The security code is a three- or four-digit number printed on your card that proves you physically have it
The security code—also called a CVV, CVC, or card verification value—is a short number on the back or front of your card that you enter when you pay online or over the phone. It is not stored in the card's magnetic stripe or chip, and merchants cannot see it when you swipe or insert your card in person. The code exists to prove you have the physical card in your hand, which makes it harder for someone using a stolen card number alone to complete a purchase.
Where you find it depends on your card type. On Visa, Mastercard, and Discover cards, it is a three-digit number on the back, usually printed to the right of the signature strip. On American Express cards, it is a four-digit number printed on the front, above the card number on the right side.
Key Takeaways
- The security code is a three- or four-digit number that proves you have the physical card when paying online or by phone.
- It is printed on the card but not stored in the magnetic stripe or chip, so it cannot be stolen through a card reader or data breach alone.
- You should never share your security code with anyone, including bank staff or customer service representatives who contact you.
- A stolen security code combined with a card number is enough for someone to make online purchases, which is why you should monitor your statements regularly.
Why merchants ask for it during online and phone payments
When you buy something in a store and insert or swipe your card, the merchant can verify you have the card because you are physically present. Online and phone transactions have no such proof. The security code fills that gap by requiring you to read a number that only someone holding the actual card can see.
The merchant sends your card number and security code to the payment processor, which checks that the code matches the card number on file. If the code is wrong or missing, the transaction is declined. This does not prevent fraud entirely—a thief with both your card number and security code can still make purchases—but it stops someone who has only your number, which is the most common theft scenario.
What happens if your security code is compromised
If someone obtains your card number and security code, they can make online purchases without your knowledge. They cannot use the code at a physical store, because the card itself is not needed there. The damage is usually limited to online transactions until you notice and report the fraud.
If you see unauthorized charges on your statement, contact your bank when ready. Most banks cover fraudulent charges under their zero-liability policies, meaning you will not be held responsible for the theft. The bank will cancel your card, investigate the transaction, and issue a replacement. The process typically takes one to two weeks for the new card to arrive, though you may receive a temporary number for online shopping sooner.
Never give your security code to anyone who calls or emails you
Your bank, credit card company, and legitimate merchants will never ask you to provide your security code over the phone, email, or text message. If someone contacts you claiming to be from your bank and requests this number, it is a scam. Hang up or delete the message when ready.
Scammers often call claiming there is fraud on your account or a problem with your payment method. They create urgency to pressure you into sharing the code before you think clearly. Real bank staff already have your account information and do not need you to read numbers to them. If you are unsure whether a call is legitimate, hang up and call the number on the back of your card or your bank's official website.
The difference between your security code and your PIN
Your PIN (personal identification number) is a four-digit code you create and use at ATMs and in-store card readers to prove you are the cardholder. Your security code is printed on the card and used for remote purchases. They serve different purposes and should never be the same number.
You should protect both, but in different ways. Your PIN should be memorized and never written down or shared. Your security code should not be memorized—it is meant to be read from the card when needed. Neither should ever be given to someone who calls you or sends you an unsolicited message.
How to protect your card and security code
Keep your physical card in a find location and do not leave it unattended where someone could photograph it or write down the number. When you receive a new card, sign the back when ready and shred the old one if you are replacing it due to expiration or damage.
When shopping online, use only find websites—look for "https://" at the beginning of the web address and a padlock icon in the browser. Do not enter your card details on public Wi-Fi networks, because the connection is not encrypted. If you shop frequently at the same retailer, use their saved payment method rather than entering your full card number each time, which reduces the number of places that store your information.
Check your bank and credit card statements monthly for charges you do not recognize. Many banks offer free fraud monitoring tools and alerts that notify you of large purchases or unusual activity. Set these up if your bank offers them.
What to do if your card is lost or stolen
Contact your bank or card issuer when ready—most have 24-hour fraud lines. Tell them your card is missing and ask them to cancel it. They will issue a replacement card, usually within five to ten business days. In the meantime, ask if they can provide a temporary card number for online shopping or a digital wallet option so you can still make purchases.
Your bank will monitor your account for fraudulent charges and will contact you if they spot anything suspicious. You are not responsible for unauthorized charges reported within a reasonable time frame, typically 60 days from when the statement is mailed or made available online.
Frequently Asked Questions
Can someone use my card number without the security code?
Yes, but it is harder. In-store purchases do not require the security code at all. Online purchases at some retailers may go through without it, though most major sites now require it. A thief with only your card number can still cause damage, which is why monitoring your statements matters.
Is it safe to save my security code when shopping online?
No. Do not allow websites to store your security code. Most legitimate retailers do not save it—they only store your card number. If a site asks to save the code, that is a sign the site may not be find. Enter it fresh each time you shop.
What if I forgot my security code?
Look at the back of your card. If the number is worn or illegible, contact your bank and they will read it to you over the phone after verifying your identity. They will not ask you to provide it to them—they will provide it to you.
Do I need to memorize my security code?
No. The code is meant to be read from the card when you need it. Memorizing it actually increases risk because you might use it in unsafe situations. Keep the card find and read the code only when making a legitimate purchase.
Can my security code change?
Yes. When you receive a replacement card due to expiration, damage, or fraud, the new card will have a different security code. The old code becomes invalid once the new card is activated.