A guide to credit card security codes: What they are and why it matters

Apr 21, 2020

This post contains references to products from one or more of our advertisers. We may receive compensation when you click on links to those products. Terms apply to the offers listed on this page. For an explanation of our Advertising Policy, visit this page.

If you’re online shopping and get to the final steps, you know what’s coming next — entering your credit card information to process the order. But besides entering a card number and expiration date, you probably will have to enter a security code — a feature on every credit card meant to help verify the card is in your possession.

These three or four-digit numbers provide an additional layer of security when you make purchases online or over the phone. Here is what you need to know about credit card security codes, and how to find them by issuer.

Want more credit card news and travel advice from TPG? Sign up for our daily newsletter.

What is the credit card security code

credit card CVV2 code. online payments security. man holding plastic cards. Courtesy of golubovy via Getty Images.
(Photo by Golubovy/Getty Images)

A credit card security code, or CVV code, is a security code that’s completely unique to your card. When you provide your security code to a retailer, along with your credit card number and card expiration date, the information is instantly sent to the card issuer for authentication. Once that is accepted, your transaction will go through. This entire process usually just takes a few seconds.

Credit card security codes also go by a few other names:

  • CVV: Card Verification Value
  • CVV2: Card Verification Value 2 (Visa)
  • CVC: Card Verification Code (MasterCard)
  • CVC2: Card Validation Code 2 (MasterCard)
  • CVD: Card Verification Data (Discover)
  • CID: Card Identification Number (Discover and American Express)
  • CSC: Card Security Code (American Express)

The credit card security code is a safeguard against potential fraud and theft. If someone was able to get a hold of your credit card number via skimming or other means, they’d be out of luck at most websites that require a security code to make a purchase. Essentially, the code is designed to indicate the card is in your possession.

Related reading: Protect yourself from credit card skimmers

Where to find the security code by issuer

The length and location of each credit card security code are dependent on your issuer. Here is a snapshot:

Issuer Security Code Length Where to Find the Code Common Names for Security Codes
Visa 3 number Back of the card Card Verification Value 2 (CVV2)
Mastercard 3 numbers Back of the card Card Verification Code (CVC), Card Validation Code 2 (CVC2)
American Express 4 numbers Front of the card Card Identification Number (CID), Card Security Code (CSC)
Discover 3 numbers Back of the card Card Verification Data (CVD), Card Identification Number (CID)

For Visa, Mastercard, and Discover cards, the security code is three digits long. These issuers have the security code on the back of your card, to the right of the signature panel. Before the code, you might see part or all of your credit card account number.

For American Express cards, the security code is four digits long. It appears on the front of your card, usually to the upper right of your card account number.

Related reading: How I learned that my credit card number was stolen

Why security codes are important

Beyond protection against theft, card security codes provide another function too — data breach security. With so many breaches and hacks occurring in recent years, this is a particularly sensitive matter.

While companies may save your credit card number, industry regulations prevent them from storing your CVV code, which means would-be hackers wouldn’t be able to seize that data. That is also why even if you request that a company save your payment information to make future purchases online easier, you’ll still have to enter your security code at checkout each time.

Related reading: Credit card fraud: How to spot and report it

Websites can store your card information but not your security code
Websites can store your card information, but not your security code.

What to do to protect your security code

Protecting your credit card security code is similar to protecting any other financial or personal information. A bank or other financial institution will almost never ask you for your CVV code over email or over the phone. Sensitive financial information should be ideally sent through secure channels only. That means don’t click on links or reply to emails directly asking you to verify your account number and CVV code (aka phishing scams).

Related reading: 6 tips for keeping your credit card safe online

Similarly, while a retailer may require you to provide a credit card security code when making a purchase, don’t be fooled by spoof calls or impersonators trying to gain access. Only shop on secure websites that have an “https://” in the URL — that “s” stands for secure and your information will be encrypted.

The best way to spot credit card fraud is to monitor your card account frequently for unfamiliar charges. It’s best to do this throughout the month so you can catch any unfamiliar charges quickly. At a bare minimum, you should review the charges on your billing statement every month before paying your balance.

Bottom line

Even though credit cards have plenty of security protection like with security codes, it’s important to be mindful of where you’re purchasing items and to check your statements periodically. Security codes are a safeguard for consumers, and it’s helpful to know what and where they are if you need to share them.

Related reading: How to choose the right credit card for you

Featured photo by Shutterstock.

Editorial Disclaimer: Opinions expressed here are the author’s alone, not those of any bank, credit card issuer, airlines or hotel chain, and have not been reviewed, approved or otherwise endorsed by any of these entities.

Disclaimer: The responses below are not provided or commissioned by the bank advertiser. Responses have not been reviewed, approved or otherwise endorsed by the bank advertiser. It is not the bank advertiser’s responsibility to ensure all posts and/or questions are answered.