A card code is the short security number printed on your credit or debit card — usually three digits on the back, four on the front for American Express — that a website or phone operator asks for to confirm you actually have the card in hand. Because the code is printed, not stored on the magnetic stripe or chip, someone who only has your account number from a receipt or a data breach cannot supply it. That is the whole point of the code: it separates people who have your card from people who only have your number.
Where to Find the Code on Your Card
The location depends on the network. On Visa, Mastercard, and Discover cards, the code is a three-digit number printed on the back, at the end of or just to the right of the signature panel.1Pay.gov. Card Security Code It often sits in italics or in a slightly different font from the numbers around it.
American Express is the exception. Its code is four digits, printed on the front of the card, above and to the right of the 15-digit account number.1Pay.gov. Card Security Code Because it is longer, some checkout forms that only accept three digits are built for the other networks; a well-designed site will show a four-digit field once it recognizes an Amex card number.
The code is printed in ink rather than embossed, so it can fade with heavy use. If yours has become unreadable, call your issuer and request a replacement card. The new one will carry a new code, and you should destroy the old card once the replacement is active. Until it arrives, online purchases that require the code may not go through.
What the Code Is Called at Checkout
Every network brands the same number differently, and checkout pages vary in what they call the field:
- Visa: Card Verification Value (CVV2)
- Mastercard: Card Validation Code (CVC2)
- American Express: Card Identification Digits (CID)
- Discover: Card Identification Digits (CID)
You will also see generic labels like “security code,” “card security code,” or “CSC.” Regardless of the wording, the merchant is asking for the printed number described above.2Visa Acceptance Support Center. Card Verification Number (CVN)
The card code is not your PIN. Your PIN authorizes in-person debit purchases and ATM withdrawals; the card code only comes into play when the card itself cannot be swiped, tapped, or inserted.
How the Code Works During a Purchase
When you type the code into a checkout page or read it to someone over the phone, the merchant sends it with your other card details to the bank that issued the card. The bank checks the code against its own records and sends back a one-letter result: match, no match, or unable to verify.
If the code does not match, the bank will usually decline the purchase, even when the card number, expiration date, and billing address are all correct. A wrong code — even a typo — reads as a fraud signal, so double-check the digits before you submit.
Why Merchants Are Not Allowed to Save It
The Payment Card Industry Data Security Standard, which every business that takes card payments has to follow, forbids merchants and their service providers from storing your card code after the transaction is authorized. Not on paper, not in a database, not even encrypted.3PCI Security Standards Council. For PCI DSS, Why Is Storage of Sensitive Authentication Data (SAD) After Authorization Not Permitted The rule exists so that a thief who breaks into a merchant’s system finds account numbers without the codes that make those numbers easy to reuse online.
This is also why a subscription service or a store where you save your card on file does not ask for the code every month. The first successful check is enough; storing the code to re-run it later is not allowed.3PCI Security Standards Council. For PCI DSS, Why Is Storage of Sensitive Authentication Data (SAD) After Authorization Not Permitted
What You Owe If Someone Uses Your Code Without Permission
Federal law caps your liability for unauthorized card use, but credit and debit cards are treated very differently.
Credit Cards
Under the Fair Credit Billing Act, the most you can be held responsible for on a credit card is $50. When only your card number and code were used — the physical card was never lost or stolen — most issuers waive even that.4Office of the Law Revision Counsel. 15 U.S. Code 1643 – Liability of Holder of Credit Card
Debit Cards
Debit card liability under the Electronic Fund Transfer Act depends on when you report the problem:
- Report within two business days of learning about the fraud, and your liability is capped at $50.
- Report after two business days but within 60 days of your statement, and your liability can climb to $500.
- Wait more than 60 days from your statement, and you could be on the hook for the full amount of any unauthorized transfers that happen after the 60-day window, if the bank can show earlier notice would have stopped them.
Hospitalization, extended travel, and similar circumstances that keep you from reporting on time require the bank to extend these deadlines to a reasonable period.5Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability The gap between the two rules is a common reason to use a credit card rather than a debit card for online purchases.
What to Do If Your Code Has Been Exposed
If you get a data breach notice, see a charge you don’t recognize, or realize you handed your details to a phishing site, act quickly. How fast you call your bank affects both what gets refunded and, for debit cards, what you legally owe.6Consumer Financial Protection Bureau. Four Steps You Can Take if You Think Your Credit or Debit Card Data Was Hacked
- Look through recent transactions in your bank’s app, including small ones. Thieves often test a stolen number with a small charge before running a bigger one.
- Call your issuer, report anything you didn’t authorize, and ask them to cancel the card. They will send a replacement with a new number and a new code. Follow up in writing.
- Turn on transaction alerts if your bank offers them. Fraudulent charges can surface weeks or months after a breach.
- If a debit card was involved, change your PIN too, even if you have no evidence the thief has it.
Codes That Change: Dynamic and Virtual Options
The printed code on a normal card never changes. Two newer options address that.
Some banks issue cards with a dynamic code that refreshes every 12 to 24 hours, either on a small electronic display on the back of the card or inside the bank’s app.7National Cyber Security Centre. Insight: The Codes They’re A-Changin’ A code a thief captures today is worthless tomorrow.
Virtual card numbers go further: your issuer generates a separate card number, sometimes unique to a single merchant, that you use online while your real account number stays hidden. If the retailer’s system is breached, the exposed number cannot be used anywhere else.8Capital One. What Are Virtual Credit Card Numbers and How Do They Work One catch: if a merchant asks to see your physical card at pickup, the number on the card won’t match the one on the order, which can cause friction at the counter.