What Is the Security Code on a Credit Card — and Where Do You Find It?

Every credit card carries a short numeric code designed specifically to verify that the person making a purchase actually has the card in hand. If you've ever been asked for it during an online checkout and weren't sure exactly what it was or where to look, you're not alone. Here's a clear breakdown of what that code is, why it exists, and how it varies across card networks.

What the Security Code Actually Is

The security code on a credit card is a 3- or 4-digit number that serves as an extra layer of fraud protection. Unlike your card number or expiration date, this code is not stored in the magnetic stripe — which means that even if someone skims your card at a compromised reader, they generally can't capture it. For online or phone transactions where a merchant can't physically swipe your card, requiring this code helps confirm you're the legitimate cardholder.

You'll hear it called by several names depending on the card network:

The terminology differs, but the purpose is identical across all of them.

Where Exactly to Look on Your Card 🔍

For Visa, Mastercard, and Discover, flip your card over. You'll see the signature panel — a white or gray strip running horizontally. The security code is printed there, usually after the last few digits of your card number. It's the standalone 3-digit number at the end.

For American Express, the code is on the front of the card. Look for a small 4-digit number printed above and to the right of your embossed card number. It's not raised — it's flat-printed, which is one way to distinguish it from the main account number.

If your card is brand new and the code isn't immediately obvious, check both sides carefully before assuming it's missing.

Why This Code Exists

Credit card fraud largely breaks into two categories: card-present fraud (someone physically uses a stolen card) and card-not-present fraud (someone uses stolen card details online). The security code was designed specifically to address the second type.

When you hand your card to a cashier or tap it at a terminal, the transaction can be verified in multiple ways. But online, the merchant can only see what you type. Requiring the security code creates an additional hurdle — a thief who only has your card number and expiration date (common in data breaches) still lacks the one piece needed to complete many transactions.

That said, the code is not a perfect shield. If a full card compromise occurs — meaning someone obtains the code along with the other details — it can still be misused. It's one layer of security, not the whole system.

How Merchants Use (and Are Restricted From Storing) the Code

Here's something most cardholders don't know: merchants are prohibited from storing your security code after a transaction is authorized. This rule comes from PCI DSS — the Payment Card Industry Data Security Standard, a set of requirements that any business handling card payments must follow.

That prohibition is precisely why the code retains its value. Your card number might live in a retailer's system for future purchases (with your permission, for stored payment methods), but the security code cannot. Every time you shop with a saved card online, you'll often still be prompted to re-enter the security code — that's not an oversight, it's by design.

Virtual Cards and Digital Wallets — Does the Code Still Apply?

When you use Apple Pay, Google Pay, or similar digital wallets, the security code works differently behind the scenes. These services tokenize your transaction — replacing your actual card details with a one-time code — so the CVV/CVC as printed on your physical card isn't directly transmitted. Security remains intact through a different mechanism.

Some issuers now offer virtual card numbers for online shopping, which come with their own dynamic security codes that change periodically. If your issuer offers this feature, the virtual code functions the same way as the printed one — it just provides an additional layer because it isn't tied to your physical card.

What Affects How and When You're Asked for It

Not every transaction will prompt you for the security code, and that variation can feel inconsistent. A few factors determine when it's requested:

• Transaction type: Card-not-present transactions (online, phone orders) almost always require it. In-person swipe or chip transactions do not.
• Merchant settings: Some merchants opt out of requiring it to reduce checkout friction, accepting the associated risk themselves.
• Recurring billing: Once a subscription is established, the merchant typically processes future charges without re-asking for the code — though they cannot store it, they're authorized to bill the account.
• Fraud triggers: If a transaction looks unusual, additional verification steps (including confirming the code) may be triggered even for merchants that don't normally ask.

When Your Security Code Doesn't Work

If you enter the correct code and a transaction still fails, a few variables could explain it 🛡️:

• The card number or expiration date was entered incorrectly alongside the code
• Your billing address doesn't match what's on file (many merchants run AVS — Address Verification Service — checks simultaneously)
• The card itself has been flagged or temporarily restricted by your issuer
• You're using a virtual card number with its own separate code, not your physical card's code

In most cases, contacting your card issuer directly is the fastest path to identifying the issue.

The Code Is Simple — But Your Card Profile Is More Complex

Understanding what the security code is and how it works is straightforward. It's a verification tool, a fraud deterrent, and a consistent feature across every major card network — just with different names and positions depending on who issued your card.

What varies more significantly from person to person isn't the code itself, but the card carrying it — the issuer's policies, the card's features, the terms attached to your specific account. Those depend entirely on your credit profile, your history with the issuer, and the decisions you've made along the way.