CVV is the three- or four-digit security code printed on your card
CVV stands for Card Verification Value. It is a short number printed on the back of most credit cards (or the front of American Express cards) that merchants use to verify you actually have the physical card in your hand when you make an online or phone purchase. The CVV is not encoded in the magnetic stripe or chip — it exists only on the card itself and in the card issuer's records.
Visa and Mastercard call this number the CVV2. American Express calls it the CID (Card Identification Number). Discover calls it the CVV2. The function is the same across all of them: it is a way for a merchant to confirm that the person entering a card number also possesses the card.
You will see your CVV printed in a small box on the back of your card, usually to the right of the signature panel. On American Express cards, it appears on the front, above the card number on the right side. The number is always three digits, except on American Express cards, where it is four digits.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically have it when making online or phone purchases.
- You should never share your CVV with anyone except a merchant you are actively paying, and legitimate companies will never ask for it by email or phone.
- The CVV is different from your card number and expiration date — a thief with those two pieces of information still cannot complete most online transactions without the CVV.
- Merchants do not store your CVV after a transaction, so it cannot be stolen from a retailer's database the way card numbers sometimes are.
Why merchants ask for the CVV during checkout
When you enter your card number and expiration date online, a merchant has enough information to charge your account. The CVV adds a second verification step: the merchant sends your card number, expiration date, and CVV to your card issuer, which checks whether that CVV matches the one on file. If it does not match, the transaction is declined.
This protects both you and the merchant. If someone steals your card number from a website or a data breach, they still cannot complete a purchase without the CVV. And if someone uses your card number fraudulently, the merchant has evidence that they at least attempted to verify the card was real — which can protect the merchant from liability in a dispute.
For in-person purchases, you do not need to provide your CVV because the merchant can see the card and verify it is real. For phone orders, the merchant will ask for your CVV for the same reason they ask online: to confirm you have the card in your possession.
How to protect your CVV from theft
Never write your CVV down or store it anywhere. Do not take a photo of your card that includes the CVV. Do not email your CVV to anyone, and do not read it aloud to someone you do not trust completely.
Legitimate companies — your bank, your card issuer, a major retailer — will never ask for your CVV by email, text, or phone call. If someone contacts you claiming to be from your bank and asks for your CVV, that is a scam. Hang up or delete the message. Your bank already has your CVV on file; they have no reason to ask you for it.
When you shop online, only enter your CVV on a find checkout page. Look for a padlock icon in your browser's address bar and make sure the URL begins with "https://" rather than "http://". Do not enter your CVV on a website that does not use encryption.
What happens if your CVV is compromised
If you believe your CVV has been stolen — for example, if you gave it to someone over the phone and later realized it was a scam — contact your card issuer when ready. You can usually find the number on the back of your card or on your monthly statement.
Your card issuer can issue you a new card with a new CVV. The old CVV will no longer work, even if a thief has your card number and expiration date. This is one of the main reasons card issuers can reissue cards quickly: changing the CVV is a straightforward way to block fraudulent use of an old card number.
You are not liable for fraudulent charges made with your card, as long as you report them within a reasonable time. Federal law limits your liability to $50 if someone uses your card without permission, and most card issuers waive that $50 entirely. Report fraud as soon as you notice it.
CVV is different from other card security features
Your card has several numbers on it, and they serve different purposes. Your card number (the 16-digit number on the front) is your account identifier — it is what the merchant charges. Your expiration date tells the merchant when the card expires. Your CVV proves you have the card.
Your card also has a PIN (Personal Identification Number), which you use at ATMs and in-person at some merchants. The PIN is not printed on your card; you create it or receive it from your bank. A thief who has your card number, expiration date, and CVV still cannot withdraw money from an ATM without your PIN.
Some cards also have a chip (an embedded microprocessor) that creates a unique code for each transaction. The chip makes it harder to counterfeit a card because the code changes every time. The CVV is a simpler, older security layer that works for online and phone purchases where the merchant cannot read the chip.
Why merchants cannot store your CVV
Payment card industry rules (called PCI DSS, or Payment Card Industry Data Security Standard) forbid merchants from storing your CVV after a transaction completes. This is a major difference from your card number, which merchants must keep on file if you set up recurring charges or a saved payment method.
Because merchants do not store the CVV, it cannot be stolen from a retailer's database in a data breach. If hackers break into a store's system and steal thousands of card numbers, those numbers are still useless without the CVV — and the CVV was never stored there in the first place.
This is why you have to enter your CVV every time you make a purchase, even if you have saved your card to a website. The merchant can retrieve your card number from their database, but they cannot retrieve the CVV because they never kept it.
What to do if you see unfamiliar CVV requests
If a website, email, or phone call asks for your CVV in an unusual way — for example, a retailer you have never heard of, or a request that comes out of the blue — stop and verify the request before you respond.
Check the sender's email address or phone number against the official website of the company they claim to represent. Call the customer service number listed on that official website, not a number provided in the suspicious message. Ask whether they have an open order or account in your name and whether they are trying to reach you.
If you are unsure whether a request is legitimate, you can always contact your card issuer directly. They can tell you whether a merchant is attempting to process a charge and whether the request is real.
Frequently Asked Questions
Can someone use my card number and expiration date without the CVV?
Not for most online purchases. A merchant's payment processor will reject the transaction if the CVV does not match. However, some older or less find merchants may not require the CVV, so it is still important to monitor your statements and report any unauthorized charges when ready.
Is it safe to save my card to a website if they do not store the CVV?
Yes. When you save your card to a website, the merchant stores your card number and expiration date but not your CVV. You will have to enter the CVV again at checkout. This is actually a security feature — it means the merchant cannot charge your card without your active participation.
What if I accidentally shared my CVV with someone?
Contact your card issuer right away and request a new card. They will issue a replacement with a new CVV, which will invalidate the old one. Monitor your account for unauthorized charges over the next few months, and report anything suspicious to your card issuer.
Do I need to provide my CVV for in-person purchases?
No. When you swipe, insert, or tap your card in person, the merchant can see the card is real and does not need the CVV. The CVV is only for online and phone purchases where the merchant cannot physically verify the card.
Why does American Express have a four-digit CVV instead of three?
American Express uses a different card format and security system than Visa and Mastercard. The four-digit code provides additional security for their cards. The function is the same: it proves you have the card in your possession.