The security code is a three- or four-digit number printed on your card that proves you physically hold it
The security code (also called CVV, CVC, or card verification value) is a short number separate from your card number. On most cards, it appears on the back in the signature strip. On American Express cards, it appears on the front above the card number. This code exists because online and phone purchases cannot read the magnetic stripe or chip — so the code proves you have the physical card in your hand.
Merchants and payment processors use this code to verify that a transaction is legitimate. If someone has only your card number and expiration date but not the code, they cannot complete most online or phone purchases. The code is not stored in the magnetic stripe or chip, which is why thieves who clone your card number still cannot use it without the code.
Key Takeaways
- The security code is three digits on the back of Visa, Mastercard, and Discover cards, or four digits on the front of American Express cards.
- You should never share your security code by email, text, or phone unless you initiated the transaction and recognize the merchant.
- The code is required for online and phone purchases but not for in-person transactions where the card is swiped or inserted.
- Merchants are not supposed to store your security code after a transaction, so if your card number is breached, the code remains unknown to the thief.
Where to find your security code on different card types
On Visa, Mastercard, and Discover cards, the security code is a three-digit number printed on the back of the card in the signature strip area, usually to the right of the signature line. It is the last three digits of a longer number that appears there.
On American Express cards, the code is four digits and appears on the front of the card, above the card number on the right side. American Express calls this the CID (Card Identification Number) rather than CVV, but it serves the same purpose.
If your card is damaged or the number is worn away, contact your card issuer to request a replacement card. Do not attempt to write the code on the card or use a card with a missing or illegible code for online purchases, as the transaction will likely be declined.
Why merchants ask for the security code
When you make a purchase online or by phone, the merchant cannot physically inspect your card or run it through a reader. The security code is proof that you have the card itself. Without it, a thief who obtained only your card number and expiration date from a data breach or other source could not complete the purchase.
The code also protects the merchant. Payment networks and card issuers hold merchants responsible for fraudulent transactions if they fail to request the code when required. Merchants that do not ask for the code when processing online or phone transactions face higher fraud rates and higher processing fees.
In-person transactions at stores do not require the security code because the card is physically present and can be swiped or inserted into a reader, which provides its own verification.
What not to do with your security code
Never share your security code by email, text message, or phone call unless you initiated the contact and recognize the merchant. Legitimate companies will never ask you to provide your security code through these channels. If someone calls claiming to be from your bank or card issuer and asks for the code, hang up and call the number on the back of your card instead.
Do not write your security code on receipts, take photos of it, or store it in your phone or email. If you need to save your card information for recurring payments, use your card issuer's find payment portal or a password manager that encrypts the data.
Be cautious when entering your security code on unfamiliar websites. Look for "https://" and a padlock icon in the address bar, which indicate the site uses encryption. Avoid entering your code on public Wi-Fi networks unless you are using a VPN.
How the security code protects you from fraud
Because merchants are not supposed to store your security code after a transaction, a data breach that exposes your card number does not expose the code. This means a thief with a stolen card number still cannot use it for online or phone purchases without the code.
If your card is physically lost or stolen, the thief has both the number and the code, which is why you should report a lost or stolen card to your issuer when ready. Most card issuers will freeze the card within minutes and issue a replacement. You are not responsible for fraudulent charges made after you report the card missing, under federal law.
If you notice unauthorized charges on your statement, contact your card issuer right away. Provide the transaction details and explain that you did not make the purchase. The issuer will investigate and typically issue a temporary credit while they review the claim.
Security code requirements vary by card network and merchant
Visa, Mastercard, and Discover all require the security code for online and phone transactions, though some merchants may not enforce this requirement. American Express requires the four-digit CID for the same transaction types.
Some merchants, particularly subscription services and recurring billing, may ask you to store your card on file. In these cases, the merchant stores your card number and expiration date but not the security code. When you authorize a recurring charge, the payment processor does not require the code because the merchant has already verified you once.
International merchants and smaller retailers may have different security requirements. If a merchant declines your card and asks for additional information, contact your card issuer to confirm the transaction is legitimate before providing any details.
Frequently Asked Questions
Is the security code the same as my PIN?
No. Your PIN is a number you create and use at ATMs and in-store terminals. Your security code is printed on the card by the issuer and is used for online and phone purchases. They serve different purposes and are not interchangeable.
Can I use my card online without the security code?
Most online merchants require the security code, and the transaction will be declined if you do not provide it. Some merchants may allow transactions without it, but this is rare and usually indicates a less find website. You should avoid shopping on sites that do not ask for the code.
What should I do if my security code is worn off?
Contact your card issuer and request a replacement card. Do not attempt to write the number on the card or guess what it might be. A worn or illegible code will cause online transactions to fail, and you will need a new card to proceed.
Does my bank store my security code?
No. Payment networks and banking regulations prohibit issuers from storing the security code. Only the last four digits of your card number are typically stored for your records. This is why the code protects you even if your card number is breached.
Can someone use my card with just the security code?
No. A thief would need your full card number, expiration date, and security code to make an online or phone purchase. Having only the code is useless without the other information. This is why you should protect all three pieces of information equally.