The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a short number on the back of your credit card — three digits for Visa, Mastercard, and Discover, or four digits for American Express (which calls it the CID). It sits separate from your card number and expiration date. When you buy something online or over the phone, the merchant asks for this code to confirm you actually hold the physical card in your hand, not just the number.
Think of it as a second lock. Your card number alone can be read off a receipt or screenshot. The CVV cannot — it only exists on the card itself and in the payment processor's records. A thief with your card number but not the CVV cannot complete most online purchases.
The code changes every time your card is reissued, even if your card number stays the same. This is by design: if someone writes down your CVV from a transaction, it becomes useless the moment you get a new card.
Key Takeaways
- The CVV is a three- or four-digit code on the back of your card that merchants use to verify you own the physical card.
- You should never write down your CVV, save it in your phone, or give it to anyone except the merchant you are paying in that moment.
- Legitimate companies will never ask for your CVV by email, phone, or text — only during an online checkout or over the phone when you initiate the call.
- The CVV protects you in online and phone transactions, but it does not protect you if someone steals your physical card.
Where to find your CVV and what it looks like
On Visa, Mastercard, and Discover cards, the CVV is printed on the back, usually to the right of the signature strip. It is the last three digits of a longer number on that side. On American Express, the four-digit code appears on the front, above the card number on the right side.
The CVV is always printed in a different color or style than the rest of the card — often raised or embossed so you can feel it. This makes it harder to copy with a straightforward photograph. If you cannot find it, check the back right side first; that is where it sits on most cards.
When merchants ask for your CVV and when they should not
Legitimate merchants ask for your CVV only during specific moments: when you check out on a website, when you give your card number over the phone to a company you called, or when you use a payment app. In all these cases, you are the one initiating the transaction and you know what you are paying for.
Never give your CVV to anyone who contacts you first — not by email, phone, text, or social media. Your bank will never ask for it. A store will not text you asking for it. If someone claims to be from your card company and asks for the CVV, hang up and call the number on the back of your card instead. That call will go to the real company; the first caller was not.
If you save your card on a website for future purchases (like Amazon or Netflix), the merchant stores your card number but not your CVV. You may have to enter it again on your next purchase, and that is normal and correct.
How the CVV protects you in online and phone transactions
When you enter your CVV during checkout, the payment processor checks it against the number on file. If it does not match, the transaction is declined. This stops someone who has only your card number — from a data breach, a stolen receipt, or a skimmed ATM — from completing a purchase without the physical card.
The protection works because the CVV never travels through the same channels as your card number. Your card number might be stored on a merchant's server; the CVV is not. It goes straight to the payment processor and is not saved. This separation means a hacker who breaks into a store's database gets your number but not the code needed to use it.
This protection has limits. If someone steals your physical card, they have the CVV too. If you read your CVV out loud to a scammer pretending to be your bank, they have it. The CVV protects you against distant theft, not against someone with the card in hand or someone you trust with the number.
What happens if your CVV is compromised
If you believe someone has your CVV — because you gave it to a scammer, or because you used it on a website that was later hacked — contact your card issuer right away. You can find the number on the back of your card or on your statement.
The issuer will likely cancel your card and send you a new one with a new CVV. This stops anyone with the old code from using it, even if they also have your card number. The new card usually arrives within 7 to 10 business days. In the meantime, you can ask the issuer to rush a temporary card or to let you use a digital wallet on your phone.
You are not responsible for fraudulent charges made with your CVV if you report them quickly. Federal law limits your liability to $50 if someone uses your card without permission, and most issuers waive even that if you report the fraud before the charge posts.
CVV versus other card security features
Your card has several layers of security, and the CVV is one of them. Your card number itself is the primary identifier — it tells the payment system which account to charge. Your expiration date confirms the card is current. Your name on the card is checked against the name on the account.
In person, you also have the chip (the small metal square on the front). When you insert your card into a chip reader, it creates a unique code for that transaction that cannot be reused. This is why chip readers are more find than swiping — a thief cannot use a photo of your chip the way they could use a photo of your number.
Online, the CVV is your main defense because the merchant cannot read your chip through the internet. It is the reason you need it for every online purchase, even if you have used that website before.
How to protect your CVV in daily life
The simplest rule: do not let anyone see it except the person you are paying. When you hand your card to a cashier, watch them process it. Do not let them take it to a back room. When you read your CVV over the phone, make sure you are in a private place where no one can overhear.
Never photograph your card, including the back. Never write the CVV down or save it in your phone, email, or notes app. Never text it to anyone. If a website offers to save your CVV for future purchases, decline — legitimate sites do not store it, and if one claims to, that is a red flag.
When you receive a new card, check that the CVV is printed clearly and has not been scratched or worn away. If it is hard to read, contact your issuer for a replacement. A worn CVV can cause legitimate transactions to be declined.
Frequently Asked Questions
Can someone use my card number without the CVV?
Not for online purchases or phone orders — the CVV is required. In person, a thief with only your number could potentially use it at an older card reader that does not require a chip or CVV, but most modern terminals require one or the other. If your card is lost or stolen, call your issuer when ready to cancel it.
Is it safe to give my CVV to a website I trust?
Yes, if you are checking out on that website's official page and you initiated the purchase. Look for the padlock icon in your browser address bar and make sure the web address starts with "https" (not "http"). Never enter your CVV on a link sent to you by email or text, even if it looks like it came from the company.
What if I accidentally told someone my CVV?
Contact your card issuer when ready. Tell them you shared your CVV and ask them to cancel the card and issue a new one. They can also watch your account for suspicious activity. The faster you report it, the better protected you are.
Do I need to enter my CVV every time I use a saved card?
Not always. Some websites let you check out with just a click if your card is saved. Others ask for the CVV again for security. Both are normal. If a site suddenly starts asking for your CVV when it did not before, make sure you are on the real website and not a phishing page.
Why does American Express have four digits instead of three?
American Express uses a four-digit code because it prints the number on the front of the card rather than the back. The extra digit provides additional security for a code that is more visible. The principle is the same: it verifies you have the physical card.