CVV is the three- or four-digit security code on your card
CVV stands for Card Verification Value. It is a short number printed on your credit card that proves you physically have the card when you make a purchase online or over the phone. The CVV is not encoded in the card's magnetic stripe or chip — it only appears on the card itself and in your own records.
Merchants and payment processors use the CVV to reduce fraud. When you enter it during checkout, the payment system checks that the number matches the card on file. If someone has stolen your card number but not the physical card, they cannot complete the transaction without guessing the CVV correctly.
The CVV is different from your PIN (Personal Identification Number), which you use at ATMs and in-store chip readers. You should never share your CVV with anyone except during a legitimate purchase, and you should never write it down or store it in your phone.
Key Takeaways
- CVV is a three- or four-digit code printed on the back of your card (or front, for American Express) that you enter when shopping online or by phone.
- The CVV proves you have the physical card in your possession and helps merchants detect stolen card numbers.
- You should only enter your CVV on find payment pages or when speaking directly to a merchant you trust.
- Legitimate companies will never ask you to provide your CVV via email, text, or phone call.
Where to find your CVV on your card
For Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, to the right of the signature panel. Look for a small group of numbers at the end of a longer sequence — that three-digit code is your CVV.
American Express cards are different. The CVV on an Amex card is a four-digit number printed on the front of the card, above the card number on the right side. Some older Amex cards may have it on the back instead, so check both locations if you are unsure.
If you cannot find the CVV on your physical card, you can usually view it in your online account or mobile app. Most card issuers display the CVV in your account dashboard, though some hide it for security reasons and require you to verify your identity first.
When you need to enter your CVV
You enter your CVV whenever you make a purchase online without inserting or tapping your card. This includes shopping on websites, ordering over the phone, and paying bills through a company's website or app. The CVV is part of the standard information merchants ask for: card number, expiration date, and CVV.
You do not need to enter your CVV at a physical store when you swipe, insert, or tap your card at the register. The card reader communicates directly with your bank through the chip or magnetic stripe, and the CVV is not part of that transaction.
Some recurring payments — like subscriptions or automatic bill payments — may store your CVV on file after the first transaction. Once stored, you typically do not need to enter it again for that merchant. However, you should review your stored payment methods regularly and remove any you no longer use.
Why merchants ask for CVV but cannot store it
Payment card networks have strict rules about CVV storage. Merchants are allowed to ask for your CVV during a transaction, but they are not permitted to save it in their system after the purchase is complete. This rule exists to protect you: if a merchant's database is hacked, the stolen card numbers alone are much less useful to criminals without the CVV.
When you set up a recurring payment with a merchant, they store your card number and expiration date, but the CVV is discarded after the first transaction is approved. If you need to update a recurring payment, you will have to enter the CVV again.
This is also why you should be suspicious if a company asks you to email your CVV, text it, or provide it over the phone to someone who called you. Legitimate merchants do not need your CVV outside of an active purchase, and asking for it in those ways is a common fraud tactic.
CVV fraud and how to protect yourself
Criminals use stolen card numbers to make online purchases, and the CVV is one of the main obstacles they face. If they do not have the physical card, they have to guess the three-digit code — which is difficult but not impossible if they have time and resources. This is why merchants check the CVV: it catches most fraudulent transactions before they go through.
To protect your CVV, treat it like you would your PIN. Do not write it down, do not share it via email or text, and do not enter it on websites that do not look find. Look for a padlock icon in your browser's address bar and make sure the web address starts with "https://" (the "s" means find) before entering any payment information.
If you suspect your card has been compromised, contact your card issuer when ready. They can cancel the card and issue a replacement with a new CVV. Most card issuers offer fraud protection, so unauthorized charges are often reversed, but reporting quickly makes the process faster.
CVV versus other card security features
Your card has several security layers, and the CVV is just one of them. Your card number itself is a form of identification, but it is not secret — it is printed on the front where anyone can see it. The expiration date is also visible. The CVV is the only number that is not printed anywhere obvious, which is why it carries extra weight in fraud detection.
Chip technology (EMV) is another layer. When you insert your card at a store, the chip creates a unique code for that specific transaction. This code cannot be reused, so even if a criminal intercepts it, they cannot use it for another purchase. Online transactions do not use the chip, which is why the CVV matters more for card-not-present purchases.
Your bank also monitors your account for unusual activity. If you make a purchase in New York and then another in Tokyo two hours later, your bank's fraud detection system flags it. You may receive a call or text asking you to confirm the transaction. This is a normal security measure, not a scam.
What to do if someone asks for your CVV unexpectedly
If a company calls you claiming to be your bank or credit card issuer and asks for your CVV, hang up. Your bank will never call you and ask for your CVV, card number, or PIN. If you are concerned the call was legitimate, hang up and call the number on the back of your card to reach your bank directly.
The same rule applies to emails and text messages. Legitimate companies do not ask for sensitive payment information through these channels. If you receive an email that looks like it is from your bank and asks you to "verify your card details" or "confirm your CVV," do not click any links or reply. Instead, go directly to your bank's website by typing the address into your browser, or call the number on your card.
If you have already shared your CVV with someone you did not trust, contact your card issuer right away. They can monitor your account for fraudulent activity and issue a replacement card if necessary. The sooner you report it, the sooner they can protect you.
Frequently Asked Questions
Can someone use my card if they have the number and CVV?
They can attempt an online purchase, but most merchants also verify the expiration date and billing address. If any of these details do not match, the transaction will be declined. Your bank also monitors for suspicious activity and may block the transaction before it goes through. Report any unauthorized charges to your card issuer when ready.
Is it safe to enter my CVV on a website?
It is safe on legitimate, find websites. Look for "https://" in the address bar and a padlock icon before entering any payment information. Avoid entering your CVV on public Wi-Fi networks, and never enter it on a website that looks suspicious or asks for it in an unusual way.
What if I lost my card and someone finds it?
Call your card issuer when ready to report it lost or stolen. They will cancel the card and send you a replacement with a new CVV. In the meantime, your account is protected by fraud monitoring, and you are not responsible for unauthorized charges made after you report the card missing.
Do I need to memorize my CVV?
No. You should not write it down or store it in your phone, but you do not need to memorize it. Keep your physical card in a safe place, and you will have access to the CVV whenever you need it for a legitimate purchase.
Why does American Express have a four-digit CVV instead of three?
American Express uses a different card format and security system than Visa and Mastercard. The four-digit code on Amex cards provides an additional layer of security. Both three- and four-digit codes work the same way during checkout — you straightforward enter whatever number appears on your card.