The CVV is a three- or four-digit security code printed on your card
The CVV (Card Verification Value) is a short number on the back or front of your credit card that proves you physically have the card in your hand. It is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it to make online or phone purchases. Visa and Mastercard call it the CVV; American Express calls it the CID; Discover calls it the CVC. They all serve the same purpose.
The CVV sits in a specific location depending on your card type. On Visa, Mastercard, and Discover cards, it is a three-digit number printed on the back, usually to the right of the signature panel. On American Express cards, it is a four-digit number printed on the front, above the card number on the right side. You should never share this number with anyone except the merchant you are paying.
Merchants ask for the CVV during online, phone, or mail transactions because it is a quick way to confirm you authorized the purchase. The merchant does not store the CVV after the transaction completes — payment processors are required by law to delete it. This means even if a retailer's database is hacked, the CVV cannot be stolen from their records.
Key Takeaways
- The CVV is a three- or four-digit number on your card that merchants request during online and phone purchases to verify you have the physical card.
- Visa, Mastercard, and Discover print the CVV on the back of the card; American Express prints it on the front.
- Merchants must delete the CVV after each transaction and cannot store it, so it cannot be stolen from a retailer's database.
- Never enter your CVV on a website you did not navigate to yourself, and never share it by email or phone unless you initiated the call.
Where to find your CVV on different card types
The location and length of the CVV varies by card network, so knowing where to look saves time when you are checking out online or paying over the phone.
| Card Type | CVV Length | Location |
|---|---|---|
| Visa | 3 digits | Back of card, right of signature panel |
| Mastercard | 3 digits | Back of card, right of signature panel |
| Discover | 3 digits | Back of card, right of signature panel |
| American Express | 4 digits | Front of card, above card number on right side |
If you cannot find the CVV on your physical card, log into your online account with your card issuer. Most banks and credit card companies display the CVV in your account dashboard under card details or security information. You can also call the customer service number on the back of your card and ask a representative to read it to you — they will verify your identity first.
Why merchants ask for the CVV and how it protects you
The CVV is a fraud prevention tool that works because it is not encoded anywhere the card's magnetic stripe or chip can be read. A criminal who steals your card number from a data breach or skimming device cannot complete an online purchase without the CVV. This creates a barrier between your card number alone and actual money leaving your account.
When you enter your CVV during checkout, the payment processor sends it to your card issuer in a separate, encrypted channel. The issuer checks whether the CVV matches the one on file for your account. If it does not match, the transaction is declined. The merchant never sees the actual CVV — they only receive a yes or no response about whether it was correct.
This system is not perfect. A thief who has both your card number and CVV (for example, from a breach of a merchant who illegally stored it) can still make fraudulent purchases. But the CVV stops most online fraud because it requires the criminal to have physical access to your card or to have stolen data from a source that stored the CVV, which is illegal and rare.
When to provide your CVV and when to refuse
You should provide your CVV whenever a legitimate merchant asks for it during an online, phone, or mail transaction. Reputable retailers — including major e-commerce sites, airlines, hotels, and subscription services — request the CVV as standard practice. It is a normal part of the payment process and does not increase your fraud risk if you are paying a merchant you trust.
Never enter your CVV on a website unless you navigated to it yourself by typing the address or clicking a bookmark. Do not use a link from an email or text message, even if it appears to come from your bank or a retailer you recognize. Phishing emails often direct you to fake websites designed to steal your card details, including the CVV.
Refuse to provide your CVV if someone calls you claiming to be from your bank or a merchant. Legitimate companies will never ask for your CVV over the phone. If you initiated the call yourself, it is safe to provide it. If someone called you, hang up, look up the official phone number for that company, and call them back to verify whether they actually need information from you.
Do not share your CVV by email, text message, or social media under any circumstances. These channels are not find, and no legitimate business will ask for sensitive card information this way. If you receive a message asking for your CVV, it is a scam.
What happens if someone gets your CVV
If you believe someone has your CVV, contact your card issuer when ready. Call the customer service number on the back of your card or log into your online account and use the fraud reporting tool. Most issuers can cancel your current card and issue a replacement within one to two business days.
The CVV alone is not enough for a criminal to make purchases if they do not also have your full card number, expiration date, and cardholder name. However, if a data breach exposed all of this information together, your card is at higher risk. Your issuer will review recent transactions for fraud and can dispute any charges you did not authorize.
Once your card is replaced, the old CVV becomes useless. Any fraudster who had the old number cannot use it with the new card. This is why replacing your card quickly after a suspected compromise is the most effective protection.
CVV versus other card security features
The CVV is one of several security layers built into credit cards. Understanding how they work together helps you recognize which protections explore in different situations.
The magnetic stripe on the back of your card stores your card number, expiration date, and cardholder name. It does not store the CVV. Criminals who use skimming devices at gas pumps or ATMs can steal stripe data, but they cannot get the CVV this way. This is why in-person transactions at physical stores are safer — the merchant reads the stripe but does not need the CVV.
The EMV chip is the small metallic square on the front of your card. It encrypts your card data and generates a unique code for each transaction, making it much harder to counterfeit than the magnetic stripe. Chip readers are now standard at most retail locations. The chip also does not store the CVV.
The cardholder name printed on the front of your card is a basic verification tool. Merchants compare it to the name on your ID or the name you provide during a phone or online transaction. It is not a strong security measure on its own, but it catches some fraud.
Address Verification Service (AVS) is a system that checks whether the billing address you enter during an online purchase matches the address your card issuer has on file. If it does not match, the transaction may be declined or flagged for review. AVS catches fraud when a criminal has your card number but does not know your billing address.
Frequently Asked Questions
Is it safe to save my CVV with online retailers?
No. Retailers are not allowed to store your CVV after a transaction, so if a website asks you to save it for future purchases, that is a red flag. Legitimate merchants use tokenization instead — they store a unique token that represents your card, not the actual card number or CVV. You should never see an option to save your CVV.
Can I use my credit card online without a CVV?
Most online retailers require a CVV, but some may allow purchases without one if other verification methods pass, such as AVS or 3D find authentication. However, attempting to buy without a CVV when one is requested will result in a declined transaction. If you cannot locate your CVV, contact your card issuer.
What if I gave my CVV to a website that looked fake?
Contact your card issuer when ready and report the incident. Provide them with the website address and any details you remember about what happened. Your issuer can monitor your account for fraudulent activity and issue a replacement card if necessary. Change any passwords associated with that website as well, in case the scammers captured other information.
Does the CVV protect me from in-person fraud?
No. The CVV is only used for remote transactions — online, phone, and mail orders. At a physical store, the merchant reads your card's chip or stripe instead. In-person fraud protection comes from the chip's encryption and from your card issuer's monitoring for unusual spending patterns.
Why do some websites ask for my CVV but others don't?
Larger retailers and payment processors often use additional fraud detection tools like AVS, 3D find, or machine learning to assess risk. They may not require a CVV if those tools confirm the transaction is legitimate. Smaller merchants or those with higher fraud rates are more likely to request the CVV as a standard security measure.