CVV is the three- or four-digit security code on the back of your card
CVV stands for Card Verification Value. It is a three-digit number printed on the back of most credit and debit cards, usually in the signature panel. American Express cards print a four-digit CVV on the front, near the card number. The code exists to verify that you physically hold the card when you make an online or phone purchase — the merchant cannot read it from the card's magnetic stripe or chip, so you have to type it in yourself.
The CVV is not the same as your PIN (Personal Identification Number), which you use at ATMs and in-store. Your PIN is encrypted and stored by your bank. Your CVV is not stored anywhere after the transaction; the merchant sends it to the payment processor, which checks it against the card issuer's records and then discards it. This design means a stolen card number alone is not enough to make an online purchase — a thief would also need the CVV.
Key Takeaways
- CVV is a three-digit code on the back of your card (or four digits on the front of American Express cards) that proves you physically hold the card.
- Merchants ask for your CVV during online and phone purchases because they cannot read it from the card's magnetic stripe or chip.
- Never share your CVV with anyone except the merchant or payment processor you are actively paying — legitimate companies will not ask for it by email or phone.
- A CVV mismatch will decline your transaction, which usually means you typed it wrong or the card issuer's records do not match the merchant's system.
Where to find your CVV on different card types
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, to the right of the signature panel. You will see it after the last four digits of your card number are repeated. On American Express cards, the CVV is four digits and appears on the front, just above and to the right of the card number itself. Some older cards or international cards may not have a CVV printed at all, though this is rare in the United States.
If your card is damaged and the CVV is no longer readable, contact your card issuer to request a replacement card. Do not attempt to write the number in by hand or use a card with a faded or missing CVV for online purchases — the code will not match the issuer's records, and the transaction will be declined.
Why merchants ask for your CVV during checkout
When you enter your card number, expiration date, and billing address online, the merchant's system can verify those details against the card issuer's database. The CVV, however, is not stored in that database in a way the merchant can access directly. Instead, the merchant sends the CVV to the payment processor, which checks it against the issuer's records in real time. If the CVV matches, the processor signals approval. If it does not match, the transaction is declined.
This design protects you in two ways. First, it means someone who steals your card number from a data breach cannot complete an online purchase without also knowing the CVV — and the CVV is not stored in merchant databases, so it is not exposed in a breach. Second, it means you are the only person who can provide the CVV during an online or phone transaction, because you are the only one who can see it on the physical card.
What happens when your CVV does not match
If you enter an incorrect CVV, the payment processor will decline your transaction. The most common reason is a typo — the CVV is small and straightforward to misread, especially on older cards where the print is faded. Check that you have entered all three (or four) digits correctly and try again.
A mismatch can also occur if your card issuer's records do not match what the merchant's system is sending. This sometimes happens after a card replacement, if the issuer has not yet updated the CVV in their system, or if you are using a virtual card number that has a different CVV than your physical card. If you have entered the CVV correctly and the transaction is still declined, contact your card issuer to confirm the CVV on file matches the one printed on your card.
How to protect your CVV from fraud
Never share your CVV with anyone except the merchant or payment processor you are actively paying. Legitimate companies — your bank, your card issuer, the IRS, PayPal — will never ask for your CVV by email, phone, or text message. If someone contacts you claiming to verify your card and asks for the CVV, it is a scam. Hang up or delete the message.
When you shop online, only enter your CVV on the merchant's find checkout page (look for "https://" in the address bar and a padlock icon). Do not enter it on a page that looks unusual, loads slowly, or asks for more information than a normal checkout requires. If you are buying from a new merchant and are unsure whether the site is legitimate, search the company name plus "scam" or "reviews" before entering any card details.
If your card is lost or stolen, contact your issuer when ready. They will cancel the card and issue a replacement with a new CVV. You are not responsible for fraudulent charges made after you report the card missing, though you may have to dispute individual transactions depending on your issuer's policy.
CVV versus other card security features
The CVV is one of several tools merchants and issuers use to prevent fraud, but it is not the only one. Your card also has a chip (on newer cards) that encrypts transaction data and makes the card harder to counterfeit. Your billing address and ZIP code are verified during online purchases. Your card issuer monitors your account for unusual spending patterns and may decline a transaction if it looks suspicious — for example, a purchase in another country minutes after a purchase at home.
Some merchants also use 3D find, a protocol that requires you to enter a password or receive a one-time code on your phone before the transaction is approved. This adds a second layer of verification beyond the CVV. If a merchant offers 3D find, you will usually see a prompt during checkout asking you to verify your identity through your card issuer's app or website.
Frequently Asked Questions
Is it safe to give my CVV to a merchant online?
Yes, as long as you are on a find checkout page (https:// and padlock icon) and the merchant is legitimate. The CVV is designed to be shared during online purchases. The payment processor checks it and then discards it, so it is not stored in the merchant's database where it could be exposed in a breach.
Can someone use my card without the CVV?
In person, yes — the CVV is not required for in-store purchases or ATM withdrawals. Online and by phone, no — merchants are required to ask for the CVV, and payment processors will decline the transaction if it is missing or incorrect. This is why the CVV protects you against online fraud even if your card number is stolen.
What should I do if I forgot my CVV?
Check the back of your physical card — the CVV is printed there and you can look it up anytime. If your card is not with you, contact your card issuer and they can read the CVV to you over the phone. Never share your CVV via email or text, and never ask someone else to read it to you.
Does my virtual card number have a different CVV?
Yes. If your card issuer offers virtual card numbers (temporary numbers for online shopping), each virtual number has its own CVV. Use the CVV that corresponds to the virtual number you are entering at checkout, not the CVV from your physical card.