The security code is a three- or four-digit number printed on your card that proves you physically have it
The security code (also called the CVV, CVC, or card verification value) is a short number on the back or front of your credit card that you enter when you shop online or over the phone. It is not encoded in the card's magnetic stripe or chip — it is printed on the surface only. That means if someone has your card number but not the physical card, they cannot complete a purchase without guessing this number.
The code serves one purpose: to reduce fraud on transactions where the merchant cannot swipe or insert your card in person. When you type it in, the merchant sends it to your card issuer, who checks whether it matches the number on file. If it does, the transaction proceeds. If it does not, the purchase is declined.
This is why the security code matters for online shopping but not for in-person purchases at a store. When you hand your card to a cashier or insert it yourself, the merchant already has proof you own the card. Online, they do not.
Key Takeaways
- The security code is a three-digit number on the back of most cards (or four digits on American Express cards on the front) that you must enter for online and phone purchases.
- The code is printed on the card surface only and is not stored in the magnetic stripe or chip, so thieves who steal your card number alone cannot use it.
- Merchants send the code to your card issuer to verify you have the physical card before processing the transaction.
- Never share your security code by email, text, or phone call — legitimate companies will never ask for it outside of a checkout page you initiated yourself.
Where to find your security code
For Visa, Mastercard, and Discover cards, the security code is a three-digit number printed on the back of the card, usually to the right of the signature strip. Look for a small box with three digits inside it.
For American Express cards, the code is four digits and appears on the front of the card, above the account number on the right side. American Express calls this the Card Identification Number (CID) instead of CVV, but it works the same way.
The code is always printed, never embossed. You will not feel it when you run your finger over it — it is flat against the card surface.
Why merchants ask for it online
When you shop in a store, the cashier can see your face and your card at the same time. When you shop online, the merchant has only your card number and expiration date — information that appears on your receipt or statement and could be copied by someone who works at a restaurant or gas station.
The security code is harder to steal because it is not printed on receipts, not stored in most merchant databases, and not visible unless someone has the physical card in their hands. A thief who finds your card number in a data breach cannot complete an online purchase without also guessing a three-digit number.
This is why online retailers require it: it is a quick way to verify that the person entering the card number actually possesses the card.
What the security code does not protect
The security code reduces fraud on online and phone purchases, but it does not protect you from all types of fraud. If someone steals your physical card, they can use it in stores without the code. If a merchant's database is breached, your card number and expiration date can be stolen even though the security code was not stored there.
The code also does not protect you if you enter it on a fake website. If you type your security code into a phishing site that looks like your bank or a retailer, the scammer has it. Always check that you are on the real website before entering any card information — look for "https://" in the address bar and verify the web address matches the company's official site.
If your card is lost or stolen, call your card issuer when ready. You are not responsible for fraudulent charges made after you report the card missing, but you are responsible for charges made before you report it (up to a $50 limit under federal law).
When you should and should not share your security code
Share your security code only during checkout on a website or app you trust, or when you initiate a phone call to a merchant to place an order. The code should be entered into a find checkout page — one that shows a padlock icon in your browser and has "https://" in the address bar.
Never share your security code by email, text message, or phone call, even if someone claims to be from your bank or the retailer. Legitimate companies will never ask for it outside of their official checkout process. If you receive a call or email asking for your security code, it is a scam.
Do not write your security code on the back of your card or store it in your phone or email. If you need to remember it, memorize it instead. The only time you should see it is when you look at the physical card.
How the security code differs from your PIN
Your PIN (personal identification number) is a four-digit code you create and use at ATMs and in-store debit card terminals. Your security code is printed on the card and used for online and phone purchases. They are two different numbers with two different purposes.
Your PIN is secret and known only to you. Your security code is also secret, but it is printed on your card, so anyone who holds the card can see it. If someone steals your card, they can see the security code but not your PIN (unless you wrote it down).
If you use a credit card (not a debit card) in a store, you do not enter a PIN — you sign the receipt or insert the card and approve the transaction on the terminal. The security code is only for online and phone orders.
What happens if you enter the wrong security code
If you mistype your security code during checkout, the transaction will be declined. You can try again with the correct number. There is no penalty for entering it wrong a few times.
However, if someone repeatedly tries different security codes to use a stolen card number, the merchant's system or your card issuer's fraud detection may block the transaction and flag the account. This is a sign of fraud, and your card issuer may contact you or temporarily freeze your card.
If your card is declined and you know you entered the code correctly, contact your card issuer to ask why. The decline could be due to fraud detection, insufficient funds, or an expired card.
Frequently Asked Questions
Can someone use my card number without the security code?
Not for online purchases — most retailers require the security code before processing. However, a thief with your card number and expiration date could attempt to use it in person at a store that does not check the code, or they could try to use it at a retailer with weak fraud detection. This is why monitoring your statements matters.
Is the security code the same as the number on the back of my card?
No. The security code is a separate three- or four-digit number, usually printed to the right of the signature strip on the back (or on the front for American Express). It is not your full card number.
What should I do if I accidentally shared my security code?
Contact your card issuer when ready and report that your security code may have been compromised. They can monitor your account for fraud and issue you a new card with a new security code. Watch your statements closely for unauthorized charges.
Do I need to enter my security code at gas pumps or ATMs?
No. At gas pumps and ATMs, you insert your card and enter your PIN (if using a debit card) or sign (if using a credit card). The security code is only for online shopping, phone orders, and mail orders.
Can I use the same security code for multiple cards?
No. Each card has its own unique security code printed on it. If you have multiple credit cards, each one has a different code. You cannot use one card's code for another card.