Credit card security

Where is the security code on a credit card?

On Visa and Discover cards, the security code is the 3 digits on the back, on or beside the signature panel. American Express prints a 4-digit code on the front. Chase says Mastercard cards also carry it on the back; Mastercard’s own US site could not be saved, so we quote no Mastercard statement.

What is the security code for?

The security code proves you have the card when you pay online or by phone. American Express describes it as “data that businesses can’t store”, used “to provide additional verification for purchases made online or over the phone”. Issuers call it the CVV, CVC, CSC, CVN or CID. A random guess has a 1-in-1,000 chance for a 3-digit code and 1-in-10,000 for a 4-digit one, as American Express puts it.

A stolen code with a stolen number still isn’t your loss to bear on a credit card. The official interpretation of Regulation Z says that when goods are ordered by phone or online with the account number, alone or with “the card expiration date and a 3- or 4-digit cardholder identification number”, “no liability may be imposed on the cardholder”.

How do I find the security code without the card?

Look in your issuer’s app. Visa’s card design standards allow a card to be issued without a printed number, code or expiration date when they are “supplied in the digital application on the cardholder’s device”. Some issuers also offer virtual card numbers for online shopping: 3 of the 15 issuers we checked say so (American Express, Capital One and Apple Card). If you can’t see the code anywhere, call the number on the issuer’s website rather than searching for it elsewhere: the code exists to show that you hold the card.

How much can you lose if your card is used without permission?

On a credit card, at most $50, however late you report, because only charges made before you tell the issuer count; and $0 if someone used only your card number, not the card. On a debit card, at most $50 if you report within 2 business days of learning the card was lost or stolen, at most $500 after that, and transfers made more than 60 days after the statement that showed the fraud have no cap if reporting would have stopped them. This is a summary of federal rules, not legal advice.

Two details are often mixed up. First, the credit card cap in 12 CFR 1026.12(b) has no reporting deadline: it is “the lesser of $50 or” what was obtained “before notification to the card issuer”. The 60-day limit people attach to it belongs to a different rule, billing-error disputes in 12 CFR 1026.13, and it runs from when the issuer “transmitted the first periodic statement that reflects the alleged billing error”, not from the fraud. Second, the debit deadlines run from “learning of the loss or theft” and from “the financial institution’s transmittal of the statement”, not from the date of the fraud, and the regulation extends them “to a reasonable period” for extenuating circumstances.

The $50 cap applies only if the card is one you accepted, the issuer has told you your maximum liability and how to report a loss, and the issuer has a way to identify the user. A lower limit set by state law or your card agreement wins. An employer with 10 or more cards from one issuer may agree different liability for its employees’ cards.

What do the card networks’ $0 policies add?

They promise more than the law, on conditions of their own. These are company terms, not law.

• Visa: its Zero Liability Policy says “you won’t be held responsible for unauthorized charges”, for credit and debit cards, online or offline. It “does not apply to certain commercial card and anonymous prepaid card transactions or transactions not processed by Visa”, and cardholders “must use care in protecting their card and notify their issuing financial institution immediately”. Issuers must replace stolen funds within 5 business days of notification, provisionally: the money can be “withheld, delayed, limited, or rescinded” for reasons including “a delay in reporting”. Visa’s terms.
• Discover: “You’re never responsible for unauthorized purchases on your Discover Card”, but claims “are subject to investigation and verification”, and a purchase is unauthorized only where you have not given your card information to another person or merchant. Discover asks cardholders to “use reasonable care”. Discover’s FAQ.
• American Express: its US pages say “you are not liable for fraudulent charges on your account” and name a “Fraud Protection Guarantee”. We found no US page with the Guarantee’s conditions, so we quote only those two statements (SafeKey, Click to Pay).
• Mastercard: Mastercard’s US site refused our requests (HTTP 403, “Access Denied”), so its Zero Liability terms could not be saved or quoted. Check your card’s guide to benefits instead.

Issuers make their own promises too: 13 of the 15 issuers we checked state a $0 or zero-liability policy on their pages, often “when reported promptly”. We didn’t find one on the pages we checked for American Express and Synchrony. See the issuer table.

Which card issuers offer card lock, virtual card numbers and alerts?

Card lock is the most widely published feature: 14 of the 15 US issuers we checked describe one on their own pages. 12 of 15 describe transaction or fraud alerts, though only 4 (Capital One, Barclays, Navy Federal Credit Union and Apple Card) say they can alert you to every purchase. Virtual card numbers are rarer: 3 of 15 (American Express, Capital One and Apple Card). “Not found” means we didn’t find the feature on the pages we checked, not that the issuer lacks it.

