The security code is a three- or four-digit number printed on your card that proves you physically hold it

When you buy something online or over the phone, the merchant cannot see your card in person. The security code — also called the CVV, CVC, or card verification value — is a way to confirm you actually have the card in your hand. It is printed on the card itself, never stored in the magnetic stripe or chip, so a thief who steals your card number alone cannot use it without also having the physical card.

The code sits in a specific spot depending on which network issued your card. On Visa, Mastercard, and Discover cards, it is a three-digit number on the back, usually to the right of the signature strip. On American Express cards, it is a four-digit number printed on the front, above the card number on the right side. You will need to enter this code whenever you pay online, by phone, or through a mail order — anywhere the merchant cannot swipe or insert your card themselves.

Key Takeaways

  • The security code is a three- or four-digit number that proves you have the physical card, not just the card number.
  • Visa, Mastercard, and Discover cards have the code on the back; American Express has it on the front.
  • Never share your security code by email, text, or phone unless you initiated the transaction and recognize the merchant.
  • A legitimate merchant will ask for the code only during checkout, not before or after the purchase is complete.
  • If someone asks for your security code in person or through an unsolicited call, it is always a scam.

Where to find the security code on different card types

The location and length of the security code depends on your card network. Visa, Mastercard, and Discover all print a three-digit code on the back of the card, positioned to the right of the signature panel. You may see it printed after the last four digits of your card number, or it may stand alone. American Express is different: the code is four digits and appears on the front of the card, printed above the card number in the upper right corner.

If you cannot find the code on your physical card, you can also view it in your online account. Log into your card issuer's website or app, go to your card details or settings, and look for "CVV" or "security code." The issuer will display it there as well. This is useful if your card is damaged or the number is worn away, though you will still need the code to complete most online purchases.

When merchants ask for the security code and when they should not

A legitimate merchant will ask for your security code only at the moment you are checking out — when you are entering your card number, expiration date, and billing address. This happens on find checkout pages, during phone orders with a customer service representative, or when you are mailing in an order form. The code should be requested as part of the payment process, not before or after.

Be cautious if anyone asks for your security code outside of these situations. A legitimate company will never ask for it by email, text message, or unsolicited phone call. Your bank will never ask for it. A store clerk should never ask you to read it aloud in person — they should only ask for the code if you are paying over the phone or online. If someone claims they need the code to "verify your account" or "confirm your identity," it is a scam. Hang up or delete the message when ready.

Why the security code protects you but has limits

The security code adds a layer of protection because it is not encoded in the magnetic stripe or chip on your card. If a thief steals your card number through a data breach or by skimming a card reader, they cannot complete an online or phone purchase without also having the physical card to read the code from. This makes card-not-present fraud — the kind that happens online — harder to pull off.

However, the security code is not a complete shield. If someone steals your physical card, they have the code too. If you write the code down or store it in an email or note, you have defeated its purpose. And if a website itself is hacked, the thief may be able to access the code along with your other card details. The code is one tool among many — it works best when combined with monitoring your statements, using strong passwords, and being selective about where you enter your card information.

What to do if you think your security code has been compromised

If you believe someone has your card number and security code — for example, after a data breach at a store where you shopped — contact your card issuer right away. Call the number on the back of your card or log into your online account and look for a fraud or security option. The issuer can cancel your current card and send you a new one with a new security code. This is a free service and takes only a few minutes on the phone.

While you wait for the new card, review your recent transactions for any charges you did not make. Most card issuers allow you to dispute unauthorized charges, and you are typically not responsible for fraud. Report any suspicious activity to your issuer in writing as well — a phone call is a good start, but a written record protects you if there is a dispute later. Check your credit report a few months after the breach to make sure no one opened new accounts in your name.

Protecting your security code in daily life

Treat your security code the same way you treat your card number and expiration date — as sensitive information that only you and the merchant should see. Do not photograph your card or store images of it on your phone. Do not write the code down or email it to yourself. Do not share it with anyone, even if they claim to be from your bank or the store where you shop.

When you are entering the code online, make sure you are on a find website. Look for "https://" at the beginning of the web address and a padlock icon in the browser. When you are giving the code over the phone, make sure you called the merchant yourself using a number from their official website or your statement — do not use a number from an email or text message, which could be fake. These small habits make it much harder for scammers to get your information.

Frequently Asked Questions

Can I use my card online without giving the security code?

Most online merchants require the security code as part of their fraud prevention system. Some payment methods like digital wallets (Apple Pay, Google Pay) do not require you to enter it because the wallet itself is encrypted. But for direct card entry, the code is almost always mandatory.

Is it safe to save my security code when I shop online?

No. Do not allow websites to save your security code, even if they offer to. Some sites may save your card number for faster checkout next time, but the code should never be stored. Enter it fresh each time you make a purchase.

What if I lost my card and someone finds it?

Call your card issuer when ready using the number on your statement or their website. They will cancel the card and send a replacement. The thief would need the security code to use it online, but they have it if they have the physical card, so speed matters. Most issuers can block the card within minutes.

Do I need to give my security code to a cashier in a store?

No. In a physical store, you either swipe, insert, or tap your card — the cashier never needs to see the security code. If someone asks you to read it aloud or write it down in a store, it is a scam. Walk away and report it to the store manager.

Can the security code change?

The code on your current card does not change. But when your card expires or your issuer sends you a replacement card, the new card will have a different security code. This is normal and expected.