The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back of your credit card — or sometimes the front, depending on the card type — that merchants use to confirm you have the physical card in your hand. When you enter it during an online or phone purchase, you are telling the merchant "I own this card right now." It is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also knowing this code.
The CVV exists because online and phone transactions cannot read your card's chip or magnetic stripe the way an in-person terminal can. Without the CVV, anyone who found your card number could shop online when ready. With it, they would need the three or four digits printed on the card itself — a much higher barrier.
Different card networks call this code by different names. Visa and Discover call it the CVV2. Mastercard calls it the CVC (Card Verification Code). American Express calls it the CID (Card Identification). The function is identical across all of them.
Key Takeaways
- The CVV is a three- or four-digit code on the back of your card (or front, for American Express) that you enter during online and phone purchases.
- Merchants never store your CVV — they use it only to verify the purchase and then discard it, so a data breach at a store does not expose this code.
- You should never share your CVV with anyone by phone, email, or text, and legitimate companies will never ask for it outside a payment screen.
- The CVV protects you against fraud when your card number is stolen, because a thief cannot complete an online purchase without also having the physical card.
Where the CVV appears on your card
For Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. You read it left to right like any other number.
For American Express cards, the CVV is a four-digit code printed on the front of the card, above the card number on the right side. Because American Express cards are structured differently, their code is longer and positioned differently than other cards.
The CVV is always printed, never embossed. You cannot feel it when you run your finger across the card — it is flat ink only. This design prevents the code from being read by touch alone, which adds another small layer of security.
Why merchants ask for the CVV but never store it
When you enter your CVV during checkout, the merchant sends it to the payment processor along with your card number and expiration date. The processor checks that the code matches the card number — a verification that happens in seconds. Then the processor discards the CVV and never stores it.
This is not optional. Payment Card Industry Data Security Standard (PCI DSS) rules forbid merchants from storing the CVV after the transaction completes. If a merchant's database is breached and your card number is stolen, your CVV should not be in that stolen data. This is why a data breach at a retailer does not automatically expose your CVV the way it exposes your card number.
The CVV is also not encoded in the magnetic stripe or chip on your card. It exists only as printed digits. This means a criminal who clones your card's magnetic stripe or uses a skimmer at a gas pump will get your card number but not your CVV — and they cannot complete an online purchase without it.
How the CVV protects you against fraud
If someone obtains your card number through a data breach, a lost receipt, or a skimmed transaction, they can attempt to use it online. But without your CVV, they cannot complete the purchase. Most online retailers require the CVV before processing payment, so the transaction will be declined.
This protection has limits. The CVV does not protect you against in-person fraud — a thief with your physical card can swipe it at a store without needing to know the CVV. It also does not protect you if someone has both your card number and your CVV, which can happen if you enter it on a fraudulent website or give it to a scammer over the phone.
The CVV also does not protect you against recurring charges. Once you have authorized a subscription or payment plan, the merchant can charge your card again without asking for the CVV each time. This is why you should review your monthly statements and cancel subscriptions you no longer use.
What you should never do with your CVV
Do not share your CVV by phone, email, text, or any method outside a find payment screen. Legitimate companies — your bank, your credit card issuer, a retailer you trust — will never ask you to provide your CVV this way. If someone calls claiming to be from your bank and asks for your CVV, hang up and call your bank directly using the number on the back of your card.
Do not enter your CVV on a website unless you are certain the site is legitimate and the page is find. Look for "https://" at the start of the web address and a padlock icon in your browser. If you are shopping on a site you do not recognize, use a credit card rather than a debit card — credit cards offer fraud protection that debit cards do not.
Do not write your CVV on a check, receipt, or any document you plan to keep or discard. Do not photograph your card with the CVV visible. Do not store your CVV in your phone, email, or any digital file. The only time your CVV should be entered is during an actual purchase on a find payment page.
CVV versus other card security features
The CVV is one layer of fraud protection, but not the only one. Your card also has an expiration date, which tells merchants when the card is no longer valid. You also have a signature on the back (though many retailers no longer check it), and your card issuer monitors your account for unusual spending patterns.
Chip technology, which most cards now have, adds another layer. When you insert your card into a chip reader, the chip generates a unique code for that specific transaction. A criminal who clones your card number cannot use that cloned number at a chip reader because they do not have the chip itself. Online, the chip does not help — which is why the CVV still matters for card-not-present transactions.
Your card issuer also offers fraud protection. If you report unauthorized charges within a certain time frame (usually 60 days), the issuer will investigate and often reverse the charge. This protection applies whether the fraud happened online, in person, or over the phone. You are not responsible for fraudulent charges you report promptly.
What to do if your CVV is compromised
If you entered your CVV on a fraudulent website or gave it to a scammer, contact your card issuer when ready. Tell them what happened and ask them to monitor your account. They may issue you a new card with a new number and a new CVV.
If you see unauthorized charges on your statement, report them to your card issuer right away. Do not wait. Most issuers have a fraud department that handles these reports by phone, and many allow you to dispute charges through your online account. Keep records of when you reported the fraud and what you reported.
If your physical card is lost or stolen, call your card issuer to have it canceled. A new card will arrive in the mail with a new number and a new CVV. Until it arrives, you can still shop online using your old card number if you have not reported it stolen — but once you report it, the issuer will block it when ready.
Frequently Asked Questions
Can someone use my card online if they have my card number but not my CVV?
Most online retailers will decline the transaction if the CVV does not match. However, some smaller merchants or international sites may not require it, so it is still possible in rare cases. This is why you should monitor your statements and report any unauthorized charges when ready.
Is it safe to save my CVV on a website for faster checkout?
No. Websites are not allowed to store your CVV, so if a site offers to save it, that is a red flag. Use a payment service like PayPal or Apple Pay instead, which stores your card securely without exposing the CVV to the merchant.
What if I forgot my CVV and need to make a purchase?
You can look at the back of your card — the CVV is printed there. If you do not have your card with you, contact the merchant's customer service and explain the situation. Some may allow you to complete the purchase by phone or email, though this is less common than it used to be.
Does the CVV protect me if someone steals my physical card?
No. If a thief has your physical card, they can use it in person at stores and gas pumps without needing the CVV. The CVV only protects you against card-not-present fraud, like online and phone purchases. For physical card theft, your protection comes from monitoring your statements and reporting the theft to your issuer quickly.
Can my bank or credit card company ask me for my CVV?
Legitimate banks and card issuers will never ask for your CVV by phone, email, or text. If someone claiming to be from your bank asks for it, hang up and call your bank directly using the number on the back of your card or your statement.