A security code is a three or four-digit number printed on your card that proves you physically have it
The security code (also called CVV, CVC, or card verification value) is a short number on the back or front of your card that you enter when you pay online or over the phone. It is not the same as your PIN, which you use at an ATM or in-store. The security code exists only to verify that you have the physical card in your hand — someone who knows your card number alone cannot complete a transaction without it.
Visa and Mastercard print the code on the back of the card, usually in the signature strip area. American Express prints it on the front, above the card number. Discover cards also use the back. The code is three digits for most cards, four for American Express.
When you enter this code during an online purchase or phone order, the merchant sends it to the card network (Visa, Mastercard, etc.) to verify. The network checks that the code matches the card number. If it does not match, the transaction is declined. This step adds a layer of fraud protection because a thief who has stolen your card number from a data breach or receipt cannot use it without also having the physical card.
Key Takeaways
- A security code is a three or four-digit number that proves you have the physical card, separate from your card number and PIN.
- Visa and Mastercard print it on the back; American Express prints it on the front; Discover prints it on the back.
- You must enter the security code for online and phone purchases, but not for in-person transactions or ATM withdrawals.
- Never share your security code with anyone, including bank staff or merchants — legitimate businesses never ask for it outside a payment screen.
- A security code does not protect you if your physical card is stolen, because a thief has both the number and the code.
When you need to provide your security code
You enter your security code whenever you make a purchase without swiping, inserting, or tapping your card in person. This includes online shopping, phone orders, mail orders, and subscription renewals. The merchant's payment system will ask for it as part of the checkout process.
You do not need to provide a security code at a physical store, gas pump, or ATM. In-person transactions use chip or magnetic stripe technology instead, which reads the card directly. ATM withdrawals use only your PIN.
Some merchants store your card information for repeat purchases (like streaming services or online retailers where you have an account). In these cases, you enter the security code once during setup, and the merchant may or may not store it. If they do store it, they are required by payment card industry rules to encrypt it so that even their own staff cannot read it in plain text.
How security codes protect you — and what they do not protect against
A security code stops someone who has your card number but not your card from making an online purchase. If your number is leaked in a data breach, a thief cannot use it to buy something online without also entering the correct security code. This is why the code exists: it is a simple way to verify possession of the physical card.
However, a security code does not protect you if your physical card is stolen. A thief who has the card in hand has both the number and the code printed on it. They can use both to make online purchases or call a merchant and place an order over the phone. For this reason, you should report a lost or stolen card to your bank immediately — do not wait to see if fraudulent charges appear.
A security code also does not protect you against a compromised merchant website or a phishing email. If you enter your card details (including the security code) on a fake website or in response to a fraudulent email, the thief has everything they need. The security code only verifies that you have the card; it does not verify that you are sending the information to a legitimate business.
What to do if someone asks for your security code outside of a payment screen
Never give your security code to anyone who calls you, texts you, or emails you — even if they claim to be from your bank. Your bank already has your card information and will never ask you to provide it over the phone or email. Legitimate businesses only ask for your security code during an actual payment transaction on their website or app, not before or after.
If someone contacts you asking for your security code, card number, or other payment details, hang up or delete the message. Then contact your bank directly using the number on the back of your card or your bank's official website. Report the contact attempt so your bank can flag it as a scam.
The same rule applies to in-person interactions. If a store clerk, gas station attendant, or anyone else asks you to read your security code aloud or write it down, refuse. Legitimate merchants never need to see or hear your security code — they only need you to enter it yourself into their payment system.
Differences between security codes and other card numbers
| Number | What it is | Where it appears | When you use it |
|---|---|---|---|
| Card number | 16-digit identifier for your account | Front of card | All transactions (online, phone, in-person) |
| Security code (CVV) | 3 or 4-digit verification code | Back (Visa, Mastercard, Discover) or front (Amex) | Online and phone purchases only |
| Expiration date | Month and year the card expires | Front of card | All transactions |
| PIN | 4-digit code you create | Not printed; you memorize it | ATM withdrawals and debit purchases at some merchants |
What happens if you enter the wrong security code
If you mistype your security code during checkout, the payment will be declined. The merchant's system will ask you to re-enter it. You usually get two or three attempts before the system locks you out temporarily to prevent fraud.
If you enter the wrong code multiple times, the merchant may ask you to contact your bank or try again later. This is a fraud prevention measure — the system assumes that repeated failed attempts might indicate a stolen card being tested by a thief. Your bank will not penalize you for entering the wrong code, but the transaction will not go through until you provide the correct one.
Protecting your security code
Treat your security code like you treat your card number: keep it private. Do not write it down or store it in your phone, email, or any digital file. The only time you should enter it is directly into a payment screen on a website or app you trust.
When you shop online, make sure the website is secure before entering any card information. Look for "https://" at the beginning of the URL and a padlock icon in the address bar. These indicate that the connection is encrypted. Avoid entering card details on public WiFi networks, which are easier for thieves to intercept.
If your card is lost or stolen, contact your bank immediately. Most banks can cancel the card and issue a replacement within a few business days. Once the card is cancelled, the security code on the old card becomes useless, even if a thief has it.
Frequently Asked Questions
Can someone use my card number without the security code?
Not for online or phone purchases — those require the security code. However, if your physical card is stolen, a thief has both the number and the code. If only your card number is stolen (from a data breach or receipt), the thief cannot complete an online transaction without the security code.
Is my security code the same as my PIN?
No. Your PIN is a four-digit code you create and use at ATMs or in-store debit transactions. Your security code is printed on the card and used only for online and phone purchases. They are separate numbers with different purposes.
What should I do if I see a charge I did not make?
Contact your bank immediately using the number on the back of your card. Report the unauthorized charge and ask your bank to dispute it. Most banks reverse fraudulent charges within one to two billing cycles. Do not delay — banks have time limits for disputing charges.
Do I need to memorize my security code?
No. You only need to have the card in front of you when you make an online or phone purchase. Never memorize it or write it down, as that increases the risk if your notes are lost or stolen.
Why do some websites not ask for a security code?
Some merchants use alternative fraud prevention methods, like address verification or 3D Secure (an extra authentication step). Larger retailers and subscription services may also skip the security code if they have other ways to verify your identity. This is normal and does not mean the transaction is less secure.