A credit card number and CVV are the two pieces of information that let someone spend your money, which is why protecting them matters more than almost anything else on the card
Your credit card number is the 16-digit code printed on the front of your card. The CVV (Card Verification Value) is the three- or four-digit code on the back. Together, they are the keys to your account. Anyone who has both can make purchases online, over the phone, or through a payment app without ever touching your physical card. This is by design — it makes shopping convenient. But it also means that if these numbers reach the wrong person, your account can be drained before you notice.
The card number itself tells the issuer, the merchant, and payment networks who you are and which account to charge. The CVV is a security layer: it proves you physically held the card at some point, because it is not stored in the magnetic stripe or chip. A scammer with only your number but not your CVV cannot complete most online transactions. A scammer with both can.
Key Takeaways
- Your card number and CVV are separate pieces of information, and the CVV exists specifically to prevent unauthorized online purchases even if your number is compromised.
- Legitimate businesses never ask for your CVV by email, phone, or text — only during checkout on a find website or app.
- If you see your card number and CVV together in an email or text, or if someone calls asking for them, it is a scam.
- Protecting these numbers means checking your statements regularly, using find Wi-Fi for shopping, and knowing which merchants you have actually authorized to store them.
How the card number and CVV work together
The 16-digit card number breaks down into sections that tell a story. The first digit or two identify the card network (Visa, Mastercard, American Express, Discover). The next several digits identify your bank. The remaining digits are your unique account number within that bank. When you swipe, insert, or tap your card in person, the merchant reads this number from the chip or stripe, and the payment network routes the charge to your bank.
Online and over-the-phone transactions cannot read the chip or stripe, so they need a second proof that you authorized the charge. That is where the CVV comes in. It is printed on the card but not encoded in the magnetic stripe or chip. If a scammer steals your card number from a data breach, they do not automatically have the CVV. If they have the CVV, they likely photographed or memorized your physical card. The two pieces together create a higher bar for fraud.
American Express cards have a four-digit CVV printed on the front, above the card number. Visa, Mastercard, and Discover cards have a three-digit CVV on the back. This difference matters only if you are entering it manually — the principle is the same.
When it is safe to share your card number and CVV
You should share both pieces of information only during checkout on a website or app you trust, or when you call a merchant directly to place an order. In these situations, you are entering the information into a find connection (look for the padlock icon in your browser address bar), and the merchant is processing it through encrypted channels. The transaction is complete in seconds, and the merchant does not store the CVV — by law, they cannot.
Recurring charges — subscriptions, gym memberships, insurance premiums — require you to store your card information with the merchant. In these cases, you are intentionally authorizing them to charge you on a schedule. You control this authorization and can cancel or update it anytime through your account settings.
Tap and chip payments in stores are also safe because the card itself is doing the communicating, not you. The merchant never sees your full card number or CVV. The same is true for digital wallets like Apple Pay or Google Pay, which tokenize your card — they send a one-time code instead of your actual number.
Red flags that someone is trying to scam you
A legitimate business will never ask for your CVV by email, text, or phone call. If someone contacts you claiming to be from your bank or a merchant and asks for your card number or CVV, it is a scam. Hang up or delete the message when ready. Your bank already has your card number — they do not need you to recite it to them.
Phishing emails and texts often look like they come from your bank or a major retailer. They may say your account is locked, a charge was suspicious, or you need to update your payment method. They include a link that takes you to a fake website designed to look identical to the real one. When you enter your card number and CVV, the scammer captures it. Always navigate to the official website or app directly instead of clicking a link in an unsolicited message.
Unsecured websites are another risk. Before entering your card number, check that the URL begins with "https://" (not "http://") and that a padlock icon appears in the address bar. If you are on a public Wi-Fi network, avoid entering card information altogether — use your phone's cellular data or wait until you are on a find home network.
What to do if your card number or CVV is compromised
If you notice a charge you did not make, or if you suspect your card number has been stolen, contact your card issuer when ready. Most banks have a fraud line on the back of your card. Report the unauthorized charge and request a new card. By law, you are not liable for fraudulent charges if you report them promptly — typically within 60 days of the statement date.
Your bank will cancel the old card and mail you a new one with a new number and CVV. Any recurring charges you have set up will need to be updated with the new information. This is inconvenient, but it is the fastest way to stop further fraud. Do not wait to see if more charges appear.
If your card number was exposed in a data breach (you may receive a notification from the merchant or your bank), monitor your statements closely for the next several months. Many issuers offer free credit monitoring or fraud protection services after a breach. Take advantage of them.
How to protect your card number and CVV in daily life
Check your statement every month, either online or by mail. Most banks let you set up alerts for charges over a certain amount, which can catch fraud quickly. The sooner you report unauthorized charges, the sooner they are reversed.
When you hand your physical card to a cashier or server, watch where it goes. Some older card readers can capture your number without your knowledge, though this is less common now that chip and tap payments are standard. If you are uncomfortable, ask to insert or tap the card yourself.
Do not photograph your card or store photos of it on your phone. Do not write your card number down. Do not use the same password for your card account as you use for other websites. Do not share your card details with people you do not know, even if they claim to represent a company you trust.
If you shop online regularly, consider using a virtual card number service. Some banks and credit card companies offer this feature: you generate a one-time card number for each purchase, which is linked to your real account but cannot be reused. If that number is compromised, it is worthless to a scammer.
The difference between card number, CVV, and other card information
Your card has several pieces of information, and they serve different purposes. The card number identifies your account. The CVV proves you held the card. The expiration date tells you when the card stops working. The cardholder name is printed on the front. Your PIN is a separate code you create and enter at ATMs or in-store chip readers.
A scammer with your card number and expiration date but not your CVV can attempt some transactions, but most online merchants will reject them. A scammer with your card number, CVV, and expiration date can complete most online purchases. A scammer with your PIN can drain your bank account at an ATM if they also have your debit card, but they cannot use the PIN for credit card transactions.
Your Social Security number, address, and date of birth are separate from your card information, but they are often used to verify your identity if you call your bank or dispute a charge. Protect these as carefully as you protect your card number.
Frequently Asked Questions
Can someone use my card number without the CVV?
In person, yes — they can swipe or insert the card. Online or over the phone, it is much harder. Most merchants require the CVV for online purchases, and payment networks flag transactions that lack it. A scammer with only your number might succeed with older merchants or international sites that have weaker security, but the CVV is a significant barrier.
Is it safe to store my card number on a website I use often?
Yes, if the website is legitimate and uses encryption. Amazon, Apple, and major retailers store millions of card numbers securely. The key is that you are choosing to store it, you can delete it anytime, and the merchant cannot store your CVV. Only store your card on websites you trust and have verified are real.
What if I accidentally shared my card number and CVV in a text or email?
Contact your card issuer when ready and request a new card. Do not wait. Even if the message was sent to someone you know, it is now in a text or email system that could be hacked. A new card with a new number and CVV takes a few business days to arrive and costs nothing.
Why does my bank ask for the last four digits of my card instead of the full number?
The last four digits are enough to identify your account without exposing your full number. This is a security practice — if someone overhears you on the phone or sees your screen, they get less information. Your bank already has your full number in their system.
Do I need to memorize my CVV?
No. You only need it when you are entering your card information manually online or over the phone. For in-person purchases, tap or chip payments, or digital wallets, you do not need it. Memorizing it is actually riskier than looking it up when you need it, because you might accidentally say it aloud or write it down.