A card security code is the three- or four-digit number printed on your credit or debit card that verifies you actually have the card when you pay online or over the phone. It’s separate from the long card number on the front and acts as a second proof of possession. Merchants aren’t allowed to store it after a transaction is approved, and federal law caps what you owe if someone uses your credit card without permission at $50, though debit card protections work differently and depend on how fast you report the problem.
Where to Find the Code on Your Card
The location depends on the brand. On Visa, Mastercard, and Discover cards, the code is three digits printed on the back near the signature panel, either at the end of the card number or standing alone to its right. The digits are printed in flat ink rather than raised like the main card number, which is why they can be hard to read on a worn card.
American Express uses a four-digit code on the front of the card, above the account number on the left or right side. If a checkout page asks for a “three-digit code” and you’re using an Amex, or vice versa, the transaction will fail. Check the correct spot for your specific card.
If the digits have scratched off or faded past reading, call your issuer and ask for a replacement. The new card arrives with a freshly printed code, and most online purchases won’t go through without one you can read.
A Merchant Can’t Ask for It in Person
Visa’s rules prohibit merchants from asking for the security code during a card-present transaction, meaning any time you swipe, tap, or insert the card at a physical terminal. They also can’t ask you to write it on a receipt or order form. The code exists for card-not-present situations only, so if a cashier asks for it, something is wrong.1Visa. Visa Core Rules and Visa Product and Service Rules
CVV, CVC, CID: Same Thing, Different Names
Each network uses its own acronym, but they all refer to the printed digits on your card:
- Visa calls it CVV2 (Card Verification Value 2).
- Mastercard calls it CVC2 (Card Validation Code 2).
- American Express and Discover call it CID (Card Identification Digits).
Whatever label a checkout page shows, you type the digits printed on your card.2Visa Acceptance Support Center. Card Verification Number (CVN) Definition
How the Code Verifies an Online Purchase
When you enter the code at checkout, the merchant sends it along with the card number, expiration date, and amount to their payment processor. The processor routes everything through the card network to the bank that issued your card. The bank compares the code you typed against what it has on file. If it matches, the bank approves; if it doesn’t, the bank returns a decline that processors label a “CVV2 Mismatch.” The whole exchange takes a few seconds.3Visa Developer Portal. How to Use Payment Account Validation – Section: Card Verification Value (CVV2) Validation
The point of the design: the code isn’t stored in the magnetic stripe and isn’t kept by merchants after approval. A thief who steals only your card number from a leaked database still doesn’t have what’s needed to complete an online purchase.
Merchants Can’t Save the Code After Approval
The Payment Card Industry Data Security Standard, currently version 4.0.1, forbids any merchant or processor from storing the security code after a transaction is authorized, even in encrypted form. The rule applies no matter the reason and no matter what else the merchant keeps.4PCI Security Standards Council. For PCI DSS, Why Is Storage of Sensitive Authentication Data (SAD) After Authorization Not Permitted If a merchant’s database gets breached, there are no security codes to steal because none were saved.
Merchants are allowed to keep your card number and expiration date on file for subscriptions, memberships, and other recurring billing, but the security code has to be deleted from memory once that first authorization goes through.5PCI Security Standards Council. PCI Data Storage Dos and Donts Later recurring charges are processed without it; the network and issuing bank handle verification through other means.6PCI Security Standards Council. FAQ – Can Card Verification Codes/Values Be Stored for Card-on-File or Recurring Transactions So if a legitimate checkout page asks you to save the code for next time, that’s a red flag.
What You Owe if Someone Uses Your Code
Federal law caps your losses from unauthorized use, but credit cards and debit cards work differently, and the debit side depends on your timing.
Credit Cards
Under the Truth in Lending Act, your liability for unauthorized credit card charges is never more than $50, and only if the issuer met certain conditions such as telling you about the cap and giving you a way to report a lost or stolen card. Once you notify the issuer, you owe nothing for charges made after that.7Office of the Law Revision Counsel. 15 U.S. Code 1643 – Liability of Holder of Credit Card Most major issuers offer zero-liability policies that go beyond the statute, so in practice you often pay nothing.
Debit Cards
Debit card protection under the Electronic Fund Transfer Act is thinner and depends on how quickly you report:
- Report within two business days of learning about the loss or theft: liability capped at $50.
- Report after two business days but within 60 days of receiving the statement showing the fraud: liability up to $500.
- Report after that 60-day window: potentially unlimited liability for unauthorized transfers that happen after the window closes.
The two-business-day clock starts when you learn the card or its details were lost or stolen, not when the fraud itself happened.8GovInfo. 15 U.S. Code 1693g – Consumer Liability Regulation E puts the burden on the bank to prove that faster reporting would have prevented the loss.9Consumer Financial Protection Bureau. Regulation E – 1005.6 Liability of Consumer for Unauthorized Transfers The practical takeaway: debit card fraud has to be reported fast. Same day if you can.
Steps to Take if Your Code Is Compromised
If you see charges you didn’t make or think your card details have leaked:
- Call your card issuer right away using the number on the back of the card or through the bank’s app. Ask them to block the card and send a replacement. For debit cards, speed directly controls how much you can be held responsible for.
- Place a fraud alert with one of the three major credit bureaus (Equifax, Experian, or TransUnion). Whichever one you contact notifies the other two. The alert lasts one year and makes it harder for someone to open new accounts in your name.
- Report the theft at IdentityTheft.gov, which will generate a recovery plan for your situation.
- File a report with local police. A report can help you dispute charges and may be required by your bank or a creditor.10Office of the Comptroller of the Currency. Credit Card and Debit Card Fraud
Digital Wallets and Virtual Cards Replace the Static Code
Newer payment methods sidestep the printed code entirely. When you add a card to a digital wallet like Apple Pay, the issuer creates a device-specific token, a stand-in card number paired with a key that generates a fresh security code for every transaction. Your real card number and the code printed on the card are never sent to the merchant, so a breach on the merchant’s end yields nothing usable.11Apple Support. Apple Pay Security and Privacy Overview Contactless tap-to-pay at a physical terminal works similarly. Mastercard’s contactless specification generates a dynamic CVC3 through the card’s chip for each tap, and the issuing bank checks that one-time code during authorization.12Mastercard. Contactless Toolkit for Acquirers
Many issuers also let you generate a virtual card number, a temporary number with its own expiration and security code, for a single purchase or a limited window. Because the virtual details differ from those on your physical card, the real information stays hidden from the merchant, and a compromised virtual number can’t be reused.13Mastercard Newsroom. Virtual Cards 101 – Simplifying Commercial Payments If your issuer offers virtual numbers, using them for one-off online purchases keeps the printed code on your card out of circulation.