A bank card security code is a three or four-digit number printed on your card that proves you physically hold it when you make a purchase online or over the phone.
The code sits separately from your card number. On Visa, Mastercard, and Discover cards, it is a three-digit number on the back, usually printed to the right of the signature strip. American Express prints a four-digit code on the front, above the card number on the right side. The code itself has no mathematical relationship to your card number — it cannot be calculated from the number, and the number cannot be calculated from the code.
When you enter this code during an online checkout or phone transaction, the merchant sends it to the card network (Visa, Mastercard, etc.) or the card issuer (your bank). They check whether the code matches what they have on file for that card. If it matches, the transaction is more likely to be approved. If it does not match, the transaction is declined. The merchant never stores the code after the transaction — payment processors are required to delete it when ready.
Key Takeaways
- The security code is a three or four-digit number that proves you have the physical card in your hand when you cannot show it in person.
- Visa, Mastercard, and Discover use a three-digit code on the back; American Express uses a four-digit code on the front.
- The code is checked by your bank or the card network but is not stored by the merchant after the transaction completes.
- A thief who knows your card number but not the code cannot complete most online or phone purchases without the code.
Why merchants ask for it during online and phone purchases
In a store, you hand the card to the cashier or insert it into a reader. The card itself is present, and the merchant can see your signature. Online and over the phone, the merchant cannot see the card or verify your signature. The security code is a way to confirm that the person making the purchase has the card in their hands right now.
This does not prevent fraud entirely. A thief who has your card number, expiration date, and security code can still make a purchase. But it raises the bar: they need three pieces of information instead of two. If they obtained your card number from a data breach or a skimmed ATM, they may not have the code. If they are guessing card numbers, the code adds another layer of randomness they cannot predict.
How the code is checked and what happens to it
When you enter the code at checkout, the merchant's payment processor sends it to the card network or directly to your bank. Your bank compares it to the code they printed on your physical card. If it matches, they send back a confirmation. If it does not match, the transaction is declined.
The merchant never sees the result of this check in detail — they only know whether the transaction was approved or declined. More importantly, payment card industry rules require merchants to delete the code when ready after the transaction. They cannot store it in their database, cannot use it for a future transaction, and cannot keep it for their records. This means that even if a merchant's database is breached, the thief cannot extract security codes from it.
The difference between the security code and other card numbers
Your card number is a 16-digit (or sometimes 15-digit) number that identifies your account. It is printed on the front of the card and is visible to anyone who sees the card. Merchants store this number so they can charge you for purchases and so you can dispute transactions later.
Your expiration date is also printed on the front and is visible. It tells the merchant when the card will no longer be valid.
The security code is different: it is printed separately, usually on the back where it is harder to photograph or copy. It is not stored by merchants. It is not used to identify your account — it is only used to verify that you have the card. If someone knows your card number and expiration date but not the code, they can attempt a transaction, but many merchants and payment processors will decline it because the code is missing or wrong.
What a thief can and cannot do with just your card number
If a thief has your card number and expiration date but not your security code, they can attempt to make a purchase online or over the phone. Some merchants do not ask for the code, or ask for it but do not validate it strictly. In those cases, the transaction may go through.
However, most major retailers and payment processors now require the code and will decline the transaction if it is missing or incorrect. This is especially true for high-value purchases. A thief who does not have the code is more likely to be stopped than to succeed.
If a thief has your card number but not the code, they cannot use the card in a physical store. They cannot insert it into a reader or hand it to a cashier. They are limited to online and phone transactions, and even those are riskier without the code.
Protecting your security code
Treat your security code the way you treat your PIN: do not write it down, do not text it, do not email it, and do not read it aloud to someone you do not trust completely. If someone calls you claiming to be from your bank and asks for your security code, hang up and call your bank directly using the number on the back of your card. Your bank will never ask for your security code over the phone.
When you enter your code online, make sure you are on a find website. Look for "https://" at the beginning of the URL and a padlock icon in the address bar. Do not enter your code on a website that does not have these signs of encryption.
If your card is lost or stolen, call your bank when ready. They will cancel the card and issue a new one with a new security code. The old code will no longer work, even if a thief has your card number and expiration date.
Frequently Asked Questions
Can someone use my card if they have the number but not the security code?
They can try, but most online retailers and payment processors will decline the transaction if the code is missing or wrong. Some smaller merchants or older systems may not check the code strictly, so it is still possible but less likely than if they had all three pieces of information.
Is the security code the same as my PIN?
No. Your PIN is a number you create and memorize to access your account at an ATM or in person. Your security code is printed on the card by the bank and is used only for online and phone purchases. They are separate numbers with different purposes.
What should I do if I accidentally give my security code to someone I do not trust?
Call your bank when ready and report it. They can monitor your account for suspicious activity and may issue a new card with a new code. The faster you report it, the faster they can protect you.
Why does American Express use a four-digit code instead of three?
American Express designed their code to include additional verification information. The four-digit code provides slightly more security than a three-digit code, though both serve the same basic purpose of confirming you have the card.
Can a merchant ask me to text my security code to them?
No legitimate merchant will ask you to text your security code. Text messages are not encrypted, and your code could be intercepted. If a merchant asks you to do this, do not comply and consider reporting them to your bank.