Checked against each issuer’s published pages on October 6, 2026 and October 23, 2026. These are desk checks: nobody here has used these features, and an issuer’s marketing page is not its cardholder agreement, which governs.

Where does card fraud happen?

Mostly online and by phone, where only the card number is needed. In the Federal Reserve’s latest breakdown of US credit card fraud, $3.15 billion of $5.14 billion in 2016 (61%) was remote, and fraudulent use of the account number was the largest type, at $2.34 billion. Counterfeit cards, which the chip targets, fell from $1.88 billion to $1.66 billion.

Across all US cards, credit and debit, in-person fraud fell from $3.68 billion in 2015 to $2.91 billion in 2016, while remote fraud rose from $3.40 billion to $4.57 billion. Measured against what was spent, the in-person fraud rate fell from 12.17 to 9.34 basis points, and the remote rate reached 18.71, “about twice that rate”. For credit cards alone the rate was 16.95 basis points in 2015 and 17.13 in 2016. A basis point is one cent per $100 of payments, so 17.13 basis points is 17.13 cents in every $100. Federal Reserve, Changes in U.S. Payments Fraud from 2012 to 2016 (October 2018).

Newer data, for debit cards only

The Federal Reserve’s 2023 figures cover only debit cards issued by large banks (covered issuers), so they are not credit card figures. They show the same pattern: card-not-present fraud was 54.3% of debit fraud, lost and stolen 22.2%, counterfeit 17.5% and other 5.9%.

Source: Federal Reserve, 2023 Interchange Fee Revenue, Covered Issuer Costs, and Covered Issuer and Merchant Fraud Losses Related to Debit Card Transactions, saved October 23, 2026.

How many people report credit card fraud?

The FTC received 449,032 reports of credit card identity theft in 2024, the most reported type of identity theft that year. Over 2020–2024, the CFPB counts 2,128,094 such reports to the FTC. These are reports people filed, not a count of victims or of money lost, and the two publishers count over different periods and data cuts. In a Federal Reserve survey, 16% of US adults reported fraud involving their credit card in 2025. More figures are on our credit card statistics page.

Source: FTC, Consumer Sentinel Network Data Book 2024 (March 2025), saved October 23, 2026. Identity Theft Types table.

What this data can’t tell you

2016 is the latest year in the official breakdown of US credit card fraud by type and channel that we found, from the Federal Reserve’s October 2018 report; its later Payments Study releases we checked carry no such breakdown, so the shares today may differ. Its figures count fraudulent payments “before any chargebacks, returns, or recoveries”, and who bears the losses “is out of the scope” of that data. Payment fraud is still rare: “only small fractions of 1 percent” of payments.

Does the chip protect you online?

No. The chip protects payments where the card is in a terminal: it “generates a one-time use security code for every transaction”, says EMVCo, and chip cards “are harder to counterfeit”, says the Federal Reserve. Online and phone fraud uses the card number without the card, which the Federal Reserve describes as fraud “perpetrated without using a physical card”, so the chip plays no part.

The US chip liability shift was set for October 1, 2015: after it, Visa said, liability for counterfeit fraud “may shift” to the acquirer of a merchant that hadn’t adopted chip terminals. Mastercard says the date is “aligned across all of the major payment brands”. In-person card fraud then fell, while remote fraud rose (see where card fraud happens).

The chip hasn’t ended counterfeiting in the US. On non-prepaid debit cards (dual-message networks), the counterfeit fraud rate went from 9 basis points in 2015 to 6.6 in 2017, then back to 9.1 in 2021, against about 0.1 in Australia and France, according to the Kansas City Fed. Payments with a PIN had less fraud: in 2015, in-person payments and ATM withdrawals with a PIN had a fraud rate of 3.99 basis points, against 12.78 without one.

Sources: EMVCo, EMV contact chip; Federal Reserve, Changes in U.S. Payments Fraud from 2012 to 2016 (October 2018); Visa press release announcing the US chip roadmap (2011); Mastercard, merchant EMV chip FAQs (US); Federal Reserve Bank of Kansas City, Payments System Research Briefing, February 12, 2025; Federal Reserve, Changes in U.S. Payments Fraud from 2012 to 2016 (web version). We found no primary source on what contactless payments protect against, so this page makes no claim about it.

