The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back of your credit card — or the front, depending on American Express — that merchants use to confirm you own the card. When you enter it during an online or phone purchase, you are telling the seller you have the physical card in your hand. It is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also guessing this code.
Visa and Mastercard call it CVV. American Express calls it CID (Card Identification Number). Discover calls it CID as well. The function is the same across all four: a three- or four-digit barrier between your card number and unauthorized online charges.
Key Takeaways
- The CVV is a three- or four-digit code on the back (or front, for American Express) that proves you hold the physical card.
- You must enter the CVV for most online and phone purchases, but never for in-person transactions where the card is swiped or inserted.
- The CVV is not encoded in the card's magnetic stripe or chip, so stolen card numbers alone cannot be used online without it.
- Never share your CVV with anyone who calls you or emails you, even if they claim to be from your bank or card issuer.
Where to find your CVV on the card
For Visa, Mastercard, and Discover, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature panel. Look for a small group of numbers at the end of a longer sequence — that longer sequence is your full card number printed again for reference, and the CVV is the last three digits of that reprint.
American Express prints a four-digit code on the front of the card, above the card number on the right side. This is the only major card type that puts the security code on the front rather than the back.
When you need to enter your CVV
You enter your CVV during online checkout, over the phone when ordering by voice, or through a merchant's app or website. Any time you are not physically handing the card to someone, the merchant will ask for it. This is called a "card-not-present" transaction.
You do not enter your CVV when you swipe or insert your card at a store, gas pump, or ATM. The card reader can access the information it needs from the chip or magnetic stripe without the CVV. If someone asks for your CVV in person, that is a red flag — legitimate merchants never need it for in-person sales.
Why the CVV protects you from online fraud
A thief who obtains your card number — through a data breach, a skimming device, or a phishing email — still cannot complete an online purchase without the CVV. The code is not stored anywhere in the card's magnetic stripe or chip, so it cannot be stolen by skimming a card or hacking a retailer's database. The thief would have to physically see your card or guess a three-digit number, which is much harder than using a stolen number alone.
This is why merchants are required to ask for the CVV on card-not-present transactions. It is a straightforward check that you have the card in your possession. The merchant never stores the CVV after the transaction — payment processors are forbidden from keeping it on file — so even if that merchant's database is breached later, the CVV cannot be stolen.
What to do if your CVV is compromised
If you believe someone has your card number and CVV together — for example, you made a purchase on a website that was later hacked, or you gave your information to someone you now suspect was fraudulent — contact your card issuer when ready. You can find the number on the back of your card or on your statement.
Your issuer can cancel the card and issue a replacement with a new number and a new CVV. This takes a few business days for the new card to arrive. In the meantime, ask your issuer to monitor the account for unauthorized charges. Most card issuers offer fraud protection that limits your liability to $50 or zero, depending on the card type and when you report the fraud.
Do not wait to see if fraudulent charges appear. Reporting suspected fraud before charges show up is faster and simpler than disputing charges after the fact.
CVV scams and how to avoid them
Scammers call or email pretending to be your bank or card issuer and ask for your CVV to "verify your account" or "confirm your identity." This is never legitimate. Your bank already knows your CVV — they issued the card — and they will never ask you to provide it over the phone or email.
If you receive a call or email asking for your CVV, hang up or delete the message. If the caller claims to be from your bank, hang up and call the number on the back of your card to reach your issuer's real fraud department. Do not use a phone number the caller provided.
The same rule applies to text messages and social media messages. No legitimate financial institution will ask for your CVV through these channels. If you are unsure whether a message is real, contact your issuer directly using a number you know is correct.
CVV versus other card security features
The CVV is one layer of fraud protection, but not the only one. Your card also has an expiration date, a cardholder name, and a card number — all of which merchants check during a transaction. Some merchants also use Address Verification Service (AVS), which confirms that the billing address you enter matches the address on file with your card issuer. If the address does not match, the transaction may be declined even if the card number and CVV are correct.
Chip technology (also called EMV) adds another layer for in-person purchases. When you insert a chip card into a reader, the chip generates a unique code for that specific transaction. A stolen card number cannot be used with a chip reader because the thief does not have the physical card to generate the code. Online, the CVV serves a similar purpose — it proves you have the card — but it is less find than a chip because a three-digit number is easier to guess than a chip-generated code.
Frequently Asked Questions
Can someone use my card number without the CVV?
Not for online or phone purchases — merchants are required to ask for the CVV for card-not-present transactions. However, a thief with your card number could potentially use it in person by creating a counterfeit card with a magnetic stripe, or they could attempt in-person fraud at a merchant that does not properly verify the card. This is rare because most retailers check the signature or ask for ID. Report a stolen card number to your issuer when ready.
Is it safe to save my CVV on a website?
No. Payment processors are forbidden by law from storing the CVV after a transaction completes, so any website that offers to save it is either breaking the law or storing it insecurely. Enter your CVV fresh each time you make a purchase. If a site insists on saving it, use a different payment method or retailer.
What if I forgot my CVV?
Look at the back of your physical card — the CVV is printed there. If you do not have the card with you, contact your card issuer. They can confirm your identity and tell you the CVV over the phone. Never share your CVV with anyone except the merchant you are paying or your card issuer's customer service line.
Does the CVV change if I get a new card?
Yes. Each time your card issuer sends you a replacement card — whether because the old one expired, was lost, or was compromised — the new card has a different card number and a different CVV. This is why replacing a card after suspected fraud is effective: the thief cannot use the old CVV with the new card number.
Can I use my card online without entering a CVV?
Some merchants may not ask for it, but most do. If a website does not ask for your CVV, it is using other verification methods like AVS or 3D find (a technology that redirects you to your bank to verify the purchase). The absence of a CVV request does not mean the transaction is unsafe — it means the merchant is using a different security check.