Where do I find my MasterCard® security code on my debit card?

When people refer to a debit card’s ‘security code’, they usually mean the Card Verification Value, or CVV, and this is found on the reverse of the card.

To find it, first hold your card in front of you so that the big 16-digit card number is facing you and is the right way up (you should also be able to see your name, the card’s expiry date, your account number and so on).

Now turn the card over to show the reverse – again, keep it the right way up. If you have already signed the card on the signature strip, you should now be able to see your signature the right way up.

Look towards the top-right corner of the signature strip (just the box where you sign, not the top-right of the entire card) and you should be able to see some small numbers.

There should be at least the last four digits of the card number – the same as the big 16-digit number on the front – and then after this, a completely unique three-digit number.

Those three digits are your CVV, commonly known as the card’s security code, and you may be asked to enter them when making an online purchase.

What is a CVV?

The Card Verification Value is designed to be kept a secret, except for when you need to enter it into an online checkout form – and because of this, it is expected that only you, the authorised cardholder, will ever know what it is.

Because it is on the back of the card, and printed very small compared to the big embossed numbers on the front, it is much less likely that anyone will be able to read your security code over your shoulder, or snap a photograph of it in a shop.

Apart from yourself, the only way anyone should be able to find out that number is if they have your card, for example by either stealing it or finding it, and this is why it is so important to report a lost or stolen card immediately.

You will not always be asked for your CVV – in fact a lot of online retailers do not use it – and this does not necessarily mean that the retailer is not trustworthy, so don’t feel like you need to cancel the transaction just because they didn’t ask for your card’s security code.

How secure is CVV?

It depends partly on how safe you keep your card – if you do not keep it secure, then other people may find out your CVV and you could be putting your own money at risk.

More recently, card issuers have begun to use CVV2, which is an even more secure method; it still uses a three-digit number, but is designed to be even harder to guess at random.

It is worth noting that American Express cards use a four-digit security code, but both Visa and MasterCard® use the three-digit system.

Remember that there are many different ways to verify that a debit card transaction is legitimate, from the CVV number to the magnetic stripe, chip and pin, contactless, your PIN number and even your signature, as well as additional methods like MasterCard® SecureCode®.

What is SecureCode®?

The CVV number should not be confused with SecureCode®, which is a system offered by some organisations that issue MasterCard® debit cards.

If SecureCode® is enabled on your card, when you use it online you may be asked to provide some extra information to verify that you are the cardholder.

This might mean a one-time code is sent to your phone for you to enter in order to authorise the transaction, or some similar method.

Like the CVV security code, SecureCode® is a way to verify that you are the actual cardholder, but the two are completely separate methods, and you will still have a CVV number even if your debit card is not enrolled with SecureCode®.

What about my PIN number?

Your PIN number should be kept secret at all times and it is extremely important to understand when you need to enter your PIN number, and when to enter your CVV number.

You should NEVER need to enter your PIN number online – it is generally used only at cash machines or to authorise card payments in person using a handheld terminal (known as a PDQ terminal).

Similarly, it is unlikely you will ever be asked to state your CVV number in person, as it is solely intended to prove your identity when buying things online, so generally speaking, most people will only ever enter their CVV during an ecommerce online checkout process.