The card code on your credit or debit card is the short security number printed on the card’s surface — three digits on the back for Visa, Mastercard, and Discover, or four digits on the front for American Express. Its job is narrow and useful: to prove during an online or phone purchase that you have the physical card in your hand, not just its account number.
Because the printed code is separate from the data stored on your card’s magnetic stripe or chip, someone who captures your card number from a data breach or a stolen receipt still can’t complete most remote purchases without it.1American Express. What Is a CVV?
Where to Find the Card Code
The location depends on which network issued your card.
On Visa, Mastercard, and Discover cards, the code is a three-digit number printed on the back, usually at the end of or just to the right of the signature panel. It’s often set in italics or a slightly different font from the surrounding text.2Pay.gov. Card Security Code
On American Express cards, the code is four digits and appears on the front, above and to the right of the 15-digit account number.2Pay.gov. Card Security Code If a checkout form only accepts three digits, it likely hasn’t detected an American Express number yet; entering the card number first usually triggers a four-digit field.
The code is printed in ink rather than embossed, so it can fade with regular use, especially on the signature panel. If yours becomes unreadable, contact your issuer for a replacement card. The new card will arrive with a fresh code, and online purchases that require the code may be blocked until it does.
The Other Names You’ll See at Checkout
Every network brands its code differently, but they all do the same thing:
- Visa calls it the Card Verification Value (CVV2).
- Mastercard calls it the Card Validation Code (CVC2).
- American Express and Discover both use Card Identification Digits (CID).
You’ll also see generic labels like “security code,” “card security code,” or “CSC” on many checkout pages. Whatever the wording, the merchant is asking for the same printed number.3Visa Acceptance Support Center. Card Verification Number (CVN)
One boundary worth naming: the card code is not your PIN. Your PIN authorizes in-person debit purchases and ATM withdrawals. The card code is only used for transactions where the card itself can’t be swiped, tapped, or inserted.
How the Code Works When You Pay
When you type the code into an online form or read it to someone over the phone, the merchant sends it along with the rest of your card details to your issuing bank. The bank compares what you provided against the value it has on file and returns a short result telling the merchant whether the code matched.
If it doesn’t match, the bank will typically decline the transaction, even when the card number, expiration date, and billing address are all correct. A mismatched code is treated as a strong sign of fraud, which is why an accidental typo can block a purchase you’re legitimately trying to make. Check the code carefully before assuming the card itself has a problem.
Why No Merchant Should Store Your Code
The Payment Card Industry Data Security Standard (PCI DSS), which every business that accepts card payments must follow, prohibits merchants and service providers from storing your card code after a transaction is authorized. That applies even to encrypted storage.4PCI Security Standards Council. For PCI DSS, Why Is Storage of Sensitive Authentication Data (SAD) After Authorization Not Permitted
The point is damage control: if a hacker breaches a merchant’s database and pulls out stored card numbers, those numbers are much harder to use for remote fraud without the matching code. This is also why “card on file” services for recurring billing don’t ask you to re-enter the code every month — the code is verified once at setup and never kept.4PCI Security Standards Council. For PCI DSS, Why Is Storage of Sensitive Authentication Data (SAD) After Authorization Not Permitted
If Someone Steals Your Card Number and Code
Federal law caps how much you can be held responsible for when someone uses your card without permission, but the rules differ sharply between credit and debit cards.
Credit Cards
Under the Fair Credit Billing Act, your maximum liability for unauthorized credit card charges is $50. When only your card number and code were stolen — not the physical card — most issuers won’t hold you liable for anything.5Office of the Law Revision Counsel. 15 U.S. Code 1643 – Liability of Holder of Credit Card
Debit Cards
Debit card liability under the Electronic Fund Transfer Act depends on how quickly you report the problem:
- Report within two business days of learning about the fraud, and your liability is capped at $50.
- Report after two business days but within 60 days of your statement, and you can be liable for up to $500.
- Wait longer than 60 days from your statement, and you could be responsible for the full amount of unauthorized transfers that happen after that 60-day window, if the bank can show earlier reporting would have prevented them.
Extenuating circumstances such as hospitalization or extended travel require the bank to extend these deadlines to a reasonable period.6Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability The gap between credit and debit protections is one reason many advisers recommend using a credit card for online purchases.
Steps to Take Right Away
If you suspect your card number and code have been captured — through a breach notice, a suspicious charge, or a phishing message — move quickly:
- Log into your bank’s app or website and review recent transactions, including small ones. Thieves often test a stolen number with a minor purchase before attempting a larger charge.
- Call your card issuer to report any charges you don’t recognize and to cancel the compromised card. The replacement will have a new number and a new code. Follow up in writing and keep a copy.
- Turn on transaction alerts if your bank offers them, and keep watching your statements. Fraudulent charges can surface weeks or months after the original breach.
- If a debit card was involved, change your PIN even if you have no direct evidence the thief obtained it.
Reporting speed isn’t just good hygiene. For a debit card, it directly determines how much of the loss you’re on the hook for.7Consumer Financial Protection Bureau. Four Steps You Can Take if You Think Your Credit or Debit Card Data Was Hacked
Codes That Change and Numbers That Aren’t Really Yours
The printed code that came with your card is static: the same digits stay on the card for its entire life. Some issuers now offer alternatives that shrink the window during which a stolen code is useful.
Dynamic card codes refresh automatically, often every 12 to 24 hours. On some physical cards, a small electronic display on the back replaces the printed digits and updates on its own. More commonly, the dynamic code lives inside your banking app — you open the app and read a fresh code whenever you need one. A code a thief captures expires within hours.8National Cyber Security Centre. Insight: The Codes They’re A-Changin’
Virtual card numbers go further, giving you a substitute account number to use online so the merchant never sees your real one. Some issuers offer a single virtual number for all online use; others let you generate a separate number for each store, which becomes useless anywhere else if that retailer is later breached.9Capital One. What Are Virtual Credit Card Numbers and How Do They Work The trade-off shows up when a merchant asks to see the physical card at pickup: the number on the plastic won’t match the number on the order.