A CVV is a three- or four-digit security code printed on your credit card
The CVV (Card Verification Value) is a number your card issuer prints on the physical card itself — not encoded in the magnetic stripe or chip. On most cards, it sits on the back in the signature panel. American Express prints it on the front, above the account number. The code exists to verify that you actually hold the card in your hand when you make a purchase, especially online or over the phone.
The CVV is not the same as your PIN (Personal Identification Number), which you enter at an ATM or point-of-sale terminal. A PIN proves you know a secret; a CVV proves you have the card. Merchants and payment processors use the CVV to reduce fraud — if someone has only your card number and expiration date (stolen from a data breach, for example), they cannot complete an online transaction without the CVV.
Card networks like Visa, Mastercard, and Discover each have their own names for the same thing. Visa and Discover call it CVV2; Mastercard calls it CVC2; American Express calls it CID. The function is identical across all of them.
Key Takeaways
- A CVV is a three- or four-digit code printed on your card that proves you physically hold it when making online or phone purchases.
- The CVV sits on the back of most cards in the signature panel, or on the front of American Express cards above the account number.
- Never share your CVV with anyone except the merchant you are paying directly, and never enter it on a website unless you initiated the transaction yourself.
- A CVV is not a PIN — it is not secret in the same way, and merchants are allowed to see it, but it still protects you from fraud.
- If your card is lost or stolen, the CVV alone cannot be used to make purchases without the card number and expiration date.
Where the CVV appears on different card types
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature panel. It is the last three digits of a longer number that appears there. You do not need to memorize it — you only need to read it when you are making a purchase.
American Express cards are different. The CVV (called CID on Amex) is a four-digit number printed on the front of the card, above and to the right of the main account number. This placement is one way to spot a counterfeit Amex card — if the four-digit code is anywhere else, it is not genuine.
Some business cards and corporate cards may have the CVV in a different location or format. If you cannot find it, check the card issuer's website or call the number on the back of your card.
Why merchants ask for your CVV
When you buy something online or over the phone, you cannot hand the card to the merchant. The merchant cannot see the physical card, so they cannot verify you have it. Asking for the CVV is their way of confirming that the person making the purchase actually holds the card in their hands at that moment.
The CVV is processed separately from your card number and expiration date. Payment processors and card networks use it to check that the number matches the card issuer's records. If the CVV does not match, the transaction is declined. This straightforward check stops many fraudulent purchases — someone who stole your card number from a website or database will not have the CVV unless they also have the physical card.
Merchants are allowed to see and record your CVV during a transaction. However, payment card industry rules (called PCI DSS) prohibit merchants from storing the CVV after the transaction is complete. If a merchant's database is breached, the CVV should not be in it.
When you should and should not share your CVV
Share your CVV only when you are making a purchase from a merchant you trust and you initiated the transaction yourself. This includes online shopping, phone orders, and mail orders where you are the one calling or writing to the merchant. In these cases, the merchant needs the CVV to process your payment.
Never share your CVV in response to an unsolicited call, text, or email — even if the sender claims to be from your bank or card issuer. Your bank will never ask for your CVV over the phone or by email. If someone contacts you asking for it, hang up or delete the message and call your card issuer directly using the number on the back of your card.
Do not enter your CVV on a website unless you are certain the site is legitimate and you started the transaction. Phishing websites that look like real retailers often ask for the CVV to steal it. If you are unsure whether a website is real, type the retailer's name and web address into a search engine before entering any payment information.
How the CVV protects you from fraud
The CVV is one layer of fraud protection, but not the only one. It works because it is printed on the card itself and not stored in the magnetic stripe or chip. A thief who skims your card number from a gas pump or ATM will not get the CVV. A hacker who steals card numbers from a retailer's database will not have the CVV. Someone who finds your card number on a receipt will not have the CVV.
However, the CVV is not foolproof. If someone steals your physical card, they have the CVV. If you give your card to a cashier or server and they write down the CVV along with your card number, that information could be misused. If you enter your CVV on a phishing website, the scammer has it.
For this reason, the CVV is best thought of as one protection among several. Other protections include your card issuer's fraud monitoring (which flags unusual purchases), your right to dispute unauthorized charges, and encryption on legitimate websites (indicated by "https" in the web address and a padlock icon).
What to do if your card is lost or stolen
If your card goes missing, contact your card issuer when ready using the number on your statement or the issuer's website. Do not wait to see if fraudulent charges appear. Most card issuers have a 24-hour customer service line for this purpose.
When you report the card lost or stolen, the issuer will cancel it and send you a replacement. The new card will have a different card number and a different CVV. Any fraudulent charges made after you report the card will be your issuer's responsibility to investigate, not yours — federal law limits your liability for unauthorized charges to $50, and most issuers waive even that.
If you see charges on your statement that you did not make, contact your issuer and dispute them. You do not need to prove the charge was fraudulent — the issuer must investigate and remove it from your account while they do so. This process typically takes 30 to 60 days.
CVV versus other card security features
The CVV is one of several security features on a modern credit card. The chip (also called EMV) is another — it creates a unique code for each transaction, making it much harder to counterfeit than the old magnetic stripe. The magnetic stripe itself is still there on most cards, but it is the least find of the three.
Online, additional protections exist beyond the CVV. Many card issuers offer 3D find (also called Verified by Visa, Mastercard SecureCode, or Discover find), which requires you to enter a password or receive a one-time code on your phone before the transaction goes through. Some retailers use address verification (checking that the billing address you enter matches the address on file with your bank) or CVV verification alone.
No single security feature stops all fraud. The CVV is most useful for preventing "card-not-present" fraud (online and phone purchases), while the chip is most useful for preventing counterfeit cards at physical stores. Together, they make it much harder for a thief to use a stolen card number.
Frequently Asked Questions
Is my CVV the same as my PIN?
No. Your PIN is a secret number you create and enter at an ATM or store to prove you know a password. Your CVV is printed on the card and is not secret — merchants are allowed to see it. The CVV proves you have the card; the PIN proves you know a secret.
Can someone use my card number without the CVV?
Online and over the phone, no — most merchants require the CVV to process the transaction. In person at a store, a thief with only your card number could potentially use it if they had a counterfeit card made, but modern chip technology makes this much harder. If your card number is stolen, contact your issuer when ready.
Should I memorize my CVV?
No. You only need the CVV when you are making a purchase, and you can read it from the card at that moment. Memorizing it serves no purpose and increases the risk if you accidentally say it aloud or write it down somewhere.
What if I enter the wrong CVV?
The transaction will be declined. You can try again with the correct CVV. Entering the wrong CVV a few times will not lock your card or trigger fraud alerts — it straightforward means the payment processor could not verify the code.
Can a merchant store my CVV after the transaction?
No. Payment card industry rules prohibit merchants from storing the CVV after the transaction is complete. If a merchant asks you to provide your CVV for a future transaction (like a subscription or recurring charge), that is a sign the merchant may not be following proper security practices.