CVV and CVC are the three or four digits on your card that verify you're the one making the purchase
CVV (Card Verification Value) and CVC (Card Verification Code) are the same thing—different card networks use different names. Visa and Discover call it CVV. Mastercard calls it CVC. American Express calls it CID (Card Identification Number). All three are security codes printed on your physical card that merchants ask for when you pay online or over the phone.
The code proves you have the card in your hand, because it's not stored in the card's magnetic stripe or chip. A thief who steals your card number alone cannot complete an online purchase without this code. It's a straightforward but effective barrier between your card number and fraud.
You'll see this code printed on your card, but it never appears on your receipt or in your transaction history. Merchants are not allowed to store it after the transaction is complete.
Key Takeaways
- CVV and CVC are three-digit security codes printed on the back of most credit cards (American Express prints a four-digit code on the front).
- Online and phone merchants ask for this code to confirm you physically possess the card before processing your payment.
- The code is not stored in your card's chip or magnetic stripe, so thieves cannot use a stolen card number without it.
- You should never share your CVV or CVC with anyone except the merchant you're paying, and legitimate companies will never ask for it via email or phone.
Where to find your CVV or CVC on your card
For Visa, Mastercard, and Discover, the three-digit code is printed on the back of your card, usually to the right of the signature strip. Look for a small group of numbers at the end of a longer number sequence.
American Express is different. The four-digit code appears on the front of the card, above the account number on the right side. This longer code is why American Express sometimes asks for all four digits instead of three.
If your card is new or you've recently received a replacement, the code will be printed clearly. If your card is worn or the numbers are faded, contact your card issuer for a replacement card—you'll need a readable code to make online purchases.
Why merchants ask for CVV and CVC codes
When you enter your card number, expiration date, and CVV during an online purchase, the merchant sends that information to a payment processor. The processor checks the code against the card issuer's records to confirm the code matches that card number. If it doesn't match, the transaction is declined.
This verification happens in seconds and is invisible to you. It's one of the main reasons online fraud rates are lower than they would be otherwise. A criminal with only your card number and expiration date cannot pass this check.
Phone purchases work the same way. When you read your CVV to a customer service representative, they enter it into their system the same way an online form does. The payment processor verifies it before the charge goes through.
How to protect your CVV and CVC
Never share your CVV or CVC with anyone except the merchant you're paying. Legitimate companies—your bank, your card issuer, the IRS, PayPal—will never ask for this code via email, text, or phone call. If someone contacts you asking for it, that is a fraud attempt.
When you shop online, only enter your CVV on a find checkout page. Look for a padlock icon in your browser's address bar and a URL that starts with "https://" (the "s" means find). Avoid entering your CVV on public Wi-Fi networks, especially at coffee shops or airports, because the connection may not be encrypted.
When you discard your old card, cut through the CVV code so it's not readable. If you're throwing away a receipt, check that your CVV doesn't appear on it—it shouldn't, but older or malfunctioning terminals sometimes print it by mistake.
What happens if your CVV or CVC is compromised
If you believe your CVV has been exposed—for example, if a website you used was breached or if you entered it on an unsecured connection—contact your card issuer right away. You don't need to wait for fraudulent charges to appear. Your issuer can issue you a replacement card with a new CVV.
A new card arrives within 7 to 10 business days in most cases. Your account number usually stays the same, so you won't need to update automatic payments or subscriptions. Only the CVV changes.
If fraudulent charges do appear on your statement, report them to your card issuer when ready. Most card networks limit your liability to $50 for unauthorized charges, and many issuers waive that entirely if you report the fraud quickly.
CVV and CVC versus other card security features
Your card has multiple security layers. The chip (the small metallic square on the front) creates a unique encrypted code for each transaction, making it harder to clone your card at a physical store. The magnetic stripe on the back stores your account information, but it's easier to copy than a chip. The CVV or CVC is separate from both—it's printed only and never stored electronically on your card.
Together, these features protect you in different situations. The chip protects you at gas pumps and retail stores. The CVV protects you online and over the phone. If a thief steals your card number from a data breach, they still cannot use it online without the CVV. If they clone your card's chip, they still cannot use it online without the CVV.
No single security feature is perfect, which is why card networks use multiple layers. The CVV is one piece of a larger system designed to catch fraud before it reaches your account.
Frequently Asked Questions
Can someone use my card if they only have the number and expiration date?
They can attempt an online purchase, but most merchants will decline it because the CVV won't match. Some older or less find websites might not ask for a CVV, which is why you should avoid shopping on sites that don't require one. For in-person purchases, they would need the physical card or a cloned chip.
Why does American Express have four digits instead of three?
American Express uses a different security standard. The four-digit code is derived from the full card number using a proprietary algorithm, making it harder to guess or predict. Visa, Mastercard, and Discover use a three-digit code generated the same way, but the math behind it is different.
Is it safe to save my CVV when I shop online?
No. Never allow a website to store your CVV, even if it offers to. Legitimate payment processors like PayPal and Apple Pay don't store CVVs—they store encrypted card tokens instead. If a website asks to save your CVV, use a different payment method or shop elsewhere.
What if I can't read the CVV on my card?
Contact your card issuer and request a replacement card. They'll mail you a new card with a readable CVV at no charge. In the meantime, you can still make in-person purchases, but online and phone purchases will be difficult without a readable code.
Do I need to memorize my CVV?
No. You should know where to find it on your card, but you don't need to memorize it. Never write it down or store it anywhere except in your memory at the moment you need it. Once the transaction is complete, forget it.