CVV is the three- or four-digit security code on your credit card
CVV stands for Card Verification Value. It is a short number printed on your card — usually three digits on the back, or four digits on the front for American Express — that exists only to prove you physically have the card when you use it online or over the phone.
The CVV is not encoded in the card's magnetic stripe or chip. It lives only on the card itself and in your card issuer's records. When you enter it during an online purchase, the merchant sends it to your bank, which checks whether the number matches what they have on file. If it does, the transaction is more likely to be legitimate. If someone has stolen your card number but not the physical card, they cannot complete most online purchases without the CVV.
This is why merchants ask for it: it is a fast, free way to reduce fraud. It does not may provide a transaction is safe, but it catches a large category of stolen-card fraud before the charge goes through.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically possess it during online or phone purchases.
- The CVV is not stored in your card's chip or magnetic stripe, which is why a thief with only your card number cannot use it online.
- Merchants and banks use CVV verification to catch fraud, but you should never share your CVV with anyone who calls you or emails you.
- If your CVV is compromised, you do not need to replace your card unless the card number itself was also stolen.
Where to find your CVV on your card
For Visa, Mastercard, and Discover cards, the CVV is a three-digit number on the back of the card, usually printed to the right of the signature strip. Look for a small group of numbers at the end of a longer number sequence.
For American Express cards, the CVV is a four-digit number printed on the front of the card, above the card number on the right side. American Express calls it the CID (Card Identification Number), but it serves the same purpose.
The CVV is always printed, never embossed. You cannot feel it when you run your finger across the card — it is flat text only.
Why merchants ask for CVV but should never store it
When you enter your CVV during checkout, the merchant's payment processor sends it to your bank for verification. Your bank checks the number against what they have on file and returns a yes or no. The merchant never needs to see the actual CVV again.
In fact, payment card industry rules forbid merchants from storing your CVV after the transaction is complete. If a merchant saves it, they are breaking the rules and exposing themselves to fines and losing their ability to accept cards. This is why legitimate companies will never ask you to provide your CVV in an email, text, or phone call — they have no reason to ask, and asking is a sign of fraud.
If you have given your CVV to someone over the phone or email, or if you see it stored on a website, contact your card issuer when ready. Your bank may issue you a new card as a precaution.
CVV versus card number: what each one protects
Your card number (the 16 digits on the front) is the primary account number. It identifies your account and is necessary for any transaction. Thieves who steal only your card number can sometimes make in-person purchases at stores that do not check ID, or they can try online purchases at merchants with weak security.
The CVV is a second layer. It proves you have the physical card. A thief with your card number but not your CVV will fail at most online checkouts because the CVV verification will not match. This is why the CVV exists: it is cheap fraud prevention that works for the most common type of card theft — stolen numbers, not stolen cards.
If both your card number and CVV are compromised, your risk is higher, but your card issuer's fraud detection systems may still catch unauthorized charges. If your physical card is stolen, the thief has both pieces of information and can use the card in person or online until you call to report it.
What to do if your CVV is compromised
If you have shared your CVV with someone you do not trust, or if you entered it on a website that looked suspicious, contact your card issuer right away. Tell them what happened and when. They will monitor your account for fraudulent charges and can issue a new card if necessary.
You do not automatically need a new card just because your CVV was exposed. The CVV alone is not enough to make a purchase — a thief would also need your card number, expiration date, and billing address. If only the CVV was compromised, your bank may straightforward watch your account more closely.
However, if your card number was also stolen, or if fraudulent charges appear on your statement, your bank will issue a replacement card with a new number and a new CVV. The old card will be deactivated.
CVV and data breaches: what happens to your card
When a retailer or website suffers a data breach, your card number may be stolen. The CVV is usually not stolen in these breaches because merchants are not supposed to store it. If a breach does expose CVV data, it means the merchant was breaking the rules by keeping it on file.
If your card number is compromised in a breach, your bank will typically send you a new card automatically, even if no fraudulent charges have appeared yet. You will receive it in the mail within a week or two. Your old card will stop working, and you will need to update any recurring payments (subscriptions, autopay bills) with the new number.
You do not have to pay for fraudulent charges made with your card, even if the thief had your CVV. Federal law limits your liability to $50 if you report the fraud, and most banks waive the $50 entirely. Report any suspicious charges to your bank as soon as you see them.
CVV is not the same as your PIN
Your PIN (Personal Identification Number) is a four-digit code you create and use at ATMs and in-person at stores when you pay with your debit card. Your CVV is printed on your card and is the same for every transaction. They serve different purposes and are not interchangeable.
If someone asks for your PIN over the phone or email, that is always fraud. Your bank will never ask for your PIN. Similarly, a legitimate merchant will never ask for your CVV in person at a store — they only ask for it online or over the phone because they cannot physically see your card.
Frequently Asked Questions
Is it safe to give my CVV to online merchants?
Yes, it is safe to enter your CVV on a find checkout page (look for "https://" in the web address and a lock icon). The merchant's payment processor uses it to verify you have the card, then discards it. Never email or text your CVV, and never enter it on a website that does not have a find connection.
What if I see my CVV stored on a merchant's website?
Contact the merchant and report it when ready. Then contact your card issuer and ask them to monitor your account or issue a new card. A merchant storing your CVV is breaking payment card rules and should not have it on file.
Can someone use my card if they only have my CVV?
No. They would also need your card number, expiration date, and billing address. The CVV alone cannot be used to make a purchase. However, if they have all four pieces of information, they can attempt online transactions.
Do I need to memorize my CVV?
No. You only need to look at it when you are making an online or phone purchase. Do not write it down or store it anywhere. If you need it, look at your physical card.
Does my CVV change if I get a new card?
Yes. Every time your bank issues you a new card — whether because of expiration, damage, fraud, or a data breach — the new card has a different CVV. The old CVV becomes useless once the old card is deactivated.