What is a CVV code and how do you find yours?

It doesn’t matter what you call them – a card security code (CSC), card verification value (CVV or CV2), card verification code (CVC) or even a card code verification (CCV) – those three or four digits provide an additional measure of credit card security when you make purchases online, by mail or over the phone. But finding them can be confusing, especially if you’ve never made an online purchase with that specific card.

The card security code “is one in a series of steps that merchants can take to prevent fraud and verify that the order is being placed by the actual cardholder,” said Matthew Towson, director of community affairs for Discover Financial Services, adding that in most cases, the only way for a cardholder to provide the security code is to actually be in possession of the card.

Keep reading to find out everything you need to know about a credit card CVV – and where to find yours when you need it.

What is a credit card CVV?

A credit card security code helps protect you (and the business or nonprofit that’s processing your payment) from scammers, and most charge cards and debit cards also have one.

Security codes aren’t as vulnerable as credit card numbers to data breaches and theft because service providers and merchants aren’t supposed to store them in their systems. The only place they appear is directly on the physical card.

So when a retailer asks for your security code, they’re essentially asking for proof you have the card in your possession.

See related: Credit card fraud and ID theft statistics

Why your security code is so important

Card-not-present fraud has soared in recent years as point-of-sale payments in the U.S. become more secure and e-commerce grows more popular. The dramatic rise in massive data breaches has also helped fuel the digital fraud boom.

Asking for your code is one of the few significant defenses that online merchants have against processing a fraudulent payment. Although cardholders typically benefit from their issuers’ zero-liability policies, merchants are often hit hard by card-not-present fraud. Unlike in-store card transactions, merchants are typically held liable for online fraud.

Even security codes aren’t 100% fraud-proof since a scammer can still get your card’s security code without your knowledge by manually copying it down or by breaking into a database that’s improperly storing your information.

But in general, it’s much harder for thieves to access a card’s security code than your card number or other data. Since the number is only printed on the face of the card, it’s also protected from other forms of card fraud, such as skimming the card’s magnetic stripe or shimming its chip.

Where to find the security code

Here’s where to look when you’re searching for your card’s security code:

• If you own a Visa card, you’ll typically find your three-digit CVV or CVV2 code on the back of your card, on the far right of your signature or just above it. Some issuers will even add a “security code” label just under the three-digit number.
• If you own a Discover card, the three-digit CVD code will appear on the back of your card on the far right-hand side of your signature.
• If you’re using a Mastercard, you’ll also find your card’s CVC or CVC2 code on the right-hand side of the signature box.
• If you’re using an American Express card, you’ll find your four-digit CID number on the front of your card on the far right-hand side. Look for it above your card numbers.

The codes are an important safety measure for online transactions

Even as the U.S. payment system continues its migration to chip-equipped EMV cards, security codes will still be printed and used the same way they are now, according to Doug Johnson, vice president of risk management policy for the American Bankers Association.

“For consumers who are conducting online transactions, it’s still an important security measure to have,” he said. Even with chip cards, “the goal is not to move away from other important security measures that help protect consumers.”

If you can’t read the security code for any reason, call the issuing financial institution at the customer service number listed on the back of your credit card. Each financial institution will have its own guidelines for how to handle illegible security codes, but it may require reissuing the card.

Since the security code is a safety feature, just like your PIN, you will want to protect it. Generally, as long as you have a secure connection, you can safely provide it during online transactions. The merchant is prohibited, for security purposes, from storing the code.

See related: Virtual card account numbers grow as a way to fight fraud

When to share your credit card security code

In most cases, you should share your credit card security number only if you’re making a virtual transaction online or over the phone.

In industry-speak, this is called a card-not-present transaction. Since the merchant can’t verify your identity by physically checking your driver’s license or by asking you to sign a receipt or enter a PIN, they may ask you for this special number instead before they’ll process your transaction.

Merchants aren’t required to use a security code to process a payment, though. So you may come across online retailers who don’t ask for it.

In rare cases, you may be asked to share your security code in person if a merchant, such as a vendor at a conference or a crafter at a fair, processes your card manually using a credit card imprinter or writes your card information on a piece of paper.

In this scenario, proceed with extra caution. Under PCI Security Standards, merchants are discouraged from storing your security code once they’ve processed a transaction. But a smaller business or hobbyist accepting manual card payments may not have such stringent security practices.

Decline to share your security code if you feel suspicious about it or if you don’t regularly check your statement history for unauthorized transactions.

What happens if your credit card information is stolen?

Although card-not-present fraud is a big problem for retailers and service providers that accept virtual card payments, you shouldn’t have to worry about losing money yourself to a credit card scam.

Credit card holders are protected from liability by the Fair Credit Billing Act. Most card issuers also go beyond the requirements of the law by promising customers that they won’t pay a penny if their card information is illegally used by someone else.

See related: How to report and protect yourself from credit card fraud

Bottom line

Requiring you to provide your credit card security code may slow down a payment somewhat by requiring you to track down and enter three to four more numbers. But merchants are asking for this data for a good reason.

If you elect to store your card information with a retailer after an initial transaction, the retailer won’t ask for your security code for future transactions. So, you won’t have to go digging for your card every time you make an online purchase.