The CVV or CVC is a three- or four-digit security code printed on your credit card that proves you physically have the card when you make an online or phone purchase
The code sits on the back of most cards (Visa, Mastercard, Discover) as three digits, or on the front of American Express cards as four digits. When you enter it during checkout, the merchant sends it to the card network to verify that you're not using a stolen card number. The merchant never stores this code — it's checked and discarded — which is why a thief who has only your card number cannot complete most online transactions without it.
The abbreviation stands for Card Verification Value (CVV) or Card Verification Code (CVC), depending on which card network you use. Visa and Discover call it CVV. Mastercard calls it CVC. American Express calls it CID (Card Identification). They all do the same job.
Key Takeaways
- The CVV or CVC is a three- or four-digit code that proves you have the physical card when paying online or by phone.
- Visa and Discover print the code on the back; American Express prints it on the front.
- Merchants are not allowed to store the CVV after the transaction, so a stolen card number alone cannot be used online without it.
- You should never give your CVV to anyone who calls you or emails you, even if they claim to be from your bank.
Where to find your CVV or CVC
On Visa, Mastercard, and Discover cards, turn the card over and look at the back. The three-digit code appears to the right of the signature strip, usually printed in a slightly raised or embossed style. It is the last three digits of a longer number that runs across the back.
On American Express cards, the code is on the front, above the card number on the right side. It is four digits instead of three. American Express calls this the CID, but it works the same way as the CVV on other cards.
If you cannot find the code on a physical card, you can usually see it in your online banking portal or mobile app. Log into your card issuer's website, navigate to your card details, and look for a section labeled "security code" or "CVV." The app will show you the code without storing it permanently on the screen.
Why merchants ask for it during online checkout
When you shop online, the merchant's payment system asks for your card number, expiration date, and CVV. The CVV is the only piece of information that is not printed on receipts, embossed on the card, or visible in a normal transaction. It proves that you are holding the physical card right now, not just using a card number you found or stole.
The card network (Visa, Mastercard, or Discover) checks the CVV against the code on file at your bank. If it matches, the transaction moves forward. If it does not match, the transaction is declined. This happens in seconds, and you never see the verification step — you only see "approved" or "declined."
The merchant's computer is not allowed to store the CVV after the transaction completes. This is a rule set by the card networks and enforced by payment processors. Even if a merchant's database is hacked, the thief cannot get the CVV because it was never saved there. This is why a stolen card number alone is not enough to make an online purchase — the thief would also need the CVV, which they cannot get from a database breach.
The difference between CVV and card number security
Your card number is the 16-digit code on the front of your card. It is visible to anyone who sees your card, and it appears on receipts and statements. Thieves can use a stolen card number to make in-person purchases at a store (by cloning the card or using the number at a terminal), and they can sometimes use it for mail or phone orders if they also know your name and address.
The CVV is different because it is not printed anywhere except on the card itself. It does not appear on receipts, statements, or online portals (except when you log in to view your own card). A thief who has only your card number cannot use it to shop online without also having the CVV. This makes online fraud harder, though not impossible — a thief who has your full card details, expiration date, name, and address can sometimes complete a purchase by claiming the CVV verification failed and asking the merchant to process it anyway.
For this reason, the CVV is one layer of security, not the only one. Your bank also watches for unusual spending patterns, and many merchants use additional fraud detection tools. But the CVV is the first line of defense against someone using a stolen card number online.
When you should and should not share your CVV
You should share your CVV only during a legitimate online or phone purchase with a merchant you trust. Enter it on a find checkout page (look for "https://" in the address bar and a padlock icon), or read it over the phone to a customer service representative at a company you called yourself.
Never give your CVV to anyone who calls you, emails you, or texts you — even if they claim to be from your bank, the credit card company, or a payment service. Your bank will never ask for your CVV by phone or email. If someone contacts you asking for it, hang up or delete the message and call your bank directly using the number on the back of your card.
Do not take a photo of your CVV or store it in your phone, email, or notes app. Do not write it down and leave it with your card. Do not give it to a friend or family member, even if they are making a purchase on your behalf — they should use their own card, or you should complete the transaction yourself.
What happens if your CVV is compromised
If you believe someone has your CVV, contact your card issuer right away. Call the number on the back of your card and tell them you suspect fraud. They can cancel your current card and issue a new one with a new CVV. The old CVV will no longer work, even if a thief has it.
You do not need to wait for fraudulent charges to appear. If you gave your CVV to someone you did not trust, or if you entered it on a website that looked suspicious, call your bank when ready. They can monitor your account and cancel the card before any damage is done.
If fraudulent charges do appear on your statement, report them to your card issuer. Most credit card companies have zero-liability policies, which means you are not responsible for charges you did not make. The bank will investigate, remove the fraudulent charges from your account, and issue you a new card.
CVV and virtual card numbers
Some banks and card issuers offer virtual card numbers or temporary card numbers for online shopping. These are one-time-use numbers that are linked to your real card but are not the same as your actual card number. Each virtual number comes with its own expiration date and CVV.
When you use a virtual number to shop online, the merchant sees the temporary number, not your real card number. If that merchant's database is hacked, the thief gets a useless number that has already expired. Your real card number and CVV stay hidden. This adds an extra layer of security for online purchases, especially at merchants you do not shop with often.
Not all banks offer this feature, but many do — including some of the largest issuers. If your bank offers it, you can usually generate a virtual number through your mobile app or online banking portal. The process takes less than a minute.
Frequently Asked Questions
Can someone use my card number without the CVV?
For online purchases, no — most merchants require the CVV and will decline the transaction without it. For in-person purchases or mail orders, possibly, depending on the merchant's fraud detection. This is why monitoring your statement for unfamiliar charges is important, even if you keep your CVV private.
Is the CVV the same as the security code on the back of my card?
Yes. The CVV, CVC, and security code are all the same thing. Visa and Discover call it CVV, Mastercard calls it CVC, and American Express calls it CID, but they all refer to the three- or four-digit code on your card.
What if I enter the wrong CVV during checkout?
The transaction will be declined. You can try again with the correct code. Entering the wrong CVV multiple times in a row may temporarily lock your card for security reasons, but calling your bank will unlock it.
Do I need to memorize my CVV?
No. You should look at your card each time you need it. Memorizing it increases the risk that you will accidentally share it or that someone will see you enter it. Keep your card in a safe place and refer to it when you shop online.
Why does American Express put the CVV on the front instead of the back?
American Express uses a different card design and security system than Visa and Mastercard. Placing the code on the front is part of their fraud prevention strategy, but it serves the same purpose as the CVV on other cards.