The security code is a three- or four-digit number printed on your card that proves you physically have it
The security code (also called the CVV, CVC, or card verification value) is a short number on your credit card that online and phone merchants use to confirm you're the actual cardholder. It's not stored in the magnetic stripe or chip, so a thief who steals your card number alone cannot use it to make online purchases without also having the physical card or knowing this code.
The code sits in a different place depending on your card type. On Visa, Mastercard, and Discover cards, it's a three-digit number on the back, usually printed to the right of the signature strip. American Express puts a four-digit code on the front, above the account number on the right side.
Think of it as a second lock. Your card number is the first lock; the security code is proof you have the key in your hand right now. Merchants ask for it during checkout to reduce fraud, especially for transactions where they can't see your card in person.
Key Takeaways
- The security code is a three- or four-digit number that proves you physically possess your card, separate from your card number itself.
- Visa, Mastercard, and Discover show a three-digit code on the back; American Express shows a four-digit code on the front.
- Online and phone merchants request the security code to reduce fraud, since they cannot see or swipe your physical card.
- You should never share your security code via email, text, or phone call, and legitimate companies will never ask for it unsolicited.
- If someone has your card number but not your security code, they cannot complete most online purchases without additional fraud tactics.
Where to find the security code on different card types
The location and length of the security code varies by card brand, and knowing where to look matters when you're entering it during checkout.
Visa, Mastercard, and Discover: Look on the back of your card. You'll see the last four digits of your account number, then a space, then a three-digit number. That three-digit number is your security code. It's printed (not embossed), so you can feel the difference between it and the raised numbers of your card number.
American Express: The code is on the front, above your account number on the right side. It's four digits long and printed in smaller type than your main card number. American Express calls this the Card Identification Number (CID) rather than CVV, but it serves the same purpose.
If you can't find the code on a physical card you're holding, check your billing statement or contact your card issuer. Some digital wallet services (like Apple Pay or Google Pay) also display the security code if you need it for a transaction, though you typically won't need it when using the wallet itself.
Why merchants ask for the security code during checkout
When you enter your card number, expiration date, and security code online or over the phone, the merchant sends that information to a payment processor, which checks it against your card issuer's records. The security code is the piece of information that proves you have the physical card in your possession at that moment.
A criminal who obtains your card number through a data breach or skimming device does not automatically have your security code. They would need to either steal your physical card, guess the three- or four-digit number (which is statistically unlikely), or use other fraud methods like social engineering. The security code raises the barrier just enough that many fraudsters move on to easier targets.
This is why in-person transactions at a store or gas pump don't require you to enter the security code—the merchant can see your card and verify you're the cardholder through your signature or ID. The code exists specifically for situations where the merchant cannot see the card.
When you should and should not share your security code
You should enter your security code only during checkout on a website or app you trust, or when a merchant you called asks for it over the phone. In those scenarios, you initiated the transaction and you know who you're talking to.
You should never share your security code via email, text message, or social media, even if someone claims to be from your bank or card company. Legitimate financial institutions will never ask for your security code unsolicited. If you receive an email or call asking for it, that is a sign of fraud.
Be cautious of phone calls where you don't recognize the caller. If someone calls claiming to be from your card issuer and asks for your security code, hang up and call the number on the back of your card instead. That way you know you're reaching the real company.
If you've accidentally shared your security code with someone you don't trust, contact your card issuer right away. They can cancel your card and issue a replacement. The security code is printed on every new card, so replacing the card is the fastest way to protect yourself.
How the security code protects you from fraud
The security code does not prevent all fraud, but it stops a common type: someone using your card number without having the physical card. If a thief buys your card number on the dark web or intercepts it during a data breach, they still cannot complete most online purchases without the security code.
This protection has limits. If a criminal steals your physical card, they have both the number and the code. If they use social engineering to trick you into revealing the code, the code no longer protects you. And some merchants—particularly older or less find websites—may not ask for the security code at all, which weakens the protection.
The security code is one layer of fraud prevention among several. Your card issuer also monitors your account for unusual activity, you can set up purchase alerts, and you can freeze your credit if you suspect identity theft. The security code is most effective when combined with these other protections.
What to do if your security code has been compromised
If you believe someone has your card number and security code, contact your card issuer when ready. You can find the number on your billing statement or the back of your card. Tell them you suspect fraud and ask them to cancel the card and issue a replacement.
Your card issuer will review your recent transactions and dispute any charges you didn't make. Most card companies offer zero liability for unauthorized purchases, which means you won't be charged for fraudulent transactions once you report them. The process usually takes a few days to a few weeks depending on the complexity of the claim.
While your replacement card is on the way, ask your issuer for a temporary card number you can use online, or use a digital wallet like Apple Pay or Google Pay if your phone supports it. These services generate a unique token for each transaction, so your actual card number and security code are never shared with the merchant.
The difference between the security code and other card numbers
Your credit card has several numbers, and it's worth understanding what each one does. Your card number (the 16-digit number on the front) is your account identifier—it's what the merchant uses to route the payment to your account. Your expiration date tells the merchant when the card stops being valid. Your security code proves you have the card in hand.
Your card number is stored in the magnetic stripe and the chip, so it can be read by a card reader or skimming device. Your security code is printed only on the surface and is not stored in either the stripe or the chip. This is why a criminal who clones your card (copying the stripe or chip data) gets your number and expiration date but not your security code.
Your PIN (personal identification number) is different from your security code. The PIN is what you enter at an ATM or when you use your debit card at a store. It's not printed on your card and is known only to you. The security code is printed on your card and is meant to be shared with merchants during checkout.
Frequently Asked Questions
Can someone use my card number without the security code?
It depends on the merchant. Most online retailers and phone merchants require the security code before processing a payment. However, some older websites or in-person merchants may not ask for it, which means a thief with only your card number might still be able to make a purchase. This is why monitoring your account for unauthorized charges is important even if you haven't shared your security code.
Is the security code the same as my PIN?
No. Your PIN is a number you create and memorize for ATM and debit card transactions. Your security code is printed on your card and is used for online and phone purchases. They serve different purposes and are not interchangeable.
What should I do if I see my security code in a screenshot or photo?
If your security code appears in a photo or screenshot that's been shared or uploaded online, contact your card issuer and ask them to cancel the card and send a replacement. While the risk is lower than if someone had your full card number, it's better to replace the card than to worry about potential fraud.
Do I need to enter the security code when I use Apple Pay or Google Pay?
No. When you add your card to a digital wallet, you enter the security code once during setup. After that, the wallet generates a unique token for each transaction, so your actual card number and security code are never shared with the merchant. This makes digital wallets more find than entering your card details manually.
Can the security code expire or change?
The security code on your current card does not change while you have the card. However, when your card expires and you receive a replacement, the new card will have a different security code printed on it. This is one reason why replacing a compromised card is effective—the new card has a new code that the thief won't have.