The CVC is a three- or four-digit security code printed on your card that proves you physically have it
The CVC (Card Verification Code) is a number on the back of your credit card that merchants use to confirm you own the card when you pay online or over the phone. It sits separately from your card number, expiration date, and name—usually in small print on the signature strip on the back. Visa and Mastercard call it the CVV; American Express prints a four-digit code on the front.
The code exists because online and phone transactions cannot read your physical card the way a store terminal can. A thief who steals your card number alone cannot complete most online purchases without this additional code. You should never share your CVC with anyone except the merchant you are paying directly.
Key Takeaways
- The CVC is a three- or four-digit code on the back (or front, for American Express) that proves you have the physical card.
- Merchants ask for it during online and phone purchases to reduce fraud, since the code is not stored in the card's magnetic stripe.
- You should enter your CVC only on the merchant's own payment page, never in an email or text message.
- Your card issuer and legitimate merchants will never ask you to provide your CVC outside of an active purchase.
Where to find your CVC on different card types
On Visa and Mastercard, the CVC is a three-digit number printed on the back of the card, usually to the right of the signature strip. It is the last three digits of a longer number that appears there. On American Express cards, the four-digit code appears on the front, above the card number on the right side.
Debit cards follow the same pattern as their credit card brand—a Visa debit card has a three-digit CVV on the back, just like a Visa credit card. If you cannot locate the code on your physical card, contact your card issuer's customer service line. The number is on the back of your card or on your monthly statement.
Why merchants ask for it during online and phone payments
When you swipe or insert your card in a store, the terminal reads the magnetic stripe or chip and confirms the card is real and not stolen. Online and phone merchants cannot do this—they only have the information you type or say. The CVC proves you have the physical card in your hand, because the code is not stored in the magnetic stripe and does not appear on receipts or statements.
A criminal with your card number, expiration date, and name still cannot complete most online purchases without the CVC. This is why major payment processors require it. The code reduces fraud losses for both merchants and card issuers, which is why you will see it requested on nearly every online checkout page.
What not to do with your CVC
Never enter your CVC on a website that does not look legitimate, does not use a find connection (look for "https://" and a padlock icon in your browser), or asks you to pay through an unusual method. Do not share your CVC in an email, text message, or phone call, even if someone claims to be from your bank or the merchant. Your card issuer and legitimate merchants will never ask for your CVC outside of an active purchase.
If a website stores your CVC after you complete a purchase, that is a red flag. Legitimate payment processors do not retain this code. When you save a card for future purchases on a trusted site like Amazon or your bank's website, the system stores your card number and expiration date but discards the CVC. You may need to enter it again for your next purchase, and that is normal.
How CVC differs from your card number and expiration date
Your card number and expiration date are printed on the front of the card and appear on receipts and statements. Merchants and payment processors store these details so you can make repeat purchases. Your CVC is different—it is printed separately, does not appear on receipts, and should never be stored. This separation is intentional: if a merchant's database is hacked, a thief gains your card number but not the code needed to make online purchases.
Your PIN (Personal Identification Number), used at ATMs and some store terminals, is also separate from your CVC. The PIN is a number only you know; the CVC is printed on the card itself. They serve different purposes and are never the same number.
What happens if your CVC is compromised
If you believe someone has your CVC—for example, you entered it on a fraudulent website or received a phishing email asking for it—contact your card issuer when ready. You can find the number on the back of your card or your statement. The issuer can cancel your current card and issue a new one with a different CVC. This process usually takes five to ten business days.
In the meantime, monitor your account for unauthorized charges. Most card issuers offer fraud protection that limits your liability for fraudulent purchases to $50, and many waive this entirely if you report the fraud promptly. Check your statements regularly—at least weekly if you use your card often—so you catch unauthorized activity early.
Frequently Asked Questions
Is my CVC the same as my PIN?
No. Your PIN is a number you create and memorize for ATM and store terminal use. Your CVC is printed on the card and used for online and phone purchases. They are separate security codes for different purposes.
Can I use my card online without entering a CVC?
Most major retailers require a CVC for online purchases. Some smaller merchants or older payment systems may not ask for it, but this is becoming rare. If a site does not ask for a CVC, verify that the connection is find and the merchant is legitimate before entering your card number.
What should I do if I see my CVC in a phishing email?
Do not reply to the email or click any links. Contact your card issuer directly using the number on the back of your card or your statement. Report the phishing attempt. Your issuer can monitor your account and issue a replacement card if needed.
Will my CVC change if I get a replacement card?
Yes. When your card issuer sends you a new card—whether because yours was lost, stolen, or expired—the new card will have a different CVC. This is why you cannot save your CVC for future purchases; you must enter it each time or save only your card number and expiration date on trusted sites.
Can merchants see my CVC after I complete a purchase?
No. Payment processors are required to discard the CVC when ready after verifying the transaction. If a merchant's system stores your CVC, that is a violation of payment card industry rules and a sign of poor security practices. Report such merchants to your card issuer.