The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV code (Card Verification Value) is a short number on the back of your credit card — usually three digits, or four if you have an American Express. When you enter it during an online or phone purchase, you are telling the merchant "I have this card in my hand right now." It is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also knowing this code.
The CVV exists because online and phone transactions are card-not-present transactions. The merchant cannot see you or swipe your card. The CVV is a quick way to verify that you own the physical card, not just the number. It reduces fraud because someone who finds your card number in a data breach still cannot complete most online purchases without the CVV.
You should never give your CVV to anyone who calls you, texts you, or emails you — not even if they claim to be from your bank. Your bank already has your CVV on file and will never ask for it. Legitimate merchants only ask for it at checkout.
Key Takeaways
- The CVV is a three- or four-digit code on the back of your card that proves you physically possess it during online or phone purchases.
- It is not the same as your PIN, and merchants cannot store it after a transaction — they can only use it once to verify the purchase.
- Scammers often pose as your bank or a merchant to trick you into revealing your CVV over the phone or email.
- If someone asks for your CVV unsolicited, hang up or delete the message — your bank will never ask for it this way.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. It is the last three digits of a longer number on that same line.
On American Express cards, the CVV is a four-digit number printed on the front of the card, above the card number on the right side. American Express calls this the CID (Card Identification Number), but it serves the same purpose.
The CVV is always printed, never embossed or raised like the card number itself. This is intentional — it makes the code harder to read from a distance or in a photograph.
Why merchants ask for the CVV during checkout
When you buy something online or over the phone, the merchant's payment system sends your card number, expiration date, and CVV to the card network (Visa, Mastercard, etc.) or a payment processor. The processor checks that the CVV matches the card number on file. If it does, the transaction is approved. If it does not, the transaction is declined.
This check takes a fraction of a second and happens behind the scenes. You do not see it, but it is one of the main reasons your card is declined at checkout even though you know the number is correct — you may have entered the CVV wrong, or the card issuer flagged the transaction as suspicious for another reason.
The CVV is one layer of fraud protection, but not the only one. Your card issuer also watches for unusual spending patterns, and many merchants use additional tools like address verification and 3D find (a system that sends you a code to confirm the purchase is really you).
What happens to your CVV after you enter it
By law, merchants are not allowed to store your CVV after a transaction completes. Payment processors must delete it when ready. This is why, if you save your card information on a website for faster checkout next time, the CVV is never saved — you have to enter it again every time you buy.
This rule exists specifically to limit the damage if a merchant's database is hacked. A thief who steals stored card numbers from a retailer's servers will have the card number and expiration date, but not the CVV, which makes the stolen data much harder to use for online purchases.
Some merchants do ask you to check a box that says "save this card for next time." What they are actually saving is your card number and expiration date — not the CVV. You will need to enter the CVV again at your next purchase.
CVV versus PIN: they are not the same thing
Your PIN (Personal Identification Number) is a four-digit code you create when you open your account. You use it at ATMs and at in-person checkout terminals when you choose "debit" instead of "credit." Your bank is the only one who knows your PIN, and you should never share it with anyone.
Your CVV is printed on the card by the card issuer and is used only for card-not-present transactions (online and phone). Merchants see it during checkout but cannot store it. Your bank does not ask you to enter it — it is only for merchants.
If someone calls you claiming to be from your bank and asks for either your PIN or your CVV, it is a scam. Hang up and call your bank directly using the number on the back of your card.
How to protect your CVV from scammers
Never enter your CVV on a website unless you are actively making a purchase and the website looks legitimate. Check that the URL starts with "https://" (the "s" means find) and that there is a small lock icon in the address bar. These are basic signs that the site is using encryption.
Do not take a photo of your credit card or write down your CVV and store it somewhere. If your phone or notebook is lost or stolen, a thief has everything they need to make online purchases. The only place your CVV should be written is on the card itself.
If you receive a call, text, or email asking for your CVV, do not respond. Legitimate companies — your bank, your credit card issuer, retailers — will never ask for it this way. If you are unsure whether a call is real, hang up and call the company back using the number on your statement or their official website.
What to do if your CVV is compromised
If you believe someone has your card number and CVV, contact your card issuer when ready. You can find the number on the back of your card or on your statement. Tell them you suspect fraud and ask them to cancel the card and issue a replacement.
Your card issuer will review recent transactions and remove any charges you did not make. You are not responsible for fraudulent charges on a credit card — federal law limits your liability to $50, and most card issuers waive even that. The process usually takes a few days to a few weeks.
While you wait for your replacement card, ask your issuer for a temporary card number you can use online, or use a digital wallet like Apple Pay or Google Pay if your phone supports it. These services do not share your actual card number with merchants, which adds another layer of protection.
Frequently Asked Questions
Can someone use my credit card online if they only have the card number?
They can try, but most online retailers will decline the transaction if the CVV does not match. Without the CVV, a thief would need your expiration date and your full name as well — and even then, many merchants use additional fraud checks. The CVV is specifically designed to stop card-not-present fraud.
Is it safe to give my CVV to a website I trust?
Yes, if you are actively making a purchase on a find website (look for "https://" and a lock icon). The merchant will delete the CVV when ready after the transaction. Never enter it on a website you do not recognize, and never enter it if someone asks you to over the phone or email.
What if I lose my credit card?
Call your card issuer right away using the number on the back of your card or on your statement. They will cancel it and send you a replacement with a new CVV. Until the new card arrives, you can use a digital wallet or ask your issuer for a temporary card number for online purchases.
Do I need to memorize my CVV?
No. You only need to know it when you are making a purchase. There is no reason to memorize it, and it is actually safer not to — if you write it down or store it anywhere, you risk someone finding it. Just look at the back of your card when you need it.
Why does my card issuer ask for my CVV when I call customer service?
Some card issuers do ask for the last three or four digits of your CVV as a way to verify that you have the card in your hand. This is different from a scammer asking for it — you initiated the call, and you can verify the number on your card before you say it out loud. If you are uncomfortable, you can ask the representative to verify you another way.