits printed on your card; Visa, Mastercard, and Discover use three digits on the back, while American Express uses four on the front.
- The code proves you have the physical card during online and phone purchases, since it does not appear in the card's magnetic stripe or chip data.
- You should only enter your security code on the merchant's website or give it directly to a merchant over the phone — never share it via email or text.
- A security code alone cannot prevent fraud if your full card number is stolen, but it does block purchases by someone who has only your number without the card itself.
Where the security code appears on your card
Visa, Mastercard, and Discover cards print the three-digit code on the back, usually to the right of the signature panel. The code is the last three digits of a longer number printed there. American Express prints a four-digit code on the front of the card, above the account number on the right side.
Some business cards and older card designs may place the code in a different location, so check your specific card if you cannot find it in the standard spot. The code itself is always printed, never embossed or raised like the account number.
How merchants use the security code
When you enter your card number, expiration date, and security code into a website checkout form, the merchant's payment processor sends that information to your card issuer to verify the transaction. The issuer checks that the security code matches the one on file for that card number. If it does not match, the transaction is declined.
The merchant never stores your security code after the transaction completes — payment networks like Visa and Mastercard prohibit it. This means even if a merchant's database is breached, the thief cannot recover your security code because it was not saved there. The code is verified in real time and then discarded.
Security code versus other card protections
A security code is one layer of fraud prevention, but it is not the only one. Your card issuer also monitors transactions for unusual patterns — a purchase in another country minutes after a local purchase, for example, or a sudden spike in spending. If the issuer suspects fraud, it may decline the transaction or call you to confirm.
Chip technology and contactless payments add another layer by encrypting your card data during the transaction itself. If you use your card in person at a chip reader or contactless terminal, the merchant never sees your full account number. Online and phone purchases, however, rely on the security code because the merchant cannot read your chip remotely.
Federal law also limits your liability for fraudulent charges. If someone uses your card without permission, you are responsible for at most $50 of unauthorized charges, and most issuers waive that fee entirely if you report the fraud promptly. This protection applies whether the fraud involved your security code or not.
What a security code does not protect against
If a thief has your full card number, expiration date, and security code — for example, from a data breach or a skimming device — they can make online and phone purchases. The security code only stops someone who has your number but not the physical card. It does not prevent fraud if all your card details are compromised.
The code also does not protect in-person transactions. When you swipe or insert your card at a store, the merchant does not ask for the security code. A thief with a cloned card or stolen card number can make purchases at physical locations without knowing the code.
How to protect your security code
Treat your security code like you would your PIN. Never share it via email, text message, or phone unless you initiated the call to a merchant you trust. Legitimate companies will never ask you to provide your security code unsolicited — if someone contacts you asking for it, that is a sign of a scam.
When shopping online, only enter your security code on the merchant's website directly, not on a third-party site. Look for a padlock icon in your browser's address bar and a URL that begins with "https" — the "s" indicates an encrypted connection. If you are using a public Wi-Fi network, avoid entering card details altogether.
Keep your physical card in sight during in-person transactions so a cashier cannot write down or photograph your security code. If you lose your card or suspect it has been compromised, contact your issuer when ready to report it and request a replacement.
Frequently Asked Questions
Can someone use my card if they only have my card number and expiration date?
They cannot complete most online purchases without your security code, but they may be able to make phone orders if the merchant does not require it. Some merchants ask for the code; others do not. Your issuer's fraud monitoring may also catch suspicious activity and decline the transaction before it goes through.
Is it safe to give my security code to a merchant over the phone?
Yes, if you initiated the call to a merchant you recognize and trust. Never provide it if the merchant called you unsolicited. Scammers often pose as card issuers or retailers to trick people into revealing their security code.
What should I do if I think my security code has been compromised?
Contact your card issuer when ready. They can issue you a new card with a new security code. You are not responsible for fraudulent charges if you report them within 60 days of receiving your statement, so act quickly if you notice unauthorized transactions.
Why do some websites ask for my security code and others do not?
Merchants choose whether to require it based on their payment processor's settings and their own fraud risk tolerance. High-risk merchants like those selling digital goods often require it; others may not. The requirement does not affect your protection — your issuer monitors all transactions regardless.
Can I change my security code?
No. Your security code is printed during card manufacturing and cannot be changed. If you want a new code, you must request a replacement card from your issuer, which will have a different code printed on it.