A card identification number is the three- or four-digit security code printed on your credit or debit card that proves you have the physical card during online, phone, and mail-order purchases. Card networks use different names for it: Visa calls it a Card Verification Value (CVV), Mastercard calls it a Card Validation Code (CVC), and American Express calls it a Card Identification Number (CID). Whatever the label, checkout pages asking for a CVV, CVC, CSC, or CID all want the same printed code.
Where the Code Is Printed on Your Card
On Visa, Mastercard, and Discover cards, the code is three digits printed on the back, near or within the signature panel, usually right after the last few digits of your account number. It’s sometimes italicized or set apart from the surrounding text.1Discover. What is a CVV Number on a Credit Card?
American Express puts its code on the front. It’s four digits, printed above and to the right of the main account number.2American Express. What Is A Credit Card CVV?
What the Code Actually Protects
The printed code exists to protect card-not-present transactions, meaning purchases where the merchant cannot physically see your card. When you enter it at checkout, the merchant sends it to the card network for verification. If the code doesn’t match the issuer’s records, the transaction is declined. That confirms whoever is placing the order has the card in hand, not just the account number.
The code isn’t embossed on the card surface and isn’t stored in the magnetic stripe, which is why older carbon-copy imprint machines can’t capture it and why skimming devices attached to ATMs and payment terminals can’t harvest it. A thief who copies your stripe data still doesn’t have what they need for an online purchase that asks for the printed code.
Security Code vs. PIN
Your security code and your Personal Identification Number do different jobs in different settings, and mixing them up gets people in trouble. The security code is static, printed on the card, and used for remote purchases to prove you have the card. A PIN is a secret number you memorize and enter at a terminal to authorize debit purchases and ATM withdrawals. PINs are never printed on your card and should never be given to a merchant or entered on a website.
You can’t substitute one for the other. Entering your CVV at an ATM won’t work, and a checkout page asking for your CVV is not asking for your PIN. Keeping them separate contains the damage: a stolen security code alone can’t be used to pull cash from an ATM, and a stolen PIN alone can’t complete an online order.
How Thieves Get Security Codes
The code isn’t in the stripe, so skimmers don’t capture it directly. Thieves get it other ways.
- Phishing. Scam emails and texts pose as your bank, a retailer, or a shipping company and send you to a fake site that asks you to “verify” your card details, including the code. Legitimate companies won’t email or text a link asking you to enter payment information.3Consumer Advice (FTC). How To Recognize and Avoid Phishing Scams
- Data breaches. If a merchant’s payment system is compromised before the code is cleared from memory, attackers can capture codes in transit.
- Overlay cameras and fake keypads. Skimming rigs at ATMs sometimes include hidden cameras or overlay keypads that record what you type, which is how a PIN and card data can be lifted at the same time.
The simplest rule: never share the code except on a checkout page for a purchase you started. If someone contacts you and asks for it, hang up and call the number on the back of your card.
Your Liability if the Code Is Used Without Permission
Federal law limits what you owe when someone uses your card information without your permission, but the rules split by card type.
Credit Cards
Under the Truth in Lending Act, your liability for unauthorized credit card charges caps at $50, and you owe nothing for charges made after you notify your issuer.4Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Most major issuers go further and offer zero-liability policies that waive even the $50. The cap applies to card-not-present fraud, so it covers online misuse of your security code.5eCFR. 12 CFR 1026.12 – Special Credit Card Provisions
Debit Cards
Debit card liability under the Electronic Fund Transfer Act depends on how fast you report the problem.6Consumer Financial Protection Bureau. 1005.6 Liability of Consumer for Unauthorized Transfers
- Within 2 business days of learning about the loss or theft: liability caps at $50.
- After 2 business days but within 60 days of receiving your statement: liability caps at $500.
- After 60 days: you can be responsible for the full amount of unauthorized transfers that occur after the 60-day window.
If only your card number and security code were stolen, not the physical card, and you report the unauthorized transactions within 60 days of the statement being sent, you are generally not liable for those charges.7GovInfo. 15 USC 1693g – Consumer Liability If a delay in reporting was caused by circumstances like hospitalization or extended travel, your issuer must extend the deadlines to a reasonable period.
What to Do If Your Card Information Is Compromised
Move quickly. With a debit card especially, the reporting clock decides how much of the loss falls on you.
- Call the number on the back of your card and report the unauthorized charges. The issuer will typically freeze the card and send a replacement with a new number and new security code.
- Follow up in writing. For credit cards, send a dispute letter to the billing inquiry address, not the payment address, within 60 days of the statement showing the error. Include your name, account number, and a description of the charge.8Consumer Advice (FTC). Using Credit Cards and Disputing Charges
- Check for broader identity theft. Unauthorized charges can be a sign that more of your personal information is out there. The FTC recommends visiting IdentityTheft.gov to review additional steps.8Consumer Advice (FTC). Using Credit Cards and Disputing Charges
- Report the fraud. If your issuer doesn’t resolve the dispute, report the problem to the FTC at ReportFraud.ftc.gov and to the Consumer Financial Protection Bureau.
Dynamic Codes and Virtual Card Numbers
A static three- or four-digit code can be stolen and reused, which is why some issuers now offer codes that change or card numbers that are single-use.
Dynamic CVVs use a small electronic display or a chip-based system that generates a new code periodically, often every 30 to 60 minutes or after each use. Because the code expires quickly, a stolen number becomes useless almost immediately. Apple Card, for example, periodically refreshes the three-digit code shown in the Wallet app.
Virtual card numbers work differently. Your issuer generates a temporary card number, with its own security code, that you use for a single purchase or a specific merchant. Once the transaction is done, the virtual number goes inactive. That’s especially useful for unfamiliar websites, since a later breach of that merchant can’t produce a reusable number. Both options run through the same card-not-present rails as any other online purchase, so merchants don’t need to do anything special. Check your issuer’s app or website to see whether either is available on your account.