The security code is a three- or four-digit number printed on your card, separate from your account number

The security code (also called CVV, CVC, or card verification value) is a short number that proves you physically hold the card. It appears on the back of most cards as three digits, or on the front of American Express cards as four digits. This number is not encoded in the magnetic stripe or chip — it's printed only on the card itself, which is why online merchants ask for it when you can't swipe or insert the card in person.

The security code serves one purpose: to reduce fraud on card-not-present transactions, like online shopping or phone orders. When you type it in, the merchant sends it to your card issuer to verify. The issuer checks that the number matches their records for your card, but they do not store what you typed — so if a merchant's database is breached, the thief does not get your security code.

Key Takeaways

  • The security code is three digits on the back of Visa, Mastercard, and Discover cards, or four digits on the front of American Express cards.
  • You should never share your security code with anyone by phone or email, and legitimate merchants never ask for it that way.
  • The security code is different from your PIN, which you use at ATMs and in-person at checkout terminals.
  • Merchants cannot store your security code after a transaction, so it does not appear on receipts or statements.

How to locate the security code on your physical card

For Visa, Mastercard, and Discover cards, turn the card over and look at the back. On the right side of the signature panel (the white strip), you will see three digits printed after the full account number. That three-digit number is your security code.

For American Express cards, the security code is four digits and appears on the front of the card, above the account number on the right side. It is smaller than the main account number and sits slightly to the right.

If your card is damaged or the number is worn away, contact your card issuer's customer service line (the number is on the back of your card or on your statement). They can read the security code to you over the phone if you need it for an when ready purchase, or they can issue a replacement card.

When merchants ask for the security code

You will be asked to enter your security code during online checkout, when you order by phone, or when you use a payment app that does not have your card on file. The merchant's payment processor sends this number to your card issuer in real time to verify the transaction. If the number does not match, the transaction is declined.

Some merchants also ask for it when you use a card at a gas pump or ATM, though this is less common. In these cases, the terminal is checking that you have the physical card before dispensing cash or fuel.

You should never be asked for your security code by text, email, or phone call from someone claiming to represent your bank or card issuer. Banks do not contact customers this way to ask for sensitive card information. If someone calls or texts asking for your security code, hang up or delete the message and contact your card issuer directly using the number on your statement.

Security code versus PIN and other card numbers

Your PIN (personal identification number) is a four-digit code you create and use at ATMs and in-person checkout terminals. It is not printed on your card and is known only to you and your bank. The PIN proves you authorized the transaction in person.

Your account number is the long number on the front of your card (usually 15 or 16 digits). This is what identifies your account to the merchant and the card network. Unlike the security code, the account number is encoded in the card's chip and magnetic stripe.

Your expiration date is printed on the front of the card and tells you when the card stops working. Merchants always ask for this during online or phone transactions, along with the security code, to confirm the card is current.

Why merchants cannot keep your security code

Payment card industry rules (called PCI DSS, or Payment Card Industry Data Security Standard) forbid merchants from storing your security code after a transaction completes. This is by design: the code proves you have the physical card, so it is only useful at the moment of purchase. Once the transaction is approved, storing it creates unnecessary risk.

This is why your security code never appears on receipts, email confirmations, or your monthly statement. If you see it printed anywhere after checkout, that merchant is violating the rules and you should report it to your card issuer.

If a merchant's database is breached and your account number is stolen, the thief cannot use it online without the security code — and because the merchant did not store it, the thief does not have it. This is the main reason the security code exists.

What to do if you think your security code was compromised

If you suspect your card information was exposed in a data breach, contact your card issuer when ready using the number on the back of your card or on your statement. You do not need to worry specifically about the security code — if your account number was compromised, the issuer will typically cancel the card and send you a replacement. The new card will have a new security code.

You can also place a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion) if you believe your identity was compromised. A fraud alert tells lenders to verify your identity before opening new accounts in your name. A credit freeze prevents anyone from viewing your credit report without your permission, which stops most identity theft before it starts.

Monitor your statements for unauthorized charges. Most card issuers offer zero-liability protection, meaning you are not responsible for fraudulent transactions if you report them promptly. Report any charge you do not recognize within 60 days of the statement date to preserve your rights.

Frequently Asked Questions

Is the security code the same as my card number?

No. Your card number is the long number on the front (usually 15 or 16 digits). The security code is a separate three- or four-digit number printed on the card but not encoded in the chip or stripe. Merchants use both during online transactions to verify you have the physical card.

Can I use my card online without the security code?

Most online merchants require it, but some do not — especially if your card is already saved in their system or if you are using a digital wallet like Apple Pay or Google Pay. Digital wallets do not transmit your security code to the merchant; the payment processor handles verification instead.

What if I give my security code to someone and they use it fraudulently?

Contact your card issuer when ready. Most issuers offer zero-liability protection for unauthorized charges, so you should not be held responsible. The issuer will cancel the card and send a replacement. Report the fraud within 60 days of the statement date to may support full protection.

Do I need to memorize my security code?

No. You should not memorize it or write it down anywhere. Keep it on the card itself. If you need it for a purchase, look at your physical card. Memorizing it serves no purpose and only increases the risk if someone gains access to your memory or notes.

Why does American Express put the security code on the front?

American Express uses a different card design and chose to print the four-digit code on the front for their own processing reasons. The location does not make it less find — the principle is the same: it proves you have the physical card and cannot be stored by merchants after the transaction.