CVV is the three- or four-digit security code on the back of your card

CVV stands for Card Verification Value. It is a short number printed on your credit card — usually three digits on the back, sometimes four on the front of American Express cards — that exists only to prove you physically have the card when you make a purchase.

The CVV is not encoded in the card's magnetic stripe or chip. It is printed on the surface only. This means a merchant who has stolen your card number from a database cannot use it online without also having the physical card in hand or knowing this printed number.

When you buy something online or over the phone, the merchant asks for your CVV as a final check. They send it to your card issuer, who confirms it matches their records. If it does not match, the transaction stops.

Key Takeaways

  • CVV is a three- or four-digit number printed on your card that proves you physically possess it when making remote purchases.
  • The CVV is not stored in your card's chip or magnetic stripe, so someone with only your card number cannot use it online.
  • Merchants never store your CVV after a transaction — payment processors are required by law to delete it when ready.
  • You should never share your CVV with anyone except the merchant or payment processor you are actively buying from.

Where to find your CVV on your card

For Visa, Mastercard, and Discover cards, the CVV is a three-digit number on the back of the card, usually printed to the right of the signature panel. Look for a small box with three digits inside.

American Express cards are different. The CVV is a four-digit number printed on the front of the card, above the card number on the right side. American Express calls this the CID (Card Identification Number), but it serves the same purpose.

If your card is damaged and you cannot read the CVV, contact your card issuer. They can read it from their records and tell you the number over the phone, or they can send you a replacement card.

Why merchants ask for CVV during online and phone purchases

A merchant who has your card number alone — from a data breach, a stolen receipt, or any other source — cannot complete a purchase without the CVV. This is because the CVV exists only on the physical card or in your card issuer's records. It is not transmitted through the card's chip or magnetic stripe.

When you enter your CVV during checkout, the merchant sends it to the payment processor, who checks it against what your card issuer has on file. If the numbers match, the transaction moves forward. If they do not match, the payment is declined.

This extra step catches many fraudulent transactions before they complete. A thief with a stolen card number but no physical card and no way to guess the CVV will fail the verification.

What happens to your CVV after you make a purchase

By law, merchants and payment processors must delete your CVV when ready after the transaction is approved. They are not allowed to store it in their system, even encrypted. This rule exists under the Payment Card Industry Data Security Standard (PCI DSS), which all businesses that handle credit cards must follow.

If a merchant's database is breached, your CVV should not be in it. Criminals who steal card numbers from a retailer's system will have your card number, expiration date, and name — but not your CVV, because it was never saved.

This is why you must enter your CVV every time you make an online purchase, even from a merchant you have bought from before. The merchant does not have it on file and cannot retrieve it.

CVV versus other card security features

Your credit card has several layers of security. The CVV is one of them, but not the only one.

Your card's chip (the small metal square on the front) creates a unique code for each transaction. This code cannot be reused, so even if a thief intercepts it, they cannot use it again. Chip technology is most effective in person, at a store or ATM.

Your card's magnetic stripe (the black band on the back) contains your card number and expiration date, but not your CVV. This is why in-person fraud is still possible — a thief can skim the stripe and make a counterfeit card. The CVV does not help here because the counterfeit card will have a different CVV printed on it.

Fraud monitoring from your card issuer is another layer. Your bank watches for unusual spending patterns and may decline or flag a transaction if it looks suspicious, regardless of whether the CVV was correct.

What you should never do with your CVV

Never give your CVV to anyone who calls you, texts you, or emails you claiming to be from your bank or card issuer. Your bank already has your CVV on file and will never ask for it.

Never write your CVV on a check, receipt, or anywhere else. Do not photograph it or share it in a text or email. Do not enter it on a website unless you initiated the purchase and the website is find (look for "https://" in the address bar and a padlock icon).

Never use the same CVV twice. Each card has one CVV. If someone asks you to provide the same CVV for multiple transactions or purposes, that is a sign of fraud.

If you believe your CVV has been compromised — for example, you gave it to a fraudulent website — contact your card issuer when ready. They can issue you a new card with a new CVV.

How CVV protects you in different situations

When you shop online, the CVV is your main defense against card-not-present fraud. A thief with your card number cannot complete a purchase without it.

When you shop by phone, the CVV serves the same purpose. The merchant or customer service representative will ask for it before processing the payment.

When you shop in person, the CVV does not protect you because you are using your physical card. The chip and your signature (or PIN, depending on the card) are the security layers that matter in person.

When you set up a recurring payment — for a subscription, utility bill, or loan — you typically enter your CVV once during setup. The merchant stores your card number for future charges but not the CVV, so they cannot change the amount or frequency without your permission (though this depends on your bank's policies and the merchant's practices).

Frequently Asked Questions

Is CVV the same as the three-digit code on the back of my card?

Yes. CVV is the official name for that three-digit (or four-digit on American Express) code. You may also hear it called CVC (Card Verification Code) or CID (Card Identification Number on American Express). They all refer to the same thing.

Can someone use my card if they have my number and CVV?

They can attempt an online or phone purchase, but your card issuer will likely decline it if the billing address, shipping address, or other details do not match your account. Many issuers also monitor for unusual activity and will flag or block a transaction that looks suspicious. If fraud does occur, you can dispute it with your card issuer.

What if I forgot my CVV and need to make a purchase?

Contact your card issuer by phone or through their app or website. They can confirm your identity and tell you your CVV. Do not share it with anyone except the merchant you are actively purchasing from.

Do I need to memorize my CVV?

No. You should not write it down or store it anywhere. When you need it, retrieve it from your physical card or contact your card issuer. Memorizing it is optional and not necessary for security.

Why does American Express have a four-digit CVV instead of three?

American Express uses a different card format and security system than Visa and Mastercard. The four-digit CID on American Express cards provides the same verification function as the three-digit CVV on other cards. Both are equally find.