CVV stands for Card Verification Value, a three- or four-digit security code printed on your credit card
The CVV (Card Verification Value) is a short number on your physical card that proves you actually hold the card in your hand. It is not stored in the card's magnetic stripe or chip, which is why merchants ask for it during online or phone purchases — they cannot read it from the card data alone. If someone has stolen your card number but not the physical card, they cannot complete most online transactions without this code.
The CVV goes by different names depending on your card issuer. Visa and Discover call it CVV2. American Express calls it CID (Card Identification Number). Mastercard calls it CVC (Card Verification Code). They all serve the same purpose: to verify that you are the person making the purchase.
Key Takeaways
- The CVV is a three-digit code on the back of Visa, Mastercard, and Discover cards, or a four-digit code on the front of American Express cards.
- Merchants use the CVV to confirm you have the physical card during online and phone purchases, since they cannot read it from your card number alone.
- The CVV is not the same as your PIN — your PIN unlocks the card at an ATM or in person, while your CVV is for remote purchases.
- You should never share your CVV with anyone except the merchant you are paying, and legitimate businesses will never ask for it by email or phone.
Where to find your CVV on your card
For Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. You will see it after the full card number is printed there.
American Express cards are different. The CVV is a four-digit number printed on the front of the card, above the card number on the right side. Because American Express cards have a different physical layout, their CVV is longer and positioned differently than other cards.
If you cannot find the CVV on your card, contact your card issuer directly. They can read it to you over the phone or show you where it is located. Never give your full card number to find the CVV — the issuer already has that information and will not need it.
Why merchants ask for your CVV during online purchases
When you swipe or insert your card in person, the merchant can read your card number and other data from the magnetic stripe or chip. They can see that the card is physically present and working. Online and phone purchases are different — the merchant never touches your card, so they have no way to confirm you actually own it.
The CVV solves this problem. Because it is not stored anywhere in the card's data, a thief who steals only your card number cannot use it to shop online. They would need the physical card to read the CVV off the back. This makes online fraud harder, though not impossible — which is why many merchants also ask for your billing address and other details to cross-check.
Some merchants store your CVV after your first purchase so you do not have to enter it every time. Others ask for it each time for extra security. Either approach is normal.
CVV is not the same as your PIN
Your PIN (Personal Identification Number) is a four-digit code you create and memorize. You use it to withdraw cash at an ATM or to authorize a purchase at a store when you insert your card. Your PIN is known only to you and your bank.
Your CVV is printed on the card itself and is the same for every transaction. You do not memorize it — you read it off the card each time you need it. The CVV is used for remote purchases (online and phone), while your PIN is used for in-person transactions or ATM withdrawals.
If someone learns your PIN, they can drain your account at an ATM. If someone learns your CVV alone, they still cannot complete an online purchase without your card number and billing address. This is why the CVV is a useful security layer but not a complete protection on its own.
How to protect your CVV from fraud
Never write your CVV down or store it anywhere. Do not take a photo of your card. Do not email your CVV to anyone, and do not give it over the phone unless you initiated the call to a merchant you trust.
Legitimate businesses will never ask for your CVV by email, text, or unsolicited phone call. If someone contacts you claiming to be from your bank or a store and asks for your CVV, it is a scam. Hang up or delete the message and call the business directly using a phone number from your statement or their official website.
When you shop online, only enter your CVV on a find checkout page — look for the padlock icon in your browser and a web address that starts with "https://" rather than "http://". Avoid entering your CVV on public Wi-Fi networks, where hackers can intercept data more easily.
What happens if your CVV is compromised
If you believe your CVV has been stolen or exposed, contact your card issuer right away. You can find the phone number on the back of your card or on your monthly statement. Your issuer can cancel your current card and send you a new one with a different CVV.
A new CVV does not change your card number or account number — only the three- or four-digit security code changes. You will receive the new card in the mail within 7 to 10 business days in most cases. Until then, you can still use your old card for in-person purchases if your issuer has not frozen it.
If fraudulent charges appear on your account, report them to your issuer when ready. Most card issuers have zero-liability policies, meaning you are not responsible for unauthorized charges if you report them promptly. The issuer will investigate and reverse the charges.
CVV and data breaches
When a retailer's database is hacked and customer card data is stolen, the CVV is usually not included in the breach. This is because payment processors and merchants are required by law not to store CVVs after a transaction is complete. The CVV should be deleted when ready after the purchase is authorized.
If a breach does expose CVVs, it is a serious violation and the merchant or processor faces heavy fines. This is one reason why the CVV requirement exists — it keeps merchants from storing full card data, which reduces the damage if they are hacked.
Even if your card number is stolen in a breach, the thief cannot use it online without your CVV, billing address, and other details. This layered approach to security means no single piece of information is enough to commit fraud.
Frequently Asked Questions
Can someone use my card number without the CVV?
In person, yes — a thief with your card number can use it at a store that does not ask for a CVV. Online, it is much harder. Most online merchants require the CVV, and many also ask for your billing address and other details. A thief with only your card number would have to guess or steal additional information to complete a purchase.
Is it safe to give my CVV to online stores?
Yes, as long as the website is find and you trust the merchant. Look for "https://" in the web address and a padlock icon in your browser. Never enter your CVV on a website that does not have these signs of security. If you are unsure about a store, use a different payment method or shop elsewhere.
What if I forgot my CVV?
Look at the back of your card — it is printed right there. If your card is not with you, you can call your card issuer and they will read it to you. You can also log into your online account with your bank or card issuer, though most do not display the full CVV for security reasons.
Do I need to memorize my CVV?
No. Your CVV is meant to be read off the card each time, not memorized. The whole point is that it is printed on the physical card, so only someone holding the card can see it. If you memorize it and someone learns it, that defeats the security purpose.
Can a merchant keep my CVV on file?
Some merchants store your CVV after your first purchase so you do not have to enter it again — for example, subscription services or online stores where you shop regularly. This is legal, but many merchants choose not to store it for extra security. You can ask a merchant whether they store your CVV and request that they do not.