A card security code is the three- or four-digit number printed on your credit or debit card that proves you physically have the card when you’re buying something online or by phone. It’s separate from the long card number on the front, and it works as a second check that the person entering the details is the real cardholder. If someone else uses it, federal law caps your liability at $50 on a credit card, and on a debit card your exposure depends on how fast you report the problem.
Where to Find It on Your Card
The location depends on who issued the card. Visa, Mastercard, and Discover print a three-digit code on the back, near the signature panel, usually at the end of the card number or standing alone to the right of it. The digits are flat-printed rather than raised, so they can be hard to read on a worn card.
American Express uses a four-digit code, and it sits on the front of the card above the account number, on either the left or right side. If a checkout page asks for your code and you enter a three-digit number from the back of an Amex card, the transaction will fail. Make sure you’re looking at the right spot for your brand.
If the digits on your card are scratched or faded past the point of reading, call your issuer and ask for a replacement. The new card arrives with a fresh code printed on it. Most online purchases won’t go through without a readable code, so don’t wait.
What the Different Names Mean
Each network has its own acronym, but they all refer to the same printed digits:
- Visa calls it the Card Verification Value 2, or CVV2.
- Mastercard calls it the Card Validation Code 2, or CVC2.
- American Express and Discover call it the Card Identification Digits, or CID.
The “2” in CVV2 and CVC2 separates the printed code from a different value encoded inside the magnetic stripe, which you never see or type. Whatever label the checkout page uses, you enter the digits printed on your card.1Visa Acceptance Support Center. Card Verification Number (CVN) Definition
How It Protects Online Purchases
When you type the code into a checkout page, the merchant forwards it with your card number, expiration date, and the amount to a payment processor. The processor sends everything through the card network to the bank that issued your card. The issuing bank compares the code you entered against what it has on file. A match returns an approval; a mismatch returns a decline, which processors label a CVV2 Mismatch. The whole exchange takes a few seconds.2Visa Developer Portal. How to Use Payment Account Validation – Section: Card Verification Value (CVV2) Validation
The code is not embedded in the magnetic stripe, and merchants aren’t allowed to keep it after a sale. That means a thief who steals a batch of card numbers from a hacked database still can’t finish an online purchase, because the code isn’t in the file they stole. It’s designed to confirm the card is in your hand at the moment of the order.
Why Merchants Can’t Store It or Ask for It In Person
The Payment Card Industry Data Security Standard, currently version 4.0.1, flatly bars any merchant or processor from storing the security code after a transaction is authorized, even in encrypted form.3PCI Security Standards Council. For PCI DSS, Why Is Storage of Sensitive Authentication Data (SAD) After Authorization Not Permitted Merchants can hold your card number and expiration date for subscriptions and recurring billing, but the code has to be deleted from their systems the moment the first charge clears.4PCI Security Standards Council. PCI Data Storage Dos and Donts Recurring charges after that go through without the code.5PCI Security Standards Council. FAQ – Can Card Verification Codes/Values Be Stored for Card-on-File or Recurring Transactions
Visa’s rules also prohibit merchants from asking for the code during an in-person transaction. If you’re swiping, tapping, or inserting your card at a physical terminal, no one should be asking you to read off or write down the code on a receipt or order form. The code exists for online checkouts and phone orders only.6Visa. Visa Core Rules and Visa Product and Service Rules
Your Liability if Someone Uses Your Code
Federal law limits what you can lose if someone uses your card without permission, but credit and debit cards follow different rules.
Credit Cards
Under the Truth in Lending Act, your liability for unauthorized credit card charges can never exceed $50, and that cap applies only if your issuer has met certain conditions, including notifying you of the limit and giving you a way to report the card lost or stolen. Once you tell the issuer, you owe nothing for anything charged afterward.7Office of the Law Revision Counsel. 15 U.S. Code 1643 – Liability of Holder of Credit Card Most major issuers voluntarily go further with zero-liability policies, so in practice you often pay nothing at all.
Debit Cards
Debit card protection under the Electronic Fund Transfer Act is weaker and depends on how fast you report:
- Report within two business days of learning about the loss or theft, and your liability is capped at $50.
- Report after two business days but within 60 days of receiving your statement, and your liability can reach $500.
- Wait longer than 60 days from the statement date, and you can face unlimited liability for unauthorized transfers that happen after that window closes.
The two-business-day clock starts the moment you learn the card or card details were lost or stolen, not when the fraud actually happened.8GovInfo. 15 U.S. Code 1693g – Consumer Liability Regulation E, which implements the statute, repeats those tiers and places the burden on the bank to show that the unauthorized transfers would not have happened if you had reported sooner.9Consumer Financial Protection Bureau. Regulation E – 1005.6 Liability of Consumer for Unauthorized Transfers
Because of this timing structure, reporting debit card fraud quickly matters far more than it does with credit cards. If something looks wrong, call your bank the same day.
What to Do if Your Code Is Compromised
If you spot unauthorized charges or have reason to think your card details have been exposed, work through these steps:
- Call your card issuer immediately. Use the number on the back of your card or your bank’s app. Ask for the card to be blocked and a replacement sent. For debit cards especially, speed is what keeps your liability low.
- Place a fraud alert on your credit reports. Contact any one of Equifax, Experian, or TransUnion, and that bureau will pass the alert to the other two. A fraud alert lasts one year and makes it harder for someone to open new accounts in your name.
- File a report with the FTC at IdentityTheft.gov. The site walks you through a recovery plan tailored to what happened.
- File a local police report. A report can help you dispute fraudulent charges, and some banks or creditors require one.
On a credit card, federal law holds you to no more than $50 in unauthorized charges, and most issuers waive even that. On a debit card, acting within two business days keeps your maximum loss at the same $50.10Office of the Comptroller of the Currency. Credit Card and Debit Card Fraud
Newer Alternatives That Replace the Printed Code
Some payment methods have moved away from a static printed code. When you add a card to a digital wallet like Apple Pay, the issuer creates a device-specific token in place of your real card number, along with a key that produces a new security code for every transaction. Your actual card number and printed code are never sent to the merchant, so a breach at the merchant’s end has nothing useful to leak.11Apple Support. Apple Pay Security and Privacy Overview Contactless tap-to-pay works on a similar principle: Mastercard’s contactless specification uses the chip in the card to generate a one-time CVC3 code for each tap, and the issuing bank verifies that code during authorization.12Mastercard. Contactless Toolkit for Acquirers
Many banks also offer virtual card numbers, which are temporary card numbers with their own expiration dates and security codes that you can use for a single purchase or for a limited time. Because the virtual number is not your real card, the merchant never sees your actual details, and if the virtual number leaks, it can’t be reused.13Mastercard Newsroom. Virtual Cards 101 – Simplifying Commercial Payments If you shop at a lot of unfamiliar sites, generating a virtual number is one of the strongest ways to keep your printed code out of circulation in the first place.