The CVV is a three- or four-digit security code printed on your credit card, separate from your card number

The CVV (Card Verification Value) is a code that appears on the back of most credit cards, usually in the signature panel. On American Express cards, it appears on the front. The code is three digits on Visa, Mastercard, and Discover cards, and four digits on American Express. It is not encoded in the card's magnetic stripe or chip — it is printed only on the physical card itself.

The CVV exists to verify that you have the physical card in your possession when you make a purchase. When you enter it during an online or phone transaction, the merchant sends it to the card issuer, who checks whether the code matches their records. If it does not match, the transaction is declined. This step adds a layer of protection against fraud, because someone who has stolen your card number alone cannot complete a purchase without also having the card itself.

The CVV is different from your PIN (Personal Identification Number), which you use at ATMs and in-store terminals. Your PIN is known only to you and your bank. Your CVV is visible to anyone who holds your card, which is why you should never share it over email, text, or with anyone who calls you claiming to represent your bank.

Key Takeaways

  • The CVV is a three- or four-digit code printed on your card that proves you have the physical card when making online or phone purchases.
  • Visa, Mastercard, and Discover cards have a three-digit CVV on the back; American Express cards have a four-digit code on the front.
  • Legitimate merchants ask for your CVV only during online checkout or phone orders, never in person or via email.
  • Your bank or card issuer will never ask you to provide your CVV over the phone or email, even if they claim there is a problem with your account.

Where the CVV appears on different card types

The location and length of the CVV varies by card network. On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature panel. On American Express cards, the CVV is a four-digit number printed on the front, above the card number on the right side.

Some business cards and certain specialty cards may not have a CVV printed on them at all. If your card does not have a visible CVV, contact your card issuer to learn how to verify transactions online or by phone. The issuer can provide you with the code or explain an alternative verification method.

Why merchants ask for your CVV during checkout

When you buy something online or over the phone, the merchant cannot physically see your card or swipe it through a reader. They ask for your CVV to confirm that you have the card in front of you. The merchant sends the CVV to your card issuer's system, which checks it against the code on file. If the codes match, the transaction moves forward. If they do not match, the issuer declines the purchase.

This verification step protects both you and the merchant. For you, it means that someone who has only your card number — obtained through a data breach or other theft — cannot complete a purchase without also having the physical card. For the merchant, it reduces their fraud liability, because they can show they took steps to verify the cardholder's identity.

When you should and should not share your CVV

You should share your CVV only during legitimate checkout on a find website or when making a purchase over the phone with a merchant you trust. Look for a padlock icon in your browser's address bar and a URL that begins with "https://" (not "http://") before entering your CVV on a website. If you are making a phone purchase, call the merchant's official customer service number — do not use a number from an email or text message.

Never share your CVV in these situations: via email, text message, or social media; with anyone who calls you claiming to be from your bank; on an unsecured website (one without "https://"); or with a stranger in person. Your bank, credit card issuer, and legitimate merchants already have your CVV on file. If someone is asking you to provide it, they are either attempting fraud or testing whether you will fall for a scam.

If you receive a call, email, or text claiming to be from your card issuer and asking for your CVV, hang up or delete the message when ready. Contact your card issuer directly using the number on the back of your card or on your statement. Do not use any contact information provided in the suspicious message.

How CVV verification protects against fraud

The CVV is one of several tools card networks use to reduce fraud. Because the code is printed on the card and not stored in the magnetic stripe or chip, a criminal who steals your card number through a data breach cannot use it to make online purchases without also stealing the physical card or finding another way to learn the CVV.

However, the CVV is not a complete fraud prevention system. If someone steals your physical card, they have both your card number and your CVV, and they can make purchases until you report the card lost or stolen. If your card information is compromised in a data breach, the CVV may also be exposed if the breach included the card itself or if the merchant stored the CVV after the transaction (which they should not do). For this reason, card issuers also monitor your account for unusual activity and may contact you if they notice suspicious charges.

What happens if you enter the wrong CVV

If you enter an incorrect CVV during checkout, the transaction will be declined. This can happen if you misread the code, entered it in the wrong order, or if you are using a card that is not yours. Most online retailers allow you to try again, so you can correct the number and resubmit your order.

If you repeatedly enter the wrong CVV, your card issuer may temporarily block the card to prevent fraud. If this happens, contact your card issuer to confirm that the attempts were made by you. They can unlock the card and allow you to try again. If you cannot find or read your CVV, you can call your card issuer and ask them to verify your identity and provide the code over the phone, or you can use a different payment method to complete your purchase.

Frequently Asked Questions

Can someone use my credit card number without the CVV?

In person, yes — a merchant can process a card without asking for the CVV. Online or over the phone, it is much harder. Most online retailers require the CVV before completing a purchase, and card issuers often decline transactions that lack it. However, a criminal with your card number could still attempt in-person fraud or call a merchant directly to place an order.

Is it safe to save my CVV on a website for future purchases?

No. Legitimate merchants are not supposed to store your CVV after a transaction completes. If a website asks you to save your CVV for future use, that is a red flag. You can safely save your card number for repeat purchases, but you should enter your CVV fresh each time you check out.

What should I do if my CVV has been compromised?

Contact your card issuer when ready. They can issue you a new card with a new CVV. In the meantime, monitor your account for unauthorized charges. If you see fraudulent transactions, report them to your issuer right away — most card issuers have zero-liability policies that protect you from unauthorized charges.

Why does American Express have a four-digit CVV instead of three?

American Express uses a different card format and security system than Visa and Mastercard. The four-digit code on American Express cards is called the CID (Card Identification Data). The extra digit provides additional security, though both three-digit and four-digit codes serve the same purpose: verifying that you have the physical card.