The security number is a three- or four-digit code printed on your card that proves you physically hold it
The security number—also called a CVV, CVC, or card verification value—is printed on the back of most credit and debit cards. On American Express, it appears on the front. This number is not encoded in the card's magnetic stripe or chip. It exists only so merchants and payment processors can confirm you have the physical card in your hand when you make an online or phone purchase.
When you enter this number during checkout, the merchant sends it to the card network (Visa, Mastercard, Discover, or Amex) for verification. The network checks that the number matches the card on file. If it does, the transaction moves forward. If it doesn't, the purchase is declined. This step catches many fraudulent transactions because someone who has stolen your card number but not the card itself cannot provide the correct security code.
The security number is different from your PIN, which you use at ATMs and in-person at checkout terminals. It is also different from your card number itself. All three pieces of information serve separate purposes in the payment system.
Key Takeaways
- The security number is a three- or four-digit code that proves you have the physical card, not just the card number.
- You enter it during online and phone purchases; it is not required for in-person transactions or ATM withdrawals.
- The card network verifies the number matches your card on file before approving the transaction.
- Never share your security number with anyone who calls or emails you, even if they claim to be from your bank.
- Merchants are not supposed to store your security number after the transaction completes, which limits the damage if their system is breached.
Where the security number appears and what it looks like
On Visa, Mastercard, and Discover cards, the security number is a three-digit code printed on the back of the card, usually to the right of the signature panel. On American Express cards, it is a four-digit code printed on the front, above the card number on the right side.
The number is printed in raised or flat text, not embedded in the card itself. This means it cannot be read by a card reader or ATM—only by someone looking at the physical card. That is the entire point: it confirms you have the card in your possession.
If your card is damaged or the number is worn away, you can call your bank and they will issue a replacement card with a new security number. The old number will no longer work for online purchases once the new card arrives.
When you need to provide your security number
You provide your security number when you make a purchase online or over the phone. Any time a merchant cannot read your card directly—through a chip reader, magnetic stripe reader, or contactless payment—they will ask for this code as proof you have the card.
You do not need to provide it for in-person purchases at a store or restaurant, because the merchant can read your card directly. You do not need it to withdraw cash from an ATM or to check your balance. You do not need it to set up automatic bill payments from your bank account, because those transactions pull money from your account rather than charging your card.
Some merchants ask for it even when they can read your card—for example, some gas stations ask for a ZIP code or security number as an extra verification step. This is optional; you can decline and use a different payment method if you prefer.
How the security number protects you from fraud
The security number stops a specific type of fraud: someone who has your card number but not your physical card. This might happen if a merchant's database is breached, if your card number is skimmed at a gas pump, or if you receive a phishing email asking for your details. Without the security number, the thief cannot complete an online purchase.
This protection has limits. If a thief has both your card number and your security number—for example, because they stole your physical card or because a merchant stored both pieces of information illegally—the security number does not stop them. If someone calls you claiming to be from your bank and asks for your security number, hang up and call your bank directly using the number on your statement. Your bank will never ask for this code over the phone.
If fraudulent charges appear on your card, report them to your bank immediately. Most banks cover fraudulent charges on debit and credit cards, though the timeline and your liability depend on how quickly you report the fraud and whether the thief had your PIN.
What merchants are allowed to do with your security number
Merchants are not supposed to store your security number after the transaction is complete. Payment card industry rules (called PCI DSS, or Payment Card Industry Data Security Standard) forbid it. This means if a merchant's database is breached, the thief will have your card number but not your security number, limiting what they can do with it.
In practice, some merchants and payment processors break this rule. If you discover that a company stored your security number and that data was breached, report it to your bank and to the Federal Trade Commission. You can file a report at reportfraud.ftc.gov.
Merchants can ask you to provide your security number during checkout, and they can verify it with the card network. But they cannot ask you to write it down, email it, or text it to them. If anyone asks you to share your security number outside of a checkout process, it is a scam.
What to do if your security number is compromised
If you believe your security number has been stolen—for example, because you gave it to a phishing website or because a merchant told you their system was breached—contact your bank immediately. You do not need to wait for fraudulent charges to appear.
Your bank can issue you a new card with a new security number. This usually takes five to ten business days. In the meantime, you can still use your old card number for in-person purchases or set up temporary payment methods for online shopping.
If fraudulent charges have already appeared, report them as soon as you notice them. Under federal law, your liability for unauthorized charges is limited: zero dollars if you report the fraud before any charges post, up to fifty dollars if you report it within two business days of discovering it, and potentially more if you wait longer. Most banks waive your liability entirely, but the faster you report it, the better.
Security numbers versus other card security features
Your card has several security features, and they work together. The chip (if your card has one) encrypts your card number so it cannot be skimmed. The magnetic stripe also encodes your number, though it is easier to copy. The security number adds a third layer: proof that you have the physical card.
Contactless payment (tapping your card instead of inserting it) also uses encryption and does not transmit your security number. Your PIN, used at ATMs and sometimes at checkout, is a separate code that only you should know. None of these replace each other; they all serve different purposes in different situations.
If your card is lost or stolen, call your bank immediately to freeze it. Your bank will cancel the card and issue a new one with a new number and new security code. Until the new card arrives, you can use your bank's app or website to make online payments, or you can use a different payment method.
Frequently Asked Questions
Can someone use my card number without the security number?
They can make in-person purchases if they have a physical card or a cloned card. For online and phone purchases, they cannot complete the transaction without the security number. However, some merchants ask for additional information like your billing ZIP code or expiration date instead of the security number, so it is not a complete barrier.
Is my security number the same as my PIN?
No. Your PIN is a four-digit code you create and use at ATMs and checkout terminals. Your security number is a three- or four-digit code printed on your card that you provide for online and phone purchases. They are separate codes for separate purposes.
What if I forgot my security number?
Look at the back of your card. If the number is worn away or illegible, call your bank and they will read it to you over the phone. You can also see it in your bank's app or online banking portal if they display it there. If you need a replacement card, your bank will issue one with a new security number.
Do I have to give my security number to a merchant?
For online and phone purchases, yes—the merchant needs it to process your card. For in-person purchases, no. If a merchant asks for it in person, you can decline and use a different payment method. Never provide your security number via email, text, or phone call initiated by someone else.
What happens if a website gets hacked and my security number is stolen?
Call your bank immediately and ask them to issue a new card. Merchants are not supposed to store your security number, so if a breach occurs, the thief may have your card number but not your security code. Even if they do, your bank can cancel the old card and issue a new one with a new number and new security code within five to ten business days.