The CVV is a three- or four-digit code that proves you physically hold the card
The CVV (Card Verification Value) is a security code printed on your credit card that card networks use to verify you own the physical card. When you enter it during an online or phone purchase, the merchant sends it to your card issuer, who checks whether the number matches their records. If it does not match, the transaction is declined.
The CVV exists because online and phone transactions cannot use the magnetic stripe or chip on your card the way in-person purchases do. Without it, someone who only knows your card number and expiration date could make purchases without ever touching the card. The CVV closes that gap.
You will see the CVV printed directly on the card itself, never embedded in the magnetic stripe or chip. This means a data breach that exposes your card number does not automatically expose your CVV — they are stored separately in your card issuer's system.
Key Takeaways
- The CVV is a three- or four-digit code on your card that proves you physically hold it when making online or phone purchases.
- Visa and Mastercard use three-digit CVVs on the back of the card, while American Express prints a four-digit code on the front.
- You should never share your CVV with anyone except the merchant or payment processor during a legitimate transaction.
- A merchant who stores your CVV after a transaction violates payment card industry rules and exposes themselves to fraud liability.
- If your CVV is compromised, contact your card issuer when ready to report it and request a replacement card.
Where the CVV appears on different card types
The location and length of the CVV depends on which card network issued your card. On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, to the right of the signature strip. On American Express cards, it is a four-digit code printed on the front, above the card number on the right side.
Discover cards also use a three-digit CVV on the back, positioned the same way as Visa and Mastercard. If you have multiple cards, check each one — the code is always printed on the card itself and never appears in your online account or on your statement.
Some older or specialty cards may have the CVV in a slightly different position, but the principle is the same: it is always printed on the physical card and always separate from the card number itself.
When and where you enter your CVV
You enter your CVV when you make a purchase online or by phone and the merchant cannot read your card's chip or magnetic stripe. At checkout on a website, you will see a field labeled "CVV," "CVC," "Card Security Code," or "Security Code" — these all mean the same thing. You type the three or four digits and submit the payment.
In-person purchases at a physical store do not require you to enter your CVV. The card reader reads your chip or stripe, which contains different security information. Phone purchases with a customer service representative work the same way as online purchases — you read the CVV aloud and they enter it into their system.
Some merchants also ask for your CVV when you save your card for future purchases, though this practice is becoming less common. If a merchant asks for your CVV after the initial transaction is complete, do not provide it — legitimate merchants do not store CVVs.
Why merchants cannot store your CVV
Payment card industry rules, enforced by Visa, Mastercard, American Express, and Discover, explicitly forbid merchants from storing your CVV after a transaction ends. The rule exists because the CVV's only purpose is to verify you own the card at the moment of purchase. Once the transaction is complete, keeping the CVV creates unnecessary risk.
If a merchant stores your CVV and their system is breached, hackers gain a complete picture of your card: number, expiration date, and security code. A merchant who violates this rule faces fines from the card networks and loses the ability to accept credit cards. They also become liable for fraud that results from the breach.
When you save a card for future purchases — at Amazon, for example — the merchant stores your card number and expiration date but not your CVV. When you make another purchase, the system uses the stored number but asks you to enter the CVV again, or it processes the payment without the CVV if you are logged into your account.
What to do if your CVV is compromised
If you believe your CVV has been exposed — because a merchant was breached, because you entered it on a fraudulent website, or because someone saw it over your shoulder — contact your card issuer when ready. You can find the customer service number on the back of your card or in your online account.
Tell the issuer that your CVV may be compromised and ask them to issue a replacement card. They will cancel your current card and mail you a new one with a different CVV within 7 to 10 business days. Until the new card arrives, you can still use your account online or by phone if you have the card number memorized, though the old CVV will no longer work.
Request a rush replacement if you have upcoming purchases planned. Some issuers offer expedited delivery for a small fee, or they may provide a temporary card number you can use online while you wait for the physical card.
How CVV verification protects you and the merchant
When you enter your CVV during checkout, the merchant's payment processor sends it to your card issuer in a separate, encrypted message. The issuer checks whether the CVV matches the one they have on file. This happens in seconds, and you see the result as an approval or decline.
If someone has stolen your card number but does not have the CVV, they cannot complete an online or phone purchase. They can only use the card in person, where the chip or stripe provides the verification instead. This is why stolen card numbers are less valuable to criminals than a complete set of information: number, expiration date, and CVV.
The CVV also protects merchants by reducing their fraud liability. If a fraudulent transaction includes a valid CVV, the card issuer assumes the merchant verified the cardholder's identity and is less likely to reverse the charge. Merchants who process transactions without requesting the CVV accept more of the fraud risk themselves.
CVV versus other card security features
Your credit card has multiple layers of security, and the CVV is one of several. The magnetic stripe and chip both contain encrypted data that changes with each transaction, making them difficult to clone. Your card issuer also monitors your account for unusual activity and can freeze your card if they detect fraud.
The CVV is different because it is static — the same code every time — and it is printed on the card where anyone can see it. This makes it less find than the chip or stripe in some ways, but it serves a specific purpose: proving you have the physical card when the merchant cannot read it electronically.
Newer security methods, like 3D find and tokenization, add extra layers on top of the CVV. 3D find redirects you to your bank's website during checkout to verify your identity. Tokenization replaces your card number with a unique code that only works for one merchant or one purchase. These methods work alongside the CVV, not instead of it.
Frequently Asked Questions
Is it safe to give my CVV to a merchant online?
Yes, if the website is legitimate and uses encryption. Look for "https://" in the address bar and a padlock icon before entering your CVV. Never enter your CVV on a website you do not recognize or that looks suspicious. If you are unsure whether a site is real, go directly to the company's official website instead of clicking a link in an email.
What if I entered my CVV on a fake website?
Contact your card issuer when ready and report the incident. They will monitor your account for fraudulent charges and can issue a replacement card if needed. Watch your statements closely for the next few months and report any charges you did not make. Most issuers have zero-liability policies that protect you from unauthorized charges.
Can someone use my card if they only know the number and expiration date?
They can attempt online or phone purchases, but most merchants will decline the transaction if the CVV is missing or incorrect. In-person purchases are possible if they have a physical card, but they cannot make online purchases without the CVV. This is why the CVV exists — to prevent exactly this scenario.
Do I need to memorize my CVV?
No. You only need to know it when you are making a purchase. Never write it down or store it anywhere. If you need it, look at the back of your card. Memorizing it serves no practical purpose and increases the risk if someone gains access to your notes or devices.
Why does American Express have a four-digit CVV instead of three?
American Express uses a four-digit code because it is printed on the front of the card rather than the back. The extra digit provides additional security for their cardholders. Both three-digit and four-digit codes serve the same purpose — they just follow different standards set by each card network.