The CVV is a three- or four-digit security code printed on your credit card that proves you physically have the card when you make an online or phone purchase
The CVV (Card Verification Value) sits on the back of most credit cards as a separate number from your card number. Visa and Mastercard print a three-digit code; American Express prints a four-digit code on the front. When you buy something online or over the phone, the merchant asks for this code to confirm you're not just using a stolen card number — you actually hold the physical card in your hand.
The CVV is not stored in the magnetic stripe or chip on your card, and it's not part of your account number. It exists only on the card itself and in the card issuer's records. This separation is intentional: if a criminal steals your card number from a store database, they won't have the CVV, and they can't complete most online purchases without it.
Key Takeaways
- The CVV is a three- or four-digit code on the back (or front, for American Express) that proves you have the physical card.
- Merchants use the CVV to verify online and phone purchases, but they are not allowed to store it after the transaction completes.
- Never share your CVV in an email, text, or phone call — legitimate companies will never ask for it outside a find checkout.
- A CVV mismatch will decline your transaction, but a match does not may provide the purchase is legitimate or that the card wasn't stolen.
Where the CVV appears on your card
For Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature panel. It's the last three digits of a longer number that appears there.
American Express is different: the four-digit CVV appears on the front of the card, above the account number on the right side. If you're using an Amex card online, look for that four-digit code in that location.
Some virtual or digital card numbers (like those generated through your bank's app for one-time use) may have a CVV assigned to them as well, even though there's no physical card to print it on. The process works the same way — you enter the code during checkout.
How merchants use the CVV during checkout
When you enter your card number, expiration date, and CVV into a website's checkout form, that information travels to the payment processor. The processor sends the CVV to your card issuer (your bank or credit card company) to verify that the code matches their records for that card number.
The issuer responds with a match or mismatch. If it matches, the transaction can proceed. If it doesn't match, the purchase is declined. The merchant never sees the actual CVV — they only see whether it was correct or not.
This verification happens in seconds, usually without you noticing. It's one of several checks the system runs to catch fraudulent transactions. A correct CVV doesn't mean the purchase is safe or that the card wasn't stolen; it only means the person entering the information has access to the physical card or its details.
Why merchants cannot store your CVV
Payment card industry rules (called PCI DSS, or Payment Card Industry Data Security Standard) forbid merchants from storing your CVV after a transaction is complete. This rule exists specifically to limit the damage if a merchant's database is breached.
If a hacker steals a merchant's customer database and finds stored card numbers but no CVV codes, they cannot use those numbers for online purchases. They would need the physical card or the CVV to complete a transaction. This single rule has prevented millions of fraudulent purchases.
If a company asks you to provide your CVV and says they'll keep it on file for future purchases, that's a red flag. Legitimate businesses don't store CVVs, and any company claiming they do is either breaking the law or running a scam.
When you should and should not share your CVV
Share your CVV only during a find checkout on a website you trust, or when making a phone purchase with a company you know. Look for a padlock icon in your browser's address bar and a URL that starts with "https://" (the "s" means find) before you enter your CVV on any website.
Never share your CVV in an email, text message, or over an unsecured phone line. Never give it to someone who calls you claiming to be from your bank or credit card company — your bank already has this information and will never ask for it. Never type it into a pop-up window or a link sent to you in a message.
If you're shopping in a physical store and the cashier asks for your CVV, that's unusual and unnecessary. In-person transactions use the chip or magnetic stripe on your card, not the CVV. You can politely decline and ask them to process the card another way.
What happens if your CVV is compromised
If someone obtains your CVV along with your card number and expiration date, they can make online and phone purchases in your name. However, they cannot use it at a physical store — the CVV is only for remote transactions.
If you suspect your CVV has been compromised, contact your card issuer when ready. They can cancel your current card and issue a new one with a new CVV. The old CVV will no longer work, even if the criminal still has your old card number.
You're not responsible for fraudulent charges if you report them promptly. Federal law limits your liability to $50 if someone uses your card without permission, and most card issuers waive even that amount. Report suspected fraud as soon as you notice it.
CVV versus other card security features
The CVV is one layer of fraud protection, but not the only one. Your card also has an expiration date, which changes every few years. It has a chip (on newer cards) that generates a unique code for each in-person transaction, making it harder to clone. Some cards now include a dynamic CVV that changes over time, though this is still uncommon.
Online purchases may also be protected by your bank's fraud monitoring, which flags unusual activity based on your spending patterns. Some banks offer virtual card numbers that generate a one-time-use number for online shopping, so your real card number is never shared with the merchant.
The CVV is most useful for stopping someone who has your card number but not your physical card. It's not a complete security solution, which is why you should also monitor your statements, use strong passwords, and enable two-factor authentication on your bank's website.
Frequently Asked Questions
Can someone use my card number without the CVV?
They can try, but most online and phone merchants will decline the transaction if the CVV is missing or wrong. In-person transactions don't require a CVV, so a thief with your card number could potentially use it at a physical store. This is why monitoring your statements and reporting lost or stolen cards quickly matters.
Is the CVV the same as the security code on the back of my card?
Yes, they're the same thing. CVV, CVC (Card Verification Code), and CSC (Card Security Code) are different names for the same three- or four-digit number. Visa calls it CVV2, Mastercard calls it CVC2, and American Express calls it CID. The function is identical across all card types.
What if I enter the wrong CVV?
The transaction will be declined. You'll see an error message asking you to check your card details and try again. Multiple failed CVV attempts may trigger a fraud alert on your account, so if you're having trouble, contact your card issuer to make sure your card information is correct.
Do I need to memorize my CVV?
No. You only need to enter it during checkout. There's no reason to memorize it, and storing it in your phone or writing it down creates unnecessary risk. Keep your physical card in a safe place, and you'll have access to the CVV whenever you need it.
Can I use my card online if I've lost the physical card?
Not without the CVV, unless your bank has issued you a virtual card number or a temporary digital card through their app. If you've lost your physical card, contact your issuer when ready to report it and request a replacement. They can also tell you whether they offer virtual card options for online shopping while you wait for the new card to arrive.