What is 3-D Secure?

3-D Secure is an extra check at some online checkouts that confirms it’s really you, “through methods such as a one-time password, PIN, or biometric”, as the Kansas City Fed describes it. EMVCo, which sets the standard, says it lets the merchant and the issuer exchange data “to authenticate the consumer and approve the transaction”, to “prevent card-not-present (CNP) fraud”. Visa’s version is called Visa Secure.

In the US you’ll meet it only sometimes: Visa says the extra check “only happens for purchases that seem unusual or higher-risk”. US merchants “are generally liable for card-not-present fraud”, the Kansas City Fed notes, but liability moves to the issuer when a fraudulent payment was authenticated through 3-D Secure, and the protocol “has been more narrowly adopted in the United States” than in Australia, the UK and the EU.

Europe made strong customer authentication a legal requirement in 2020. The European Banking Authority reports that it “has contributed to reducing fraud levels”, and that card payment fraud was 17 times higher when the payee was outside the EEA, “where SCA is not legally required”. We found no US rule that requires it; the US incentive is the liability shift.

Sources: EMVCo, EMV 3-D Secure; Visa, safe online shopping (US); Federal Reserve Bank of Kansas City, Payments System Research Briefing, May 21, 2025; European Banking Authority, joint EBA–ECB report on payment fraud (press release, December 2025).

Is a credit card safer than a debit card?

For fraud, yes. A credit card’s legal cap is $50 with no reporting deadline, and $0 for number-only fraud; a debit card’s rises from $50 to $500 after 2 business days, with no cap on later transfers after 60 days from the statement. Debit fraud also takes your own money out of your account until it is put back.

Network promises narrow the gap but don’t close it. Visa’s Zero Liability covers debit cards, but its refunds within 5 business days are provisional and can be withheld for “a delay in reporting”. Debit cardholders do bear real losses: at large banks in 2023, cardholders absorbed 30.7% of counterfeit debit fraud losses and 56.3% on prepaid cards (Federal Reserve).

A credit card also lets you dispute a purchase that went wrong. Under 12 CFR 1026.12(c) you may withhold payment for goods or services the merchant won’t put right, if you tried in good faith to resolve it with the merchant, and the purchase was over $50 and made in your state or within 100 miles of your address. That covers disputes with a merchant, not fraud.

What should you do if your card is lost, stolen or misused?

Report it to your card issuer straight away, by phone, in person or in writing, and lock the card in its app if you can. Then check your statements and dispute anything you don’t recognize in writing within 60 days of the statement it first appears on.

1. Report it now. On a credit card, only charges made before you report count toward the $50 cap, and on a debit card reporting within 2 business days of learning of the loss keeps you at $50. The CFPB’s 2014 advisory says to “report suspicious transactions immediately to your bank or card provider”.
2. Lock the card while you look for it, if your issuer offers a lock: 14 of the 15 issuers we checked do. A lock doesn’t replace a report, and some locks let recurring payments through.
3. Check every statement, including small charges: “Report even small problems right away,” the CFPB advises, because “sometimes thieves will process a small debit or charge against your account and return to take more”.
4. Dispute unauthorized charges in writing within 60 days after the issuer sent the first statement showing them, to the address the issuer gives for billing errors. The issuer must acknowledge within 30 days and resolve it within 2 billing cycles, 90 days at most. You don’t have to pay the disputed amount meanwhile, and it can’t be reported as late.
5. On a debit card, check each statement within 60 days of it being sent, to keep later transfers capped.
6. Update automatic payments to the replacement card: the CFPB reminds cardholders to “update any automatic payments linked to the card”.

Sources: 12 CFR 1026.12, Regulation Z (eCFR); 12 CFR 1026.13, Regulation Z (eCFR); 12 CFR 1005.6, Regulation E (eCFR); CFPB consumer advisory, “Report suspicious charges if account data is hacked” (September 2014).

Sources and how we checked them

Every rule and figure on this page is quoted from a saved copy of its source, and an automated test checks each quote is in its copy and each number is the one the words state. The issuer table cites each issuer’s own pages. How we check every figure. This page is general information about US federal rules, not legal advice: your card agreement and state law can give you more protection.

What we couldn’t source is left out: Mastercard’s US Zero Liability terms, the conditions of American Express’s US Fraud Protection Guarantee, FTC counts for years before 2024, and any claim about what contactless payments protect against. For the wider picture, see our best credit cards and credit card statistics.

Use this diagram