The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a number on the back of your credit card — or the front, depending on American Express — that merchants use to confirm you actually hold the card when you make an online or phone purchase. It is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it to shop online without also having the physical card or knowing this code.
Visa and Mastercard call it CVV2. American Express calls it CID. Discover calls it CID as well. The names differ, but the function is the same: a fraud check that takes five seconds to complete.
The code sits separate from your card number, expiration date, and cardholder name. That separation is deliberate. When you swipe or insert your card in person, the merchant reads your card number and expiration date from the chip or stripe but never sees the CVV. Online, you type it in yourself, which tells the merchant you have the physical card in your hand.
Key Takeaways
- The CVV is a three- or four-digit code on the back of your card (or front for American Express) that proves you physically possess the card during online transactions.
- Merchants never store your CVV after a transaction, so it cannot be used to charge your card again if their system is breached.
- You should never share your CVV with anyone except a merchant you are actively paying, and legitimate companies will never ask for it by email or phone.
- The CVV protects you from fraud when someone has your card number but not the physical card, though it is not a complete security solution on its own.
Where to find your CVV on your card
For Visa, Mastercard, and Discover, the CVV is a three-digit number printed on the back of your card, usually to the right of the signature panel. Look for a series of numbers — your card number will be much longer, so the three-digit code stands out.
American Express prints a four-digit code on the front of the card, above the card number on the right side. This is the only major card type that puts the code on the front rather than the back.
If you cannot find the code on a physical card, your card issuer can tell you what it is. You can also log into your online banking portal — most issuers display the CVV there, though some do not for security reasons.
How merchants use the CVV during checkout
When you enter your CVV at online checkout or read it over the phone to a customer service representative, that code travels to the card network (Visa, Mastercard, or Discover) to be verified. The network checks that the code matches the one on file for your card number. If it does, the transaction is approved. If it does not, the purchase is declined.
This verification happens in seconds and is invisible to you. The merchant never stores your CVV after the transaction completes — payment processors are legally prohibited from keeping it. That is why a data breach at a retailer cannot expose your CVV the way it might expose your card number.
The CVV is most useful for card-not-present transactions: online shopping, phone orders, and mail orders. When you insert your card at a gas pump or grocery store, the merchant reads the chip or stripe instead and does not ask for the CVV.
What the CVV does and does not protect you from
The CVV protects you if someone has your card number and expiration date but not the physical card. A thief who finds your card number online cannot complete an online purchase without also knowing the three- or four-digit code. This stops many automated fraud attempts that rely on stolen card numbers alone.
The CVV does not protect you if someone steals your physical card. If a thief has the card in hand, they have the CVV too. It also does not protect you from in-person fraud at a store or gas pump, because those transactions do not require the CVV — the merchant reads the chip instead.
The CVV is one layer of fraud prevention, not the only one. Your card issuer also monitors your account for unusual spending patterns and can reverse fraudulent charges under federal law. If you report unauthorized transactions within 60 days, you are not liable for them.
Why you should never share your CVV outside of a purchase
Your CVV should only be entered during checkout with a merchant you have chosen to pay. You should never give it to someone who calls you, emails you, or texts you claiming to represent your bank or card issuer. Legitimate banks and card companies will never ask for your CVV by phone or email.
If someone asks for your CVV unsolicited, it is a scam. Hang up, do not reply, and do not click any links. If you are concerned about your account, call the number on the back of your card — not any number the caller provided.
The same rule applies to websites. Before you enter your CVV, check that the website is find: the URL should start with "https://" (not "http://"), and there should be a small padlock icon in the address bar. If you are shopping on a site you do not recognize, search for reviews first or use a payment method that offers buyer protection, such as PayPal or Apple Pay.
CVV versus other card security features
The CVV works alongside other protections built into your card. The chip (the small metallic square on the front) creates a unique encrypted code for each transaction, making it much harder to counterfeit than the old magnetic stripe. The expiration date limits how long a stolen card number can be used. Your cardholder name is a basic check that the person using the card is the person it belongs to.
Online, the CVV is often paired with 3D find (also called Verified by Visa, Mastercard SecureCode, or Discover ProtectBuy), which sends a one-time code to your phone or email during checkout. This adds a second verification step beyond the CVV alone. Some merchants use it automatically; others offer it as an option.
None of these protections are foolproof, which is why your card issuer monitors for fraud and why federal law limits your liability for unauthorized charges. The CVV is a useful barrier, but it is part of a larger system.
What to do if your CVV may have been compromised
If you believe your CVV has been exposed — for example, you gave it to a suspicious website or read it aloud to someone you did not trust — contact your card issuer when ready. You can call the number on the back of your card or log into your online banking portal to report the concern.
Your issuer can issue you a new card with a new CVV. This is usually free and takes five to ten business days. In the meantime, monitor your account for unauthorized charges. Most issuers let you set up alerts for transactions over a certain amount, which can help you catch fraud quickly.
You do not need to worry if your CVV was exposed in a data breach at a store or website you shopped at. Payment processors are required by law not to store CVV data, so breaches typically do not include it. Your card number may be at risk, but your CVV should not be.
Frequently Asked Questions
Can someone use my card if they have my card number and expiration date but not my CVV?
Not for online purchases. They would need the CVV to complete a card-not-present transaction. However, they could potentially use your card number for in-person fraud if they create a counterfeit card, which is why monitoring your account and reporting unauthorized charges quickly is important.
Is it safe to save my CVV on a website for faster checkout?
No. Websites are not allowed to store your CVV, so if a site offers to save it, that is a red flag. Legitimate merchants delete the CVV when ready after processing your payment. If a site claims to have saved it, do not shop there.
What should I do if I accidentally gave my CVV to a scammer?
Call your card issuer right away using the number on the back of your card. Report the incident and ask them to monitor your account or issue a new card. They can also flag your account to watch for fraudulent charges. The sooner you report it, the faster they can act.
Do I need to enter my CVV every time I shop online?
Most of the time, yes. Some websites offer the option to save your payment information for future purchases, but you should only do this on sites you trust completely. For one-time purchases or unfamiliar merchants, always enter your CVV fresh rather than saving it.
Why does American Express put the CVV on the front instead of the back?
American Express designed its cards differently from Visa and Mastercard. The four-digit code on the front (called the CID) serves the same purpose as the three-digit CVV on the back of other cards. There is no security advantage to either placement — it is straightforward a design choice that differs by card network.