A card identification number is the three- or four-digit security code printed on your credit or debit card that a merchant asks for during online, phone, or mail orders to confirm you actually have the card in hand. Different networks label it differently: Visa calls it a Card Verification Value (CVV), Mastercard calls it a Card Validation Code (CVC), and American Express calls it a Card Identification Number (CID). Whatever the label on the checkout page, the code being requested is the same printed number, and it exists because a merchant who cannot see your card needs some way to tell an account number alone from an account number plus the physical card.
Where To Find the Code on Your Card
On Visa, Mastercard, and Discover cards, the code is three digits printed on the back, near or inside the signature panel. It usually sits just after the last few digits of the account number and is sometimes italicized or offset from the surrounding text.1Discover. What is a CVV Number on a Credit Card?
American Express is the exception. Its four-digit code prints on the front of the card, above and to the right of the main account number.2American Express. What Is A Credit Card CVV? If a checkout page asks for a CVV, CVC, CSC, or CID, it wants this printed number regardless of which term appears.
What the Code Actually Does
The code is designed to protect card-not-present transactions: purchases you make online, over the phone, or by mail, where the merchant cannot physically inspect the card. When you type the code at checkout, the merchant sends it to the card network for verification. If the code does not match the issuer’s records, the transaction is declined.
Two features make the printed code useful. It is not embossed or raised, so it does not transfer to old carbon-copy imprints. And it is not encoded in the magnetic stripe, so a skimmer attached to an ATM or payment terminal captures the account number but not this code.3IBM. How Visa Card Verification Values Are Used Someone who copies your stripe data cannot turn around and use it for online purchases that require the printed code.
Not the Same as Your PIN
Your security code and your PIN are separate. The code is a static number printed on the card that proves possession during remote purchases. A PIN is a secret you memorize and enter at a terminal to authorize debit purchases and ATM withdrawals. PINs are never printed on your card and should never be entered on a website or given to a merchant. Entering your security code at an ATM will not work, and a checkout page asking for the code is not asking for the PIN.
How Security Codes Get Stolen
Because the code is static, a thief who obtains it once can use it repeatedly until the card is replaced. Three routes are common.
Phishing is the most direct. Scammers send emails or texts that look like messages from your bank, a retailer, or a shipping company, then direct you to a fake page that asks you to “verify” your card details, including the code. Legitimate companies do not email or text links asking you to enter payment information.4Consumer Advice (FTC). How To Recognize and Avoid Phishing Scams
Data breaches are the second route. If a merchant’s payment system is compromised at the moment a transaction is being processed, attackers can capture codes before they are cleared from memory. Industry rules bar merchants from storing the code after authorization, which limits how much can be pulled from a database breach after the fact.5PCI Security Standards Council. PCI Data Storage Dos and Donts
Skimming and shimming devices attached to ATMs and payment terminals target stripe and chip data, so they do not directly capture the printed code. They often include hidden cameras or overlay keypads that record your PIN, which is a separate risk.
The practical rule: never share your code except on a checkout page for a purchase you initiated. If someone contacts you and asks for it, even claiming to be your bank, hang up and call the number on the back of the card.
Your Liability If the Code Is Used Without Your Permission
Federal law caps what you owe for unauthorized charges, but the rules differ for credit and debit cards.
Credit Cards
Under the Truth in Lending Act, your liability for unauthorized credit card charges is capped at $50, and you owe nothing for charges made after you notify the issuer.6Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Most major issuers waive even that $50 under zero-liability policies. The cap applies to card-not-present fraud, so a thief using your stolen code online is covered by the same $50 ceiling.7eCFR. 12 CFR 1026.12 – Special Credit Card Provisions
Debit Cards
Debit card liability under the Electronic Fund Transfer Act depends on how quickly you report the problem:8Consumer Financial Protection Bureau. 1005.6 Liability of Consumer for Unauthorized Transfers
- Report within 2 business days of learning of the loss or theft: liability capped at $50.
- Report after 2 business days but within 60 days of receiving the statement: liability capped at $500.
- Report after 60 days: you can be responsible for the full amount of any unauthorized transfers occurring after that 60-day window.
If only the card number and code were stolen and the physical card is still in your possession, you are generally not liable for unauthorized transactions as long as you report them within 60 days of the statement being sent.9GovInfo. 15 USC 1693g – Consumer Liability If circumstances like hospitalization or extended travel delay your reporting, the issuer must extend the deadlines to a reasonable period.
What To Do If Your Card Information Is Compromised
Move quickly, especially with a debit card, where the clock affects your liability.
- Call the number on the back of your card and report the unauthorized charges. The issuer will typically freeze the account and send a replacement with a new number and code.
- For credit cards, send a written dispute to the billing inquiry address (not the payment address) within 60 days of the statement showing the error. Include your name, account number, and a description of the charge.10Consumer Advice (FTC). Using Credit Cards and Disputing Charges
- Consider whether the fraud is part of broader identity theft. The FTC recommends visiting IdentityTheft.gov for additional recovery steps.10Consumer Advice (FTC). Using Credit Cards and Disputing Charges
- If the issuer does not resolve the dispute, report the problem to the FTC at ReportFraud.ftc.gov and to the Consumer Financial Protection Bureau.
Extra Protection Layers Beyond the Printed Code
Because a printed code is static and can be captured once and reused, card networks and issuers have added layers on top of it. The most widespread is EMV 3-D Secure, a protocol that lets your issuer verify your identity in real time during checkout. For routine purchases the check happens invisibly; for higher-risk transactions the issuer may prompt you for a one-time passcode sent to your phone, a biometric scan, or a security question.11EMVCo. EMV 3-D Secure A stolen code alone is much less useful when the thief would also need access to your phone or biometrics.
Some issuers go further with dynamic codes and virtual numbers. A dynamic code refreshes every 30 to 60 minutes or after each use, so a stolen value expires almost immediately. The Apple Card, for example, periodically refreshes the three-digit code shown in the Wallet app. A virtual card number is a temporary account number with its own code that you generate for a single purchase or a single merchant, and it stops working once the transaction is complete. Both approaches ride on the ordinary card network, so merchants process them like any other card-not-present payment. Check your issuer’s app or website to see whether either is available on your account.