A bank card security code is a three- or four-digit number printed on your card that proves you physically have it
The security code—also called a CVV, CVC, or card verification value—sits on the back of most credit and debit cards. On American Express, it appears on the front. This number is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online or over the phone without also knowing this code.
When you make a purchase online or by phone, the merchant asks for this code as a final check that you own the card. The code never gets transmitted through the same channels as your card number, which is why it adds a real layer of protection. If someone has only your card number and expiration date—information that might appear on a receipt or be captured in a data breach—they still cannot complete most remote transactions without the security code.
Key Takeaways
- The security code is a three- or four-digit number on the back (or front, for American Express) that you must provide for online and phone purchases.
- This code is not encoded in your card's chip or stripe, so a stolen card number alone cannot be used remotely without it.
- Merchants are required to request the code for card-not-present transactions, and payment processors flag transactions that skip this step as higher risk.
- Never share your security code via email, text, or phone call—legitimate companies will never ask for it outside of a secure checkout page.
- If your card is lost or stolen, contact your bank immediately; the security code does not prevent fraud if the physical card is compromised.
Where the security code appears on your card
On Visa, Mastercard, and Discover cards, the security code is a three-digit number printed on the back, usually to the right of the signature panel. On American Express cards, it is a four-digit code printed on the front, above the card number on the right side.
The code is printed, not embedded—it sits only on the physical card itself. This is intentional. Because the number appears nowhere in the card's electronic data, a criminal who intercepts your card number during a transaction cannot extract the security code from that same data stream. They would need to see the actual card or have you tell them the number.
How merchants use the security code to verify your purchase
When you enter your card details on a website or provide them over the phone, the merchant sends your card number, expiration date, and security code to their payment processor. The processor checks the code against the card issuer's records—your bank or credit card company—without revealing the code to the merchant.
If the code matches, the transaction moves forward. If it does not match or is missing, the payment is declined. This verification happens in seconds and is invisible to you. The merchant never sees your actual security code; they only receive a yes or no response about whether it was correct.
This system catches most card-not-present fraud because a thief who has stolen your card number from a data breach or a skimmed transaction typically does not have the physical card and therefore does not have the code. It is one reason why online fraud rates are lower than they would be without this requirement.
The difference between security codes and other card numbers
| Number | What it is | Where it appears | Stored in chip or stripe |
|---|---|---|---|
| Card number | Your 16-digit account identifier | Front of card | Yes |
| Expiration date | Month and year the card expires | Front of card | Yes |
| Security code (CVV/CVC) | Three- or four-digit verification code | Back (or front for Amex) | No |
| PIN | Personal identification number for in-person transactions | Not printed; you create it | No |
Your card number and expiration date are encoded in both the magnetic stripe and the chip, which is why they can be stolen during a compromised in-person transaction or a data breach. Your security code is not encoded anywhere, making it much harder to steal without seeing the physical card.
Your PIN (personal identification number) is also not printed on the card and is known only to you. However, a PIN is used for in-person transactions at ATMs and point-of-sale terminals, while a security code is used for remote purchases—online, by phone, or by mail.
When you should and should not share your security code
You should share your security code only during checkout on a secure website or when making a phone purchase with a merchant you trust. Look for "https://" in the address bar and a padlock icon, which indicate the website is encrypted. When you enter the code, it should go directly into the payment processor's system, not to the merchant's own servers.
Never share your security code via email, text message, or phone call initiated by someone claiming to be from your bank or a company you do business with. Banks and legitimate merchants will never ask for this code outside of an official checkout page or a phone call you initiated yourself. If someone contacts you asking for it, hang up or delete the message and call the company directly using the number on your card or statement.
Scammers often pose as customer service representatives and claim there is a problem with your account. They will ask you to "verify" your security code to resolve it. This is always a scam. Your bank already has your card information on file and does not need you to provide it over the phone.
What to do if your security code is compromised
If you believe someone has seen or written down your security code—for example, if you gave it to someone over the phone and now suspect fraud—contact your bank or card issuer immediately. You can request a new card with a new security code. The old card can be deactivated, and the new one will arrive within 7 to 10 business days in most cases.
If fraudulent charges appear on your account, report them to your card issuer right away. Federal law limits your liability to $50 if you report unauthorized charges within 60 days of the statement date. Many card issuers offer zero-liability protection, meaning you pay nothing for fraudulent charges if you report them promptly. The card issuer will investigate and typically issue a credit within 10 business days while the investigation continues.
If your physical card is lost or stolen, the security code alone will not protect you—call your bank immediately to freeze or cancel the card. A thief with the physical card has access to the security code and can make purchases online or over the phone. Speed matters here; the sooner you report the card missing, the sooner the issuer can stop new transactions.
Why the security code is not a complete fraud solution
The security code reduces card-not-present fraud, but it is not foolproof. If a criminal has your card number, expiration date, and security code—either because they stole the physical card or because they obtained all three numbers from a data breach—they can make purchases online or by phone.
This is why many online retailers now use additional verification methods: two-factor authentication (a code sent to your phone or email), address verification, or 3D Secure (a protocol that redirects you to your bank's website to confirm the purchase). These layers work alongside the security code to catch fraud that the code alone would miss.
For in-person purchases, the security code offers no protection at all. When you insert or tap your card at a store, the merchant never sees or requests the security code. This is why chip technology and contactless payment methods have become standard—they are harder to counterfeit than a magnetic stripe alone.
Frequently Asked Questions
Can someone use my card number without the security code?
Not for most online or phone purchases. Merchants are required to request the security code for card-not-present transactions, and payment processors will decline transactions that are missing it. However, some older or poorly secured merchants may not enforce this requirement, so it is still possible in rare cases.
Is my security code the same as my PIN?
No. Your PIN is a number you create and use at ATMs and in-store terminals. Your security code is printed on the back of your card and is used for online and phone purchases. They serve different purposes and are not interchangeable.
What if I accidentally shared my security code with a scammer?
Contact your card issuer immediately and request a replacement card. Ask them to monitor your account for fraudulent charges over the next 30 to 60 days. If charges do appear, report them right away. You are protected by federal law and most card issuers' zero-liability policies, so you should not be charged for fraud you report promptly.
Do I need to memorize my security code?
No. You only need it when making a purchase, and you should have your physical card in front of you at that moment. Do not write it down or store it anywhere. If you are making a purchase online, enter it directly into the checkout page—never save it to your browser or a password manager.
Why do some websites ask for my security code and others do not?
Larger retailers and well-established payment processors always request it. Smaller merchants or older systems may not have implemented the requirement. Transactions without a security code are flagged as higher risk by payment processors, which is why most modern checkout systems require it.