People who buy items online or over the phone usually are asked to enter not just their credit card number but also the card’s security code. The prevalence of identity theft is the primary reason major credit card issuers use security codes.
Credit cards are not completely safe, however, even with a security code. The code can’t protect against frauds such as phishing, in which the cardholder is deceived into entering the security code and other card information through a fake website. The increase of phishing has reduced the effectiveness of the security code as an anti-fraud device.
How does a credit card security code work?
A credit card security code, also known as card verification value (CVV) or card verification code (CVC), is a three- or four-digit number on the card that provide an extra layer of protection for the cardholder. The code makes it harder for hackers or thieves to steal the credit card information. It cannot be accessed without having physical possession of the credit card.
The security code is in addition to the card number that is printed on the card. It is generally used as a security feature, especially for transactions in which a personal identification number (PIN) cannot be used. The PIN is not embedded or printed on the card, but is manually entered by the credit card card holder during a point-of-sale (POS) transaction.
Using a security code is not mandatory, and merchants may or may not ask for it. Most online retailers, however, do require the security code, along with the cardholder’s credit card number and expiration date.
Types of security codes
There are several types of credit card security codes. Some of the common types include:
- The first code: Also referred to as CVV1 or CVC1, this is encoded in the card’s magnetic stripe and is used for transactions where the physical card is needed. The purpose of the code is to check that the card is in the hand of the merchant during the transaction. The code is automatically retrieved when the card’s magnetic stripe is swiped on the POS device and is checked by the issuer. The disadvantage of this code is that if the credit card has been cloned and the magnetic stripe’s information copied, the code is still valid.
- The second code: The most commonly used, this code is referred to as CVC2 or CVV2. Merchants require this code especially on transactions where a physical card cannot be used, such as when buying items over the internet or phone.
- Chip cards and contactless cards: These generate their own codes electronically.
Finding the card security code
The credit card security number is typically printed on the surface of the card, either back or front. It is not encoded on the card’s magnetic stripe.
- American Express credit cards have a four-digit security code printed on the front of the card, just above and to the right of the cardholder’s account number.
- Visa, MasterCard, Diners Club and Discover cards have a three-digit code printed on the card’s signature panel, on the back of the card. New North American Visa and MasterCards feature the code in a separate panel to the right of the signature strip. It is designed to prevent overwriting of the numbers when cardholders sign the card.