The CVV is a three- or four-digit security code printed on your card that proves you physically hold it

The CVV (Card Verification Value) is a short number on the back or front of your credit card that acts as proof you own the card. When you enter it during an online or phone purchase, the merchant knows you have the physical card in your hand — not just your card number, which could have been stolen from a data breach or written down by someone else.

The code is printed, not embedded in the card's chip or magnetic stripe. This means a thief who steals your card number alone cannot use it online without also knowing this number. It is one of the few pieces of information that should never be stored, shared, or written down.

Different card networks call it by different names — Visa and Discover call it CVV, Mastercard calls it CVC, and American Express calls it CID — but they all serve the same purpose.

Key Takeaways

  • The CVV is a three- or four-digit code printed on your card that proves you physically hold it when you make an online or phone purchase.
  • Visa and Discover cards have a three-digit CVV on the back; Mastercard has a three-digit CVC on the back; American Express has a four-digit CID on the front.
  • Never give your CVV to anyone who calls you or emails you, even if they claim to be from your bank or card company.
  • Legitimate merchants ask for the CVV only at checkout, and your bank never needs it because they already have it on file.
  • A CVV does not protect you from in-person fraud if your physical card is stolen, because the thief can use it at a store without entering the code.

Where to find your CVV on different card types

The location and length of the CVV depend on which card network issued your card. On Visa, Mastercard, and Discover cards, the code is a three-digit number printed on the back of the card, to the right of the signature strip. On American Express cards, the code is four digits and appears on the front, above the card number on the right side.

The code is always printed in a different color or font than the rest of the card to make it stand out. If you cannot find it, call the number on the back of your card and ask customer service to read it to you — they can do this because they have your account open and can verify your identity.

When merchants ask for your CVV and when they should not

Legitimate merchants ask for your CVV only at the moment of purchase — during online checkout, over the phone with a customer service representative, or occasionally when you are disputing a charge. The code is meant to be entered once and then forgotten.

You should never give your CVV to anyone who contacts you first, even if they claim to be from your bank, your card company, or a store where you shop. Banks and card companies already have your CVV on file and will never ask you to provide it. If someone calls or emails asking for it, hang up or delete the message and call the customer service number on the back of your card instead.

Merchants also should not ask for your CVV when you are making a purchase in person at a physical store. If a cashier or card reader asks for it, that is a sign of fraud or a malfunctioning terminal — stop the transaction and use a different payment method.

What the CVV does and does not protect you from

The CVV protects you from card-not-present fraud, which is when someone uses your card number without having the physical card. If a thief steals your card number from a data breach or a receipt, they cannot complete an online purchase without also knowing the CVV. This is why online merchants require it.

The CVV does not protect you if your physical card is stolen. A thief who has your card can use it at a store, gas pump, or ATM without knowing the CVV, because those transactions do not require it. If your card is lost or stolen, call your card company when ready to report it, and they will cancel the card and send you a replacement.

The CVV also does not protect you from fraud on your account if someone gains access to your online banking login or your card company's website. In those cases, the thief can see your CVV on file and use it. This is why a strong, unique password and two-factor authentication on your bank account are just as important as keeping your CVV secret.

Why you should never save your CVV online

Some websites and apps offer to save your CVV so you do not have to enter it on future purchases. You should decline this offer every time. If the website is hacked or the app is compromised, a thief gains access to both your card number and the one piece of information that proves you have the card.

Legitimate payment services like Apple Pay, Google Pay, and PayPal do not store your CVV. Instead, they store a token — a substitute code that merchants cannot use to make purchases on their own. If you want to save your card for faster checkout, use one of these services instead of letting a retailer store your CVV directly.

What to do if you think your CVV has been compromised

If you believe your CVV has been exposed — for example, because a website you used was hacked or you gave it to someone you now suspect was fraudulent — contact your card company when ready. You do not need to wait for fraudulent charges to appear. Tell them you are concerned your CVV may have been compromised, and ask them to issue you a new card with a new CVV.

Most card companies can issue a replacement card within one to two business days if you request it by phone. The new card will have a different number and a different CVV, which makes the old code useless to anyone who may have seen it. You will need to update any merchants or services where you have saved your card information, such as subscription services or stored payment methods.

How the CVV fits into your overall card security

The CVV is one layer of protection, but it is not the only one. Your card also has a chip (on newer cards) that creates a unique code for each transaction, making it harder to counterfeit. Your card company monitors your account for unusual activity and can freeze your card if they spot suspicious charges. And federal law limits your liability for fraudulent charges to $50 if you report them promptly.

The most important thing you can do is treat your CVV like you treat your PIN at an ATM — keep it to yourself, never write it down, and never give it to anyone who contacts you first. Combined with a strong password on your bank account and regular monitoring of your statements, this straightforward habit prevents most card fraud.

Frequently Asked Questions

Can someone use my card number without the CVV?

In person, yes — a thief with your physical card can use it at a store or ATM without knowing the CVV. Online or over the phone, no — most merchants require the CVV to complete the transaction. This is why the CVV is sometimes called a "security code."

Is it safe to give my CVV over the phone?

Yes, if you initiated the call and you are speaking with a merchant or service you trust. Never give it to someone who called you first, even if they claim to be from your bank. Legitimate companies will never ask you to provide it unsolicited.

What happens if I lose my card?

Call your card company when ready to report it lost or stolen. They will cancel the card and issue a replacement with a new number and a new CVV. You are not responsible for fraudulent charges made after you report the loss, as long as you report it promptly.

Do I need to memorize my CVV?

No. You only need to know it when you are making a purchase. It is actually safer not to memorize it, because that reduces the chance you will accidentally say it aloud or write it down where someone else can see it.

Why does American Express have a four-digit code instead of three?

American Express uses a four-digit code because their cards are structured differently — the code is printed on the front rather than the back. The extra digit provides the same level of security as the three-digit codes used by other networks.