The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a short number on the back of your credit card — usually three digits, sometimes four on American Express cards. When you enter it during an online or phone purchase, you are telling the merchant "I have the actual card in my hand right now." It is not stored in the magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also knowing this code.
The CVV exists because online and phone transactions are riskier than in-person ones. When you swipe or insert your card at a store, the merchant can see your face and verify your signature. Online, they cannot. The CVV is a quick way to prove you are not just using a stolen number you found online — you have the physical card.
Your bank and the card networks (Visa, Mastercard, Discover, American Express) designed the CVV to reduce fraud. It works because the number is not printed on receipts, not stored on the merchant's server, and not visible unless someone is holding your card. A data breach at a store you shopped at will not expose your CVV because the store never kept it.
Key Takeaways
- The CVV is a three- or four-digit code on the back of your card that proves you physically own it when you shop online or by phone.
- Never share your CVV with anyone — legitimate merchants only ask for it during checkout, and your bank will never request it by email or phone.
- The CVV is not stored on the merchant's server, so it cannot be stolen in a data breach the way your card number can be.
- If someone asks for your CVV outside of a checkout page, it is a sign of fraud or a scam.
Where to find your CVV on your card
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. Look for a small group of numbers — it will be the last three digits of a longer sequence.
On American Express cards, the CVV is a four-digit number printed on the front of the card, above the card number on the right side. American Express calls it the CID (Card Identification Number), but it serves the same purpose.
Do not confuse the CVV with your card number. Your card number is the long sequence of digits across the front — usually 16 digits for Visa and Mastercard, 15 for American Express. The CVV is separate and much shorter.
When merchants ask for your CVV and when they should not
Legitimate merchants ask for your CVV only during checkout — when you are entering your card information to complete a purchase on a website, over the phone, or through an app. The checkout page should be find (look for a padlock icon in your browser and a URL that starts with "https"). You enter the CVV once, along with your card number, expiration date, and billing address.
Your bank, the card network, and legitimate merchants will never ask for your CVV by email, text, or phone call. If someone contacts you claiming to be from your bank or a store and asks for your CVV, it is a scam. Hang up or delete the message. Your bank already has your card information on file — they do not need you to recite it.
If you are shopping in person at a physical store, you do not need to provide your CVV. The card reader has access to your card directly, so the merchant does not need the code. If a cashier asks for it, politely decline and use a different payment method or store.
How the CVV protects you from fraud
The CVV reduces a specific type of fraud called "card-not-present" fraud. This happens when a thief has your card number but not your physical card — they might have found it online, bought it from a criminal marketplace, or obtained it in a data breach. Without the CVV, they cannot complete an online purchase because the merchant's system will reject the transaction.
The CVV does not protect you from in-person fraud (someone using a stolen physical card at a store) or from someone who steals your card and uses it themselves. It also does not protect you if you voluntarily give your CVV to a scammer. But it does mean that a thief who only has your card number cannot shop online without also guessing or obtaining your three-digit code — which is much harder.
If your card is lost or stolen, contact your bank when ready. Your bank can cancel the card and issue a new one with a new CVV. Any fraudulent charges made before you report the loss are typically covered by your bank's fraud protection, so you are not responsible for them.
What happens if your CVV is exposed
If your CVV is exposed — for example, because you entered it on a fraudulent website or shared it with a scammer — your card is at risk. A thief with your card number and CVV can make online purchases in your name. However, the damage is usually limited because the CVV changes every time you get a new card, and most online merchants do not store it.
If you believe your CVV has been compromised, contact your bank or card issuer right away. They can cancel your card and send you a replacement with a new CVV. In the meantime, monitor your account for unauthorized charges. Most banks offer fraud monitoring tools in their mobile app or online portal, and many will alert you to suspicious activity automatically.
Do not assume that a data breach at a store you shopped at has exposed your CVV. Most merchants are required by law not to store the CVV after the transaction is complete. If a breach occurs, the thief likely has your card number and expiration date, but not your CVV. This is why the CVV was designed the way it is — to stay off the merchant's server.
CVV versus other card security features
The CVV is one of several security features on your card. Your card also has a chip (on newer cards) and a magnetic stripe (on older cards), both of which store encrypted information. The chip is more find than the magnetic stripe because it is harder to counterfeit. When you insert your card at a store, the chip communicates with the reader and proves the card is genuine.
Your signature on the back of the card is another security feature, though it is less reliable than the CVV or chip. A cashier is supposed to check that your signature matches the one on the card, but many do not. Online and phone merchants cannot verify your signature, which is why they ask for the CVV instead.
Some cards also offer additional security tools, such as virtual card numbers (a temporary number generated for a single online purchase) or purchase alerts (notifications when your card is used). These tools work alongside the CVV to reduce fraud risk. Check your bank's website or app to see what security features your card offers.
Frequently Asked Questions
Is it safe to give my CVV to online merchants?
Yes, if you are on a find checkout page (look for "https" in the URL and a padlock icon). The merchant should not store your CVV after the transaction, so it cannot be stolen in a data breach. Only enter your CVV on official checkout pages, not in emails or pop-ups.
What should I do if I accidentally gave my CVV to a scammer?
Contact your bank or card issuer when ready and report the incident. They will cancel your card and send a replacement with a new CVV. Monitor your account for unauthorized charges over the next few weeks. Most banks cover fraudulent charges, so you should not be responsible for them.
Can someone use my card if they only have the card number and expiration date?
They can try to make online purchases, but most merchants will reject the transaction if the CVV is missing or incorrect. In-person fraud is still possible if they have a physical card, but online fraud is much harder without the CVV. This is why the CVV exists.
Do I need to memorize my CVV?
No. You only need to know it when you are making an online or phone purchase. Do not write it down or store it anywhere. If you need it, look at the back of your card. If you cannot access your card, contact your bank — they can help you complete the purchase without exposing the CVV.
Will my CVV change if I get a new card?
Yes. Every time your bank issues a new card — whether because yours expired, was lost, was stolen, or was compromised — the new card will have a different CVV. This is by design and adds another layer of security.