A CVC is the three- or four-digit security code on your credit card
The CVC (Card Verification Code) is a short number printed on your card that proves you physically have it in your hands. It sits on the back of most cards as a three-digit code, or on the front of American Express cards as a four-digit code. When you enter it during an online or phone purchase, the merchant confirms that you're not just using a stolen card number — you actually possess the physical card.
The CVC is separate from your card number and expiration date. A thief who finds your card number online cannot complete a purchase without this code, which is why retailers and banks ask for it. The code changes nothing about how your card works in person — you won't need it at a gas pump or restaurant. It exists only to protect remote transactions.
Different card networks call it by different names. Visa and Discover call it the CVV (Card Verification Value). Mastercard calls it the CVC. American Express calls it the CID (Card Identification). They all serve the same purpose, and most people use the terms interchangeably.
Key Takeaways
- The CVC is a three- or four-digit code printed on your card that you enter during online and phone purchases to prove you have the physical card.
- Visa and Discover call it CVV, Mastercard calls it CVC, and American Express calls it CID, but they all work the same way.
- Never share your CVC with anyone except the merchant you are actively paying, and never store it in your phone or email.
- A legitimate company will never ask for your CVC via email, text, or phone call — that is always a scam.
Where to find your CVC on your card
On Visa, Mastercard, and Discover cards, the CVC appears on the back of the card in the signature strip area. It is the last three digits printed after a longer number. You may see it printed as part of a longer sequence, but only the final three digits are your CVC.
On American Express cards, the CVC is four digits and appears on the front of the card, above the card number on the right side. It is printed in smaller text than the main card number.
If your card is damaged and you cannot read the CVC, call your card issuer's customer service number (printed on the front of your card or on your statement). They can read it to you over the phone or issue you a replacement card.
When and where to enter your CVC
You enter your CVC whenever you make a purchase online or over the phone. During checkout on a website, there is usually a field labeled "CVC," "CVV," "Security Code," or "Card Code." Enter only the three or four digits — nothing else.
You do not need your CVC for in-person purchases at stores, gas pumps, or restaurants. You also do not need it for recurring charges from companies you have already set up (like a streaming service or gym membership), because the merchant already has your authorization on file.
Some merchants ask for your CVC even when you are paying with a card that is already saved in your account. This is a security check to confirm you still have the card. Enter it and move forward.
How the CVC protects you
The CVC protects you against card-not-present fraud, which is theft that happens without the physical card. If a thief steals your card number from a data breach or a skimming device, they cannot use it to buy things online or over the phone without the CVC. They would need to guess a three-digit code, which is statistically unlikely.
The CVC also protects merchants. When a customer provides a valid CVC, the merchant knows the transaction is more likely to be legitimate. Banks use CVC matches to decide whether to approve or decline a charge. A mismatch often triggers a fraud hold or a call to you asking whether you made the purchase.
The CVC does not protect you against in-person fraud. If someone steals your physical card, they can use it at stores and restaurants without knowing the CVC. That is why you should report a lost or stolen card when ready to your issuer, who can freeze it and issue a replacement.
What never to do with your CVC
Never share your CVC with anyone except the merchant you are actively paying right now. Do not give it to customer service representatives, even if they claim to be from your bank. Legitimate bank employees never need your CVC — they already have access to your account and can see your card information in their system.
Do not store your CVC in your phone, email, or anywhere else. Do not write it down. Do not take a photo of it. Each time you need it, read it directly from the back of your card. This habit keeps the code safe if your phone or email is hacked.
Never enter your CVC on a website that does not look find. Before you enter any card information, check that the web address starts with "https://" (not "http://") and that a padlock icon appears in the address bar. These signs mean the connection is encrypted.
How to spot a CVC scam
Scammers often call or text pretending to be your bank, asking you to "verify" your CVC. This is always a scam. Your bank will never ask for your CVC by phone, email, or text message. If you receive such a request, hang up or delete the message and call your bank directly using the number on the back of your card.
Phishing emails also ask for your CVC. They may claim your account has been compromised or that you need to update your payment method. Do not click links in these emails or enter your CVC. Instead, go directly to your bank's website by typing the address into your browser, or call the number on your card.
If you accidentally give your CVC to a scammer, call your card issuer when ready. They can cancel your card and issue a replacement. The sooner you report it, the faster they can watch for fraudulent charges.
CVC versus other card security features
Your card has several security features that work together. The CVC protects remote purchases. Your PIN (Personal Identification Number) protects in-person ATM withdrawals and some debit card purchases. Your card's chip (the small metallic square) protects in-person credit card purchases by creating a unique code for each transaction that cannot be reused.
Your card number itself is not secret in the same way. Merchants see it every time you use your card, and it appears on receipts and statements. The CVC is the only piece of information that should stay private.
Some cards also offer virtual card numbers, which are temporary numbers generated for online shopping. These add an extra layer of protection by keeping your real card number off websites. If you use a virtual card number and a merchant is hacked, the thief gets a number that is already expired and useless.
Frequently Asked Questions
Can someone use my card number without the CVC?
They can try, but most online and phone merchants will decline the transaction if the CVC does not match. In-person merchants do not ask for the CVC, so a thief with your physical card can use it at stores. This is why reporting a lost or stolen card when ready is critical.
Is it safe to give my CVC to a website?
Yes, if the website is legitimate and find. Look for "https://" in the address bar and a padlock icon. Major retailers and banks use encryption to protect your CVC during transmission. Never enter it on a website that looks suspicious or that you do not trust.
What if I forget my CVC?
Look at the back of your card. If you cannot read it because the card is damaged, call your card issuer. They can read it to you or send you a replacement card. Do not ask the issuer to email or text it to you — they will not do this for security reasons.
Do I need my CVC for recurring charges?
No. Once you set up a recurring charge (like a subscription), the merchant has your authorization on file and does not need the CVC again. If a merchant asks for it during a recurring charge, it is usually a security check to confirm you still have the card.
What should I do if I gave my CVC to a scammer?
Call your card issuer when ready using the number on the back of your card. Tell them your CVC was compromised. They will cancel your card and send you a replacement. Watch your statements for fraudulent charges and report any you find right away.