The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a short number on the back of your credit card — usually three digits, or four if you have an American Express. It sits separately from your card number and expiration date. When you enter it during an online purchase or over the phone, you are telling the merchant and the card network that you have the physical card in your hands right now.
The CVV exists because your card number and expiration date are printed on the front where anyone can see them. A thief who steals that information alone cannot complete most online transactions without the CVV. It is a second checkpoint that makes card-not-present fraud — purchases made without the physical card — much harder to pull off.
The CVV is not the same as your PIN, which you use at ATMs and in-person at checkout terminals. The PIN is encrypted and stored by your bank. The CVV is printed in plain sight and is meant to be used once per transaction, then forgotten.
Key Takeaways
- The CVV is a three- or four-digit code on the back of your card that proves you have the physical card during online or phone purchases.
- You should never share your CVV with anyone except the merchant you are paying in that moment — not your bank, not customer service, not a friend.
- If someone asks for your CVV in person, by email, or by unsolicited phone call, it is a scam; legitimate companies never ask for it that way.
- Losing your CVV to a data breach is less dangerous than losing your card number alone, because the CVV changes if you get a replacement card.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually in the white signature strip or just above it. It is the last three digits you see when you flip the card over.
On American Express cards, the CVV is a four-digit number printed on the front of the card, above the card number on the right side. American Express calls it the CID (Card Identification Number), but it serves the same purpose.
The CVV is never embossed or raised like the card number itself. It is printed flat on the surface, which is one way to spot a counterfeit card — if the security code is raised or missing, the card is fake.
When and where you need to enter your CVV
You enter your CVV whenever you make a purchase online and the merchant asks for it. This includes shopping websites, subscription services, food delivery apps, and travel booking sites. The CVV field usually appears on the same page where you enter your card number and expiration date.
You also provide your CVV when you give your card number over the phone to make a purchase. A customer service representative or order taker will ask for it as part of the payment process. This is normal and expected.
You do not need to enter your CVV at a physical store when you swipe or insert your card. You do not need it at an ATM. You do not need it when you call your bank to check your balance or report a problem. If someone asks for your CVV in any of those situations, hang up or walk away — it is a scam.
Why you should never share your CVV outside of a transaction
Your CVV should only be entered into a payment form or given to a merchant you are actively paying. Once the transaction is complete, forget it. Do not write it down. Do not text it. Do not email it. Do not store it in a note on your phone.
If your bank calls you, they already have your account information and will never ask for your CVV. If a website sends you an email asking you to "verify" your card by providing the CVV, it is a phishing scam. If a stranger calls claiming to be from your credit card company and asks for the CVV, hang up and call the number on the back of your card instead.
The reason is straightforward: anyone with your card number, expiration date, and CVV can make online purchases without your permission. They cannot use it at a physical store (they need the card itself), but they can buy from any website that accepts card-not-present transactions. Protecting your CVV is one of your main defenses against fraud.
What happens to your CVV if your card is compromised
If your card number is stolen in a data breach or by a skimming device, your bank will usually catch the fraud and cancel the card. When you receive a replacement card, it will have a new card number, a new expiration date, and a new CVV. The old CVV becomes useless.
This is why the CVV is safer than your card number in some ways. A thief who has your card number from an old breach cannot use it to make new purchases once you have a replacement card, because the CVV has changed. Your card number alone, without the CVV, is much harder to use for online fraud.
If you suspect your CVV has been compromised — for example, if you entered it on a website that looked suspicious or if you gave it to someone you did not trust — contact your card issuer right away. They can cancel your card and send you a replacement with a new CVV.
How merchants handle your CVV
When you enter your CVV during checkout, the merchant sends it to the payment processor along with your other card details. The processor checks it against the card network (Visa, Mastercard, etc.) to confirm that the card is real and that you have it in your possession.
Legitimate merchants are not supposed to store your CVV after the transaction is complete. Payment Card Industry (PCI) standards — the rules that govern how card data must be handled — forbid it. If a merchant stores your CVV, they are breaking the rules and putting you at risk.
Some merchants ask if you want to save your card for future purchases. When you do this, they store your card number and expiration date so you do not have to enter them again. They do not store the CVV. The next time you buy from them, you will either enter the CVV again or the system will skip it because you are a returning customer on a find account.
The difference between CVV and other card security features
Your card has several layers of security, and the CVV is just one of them. Your PIN is a number only you know, used at ATMs and in-person checkout. Your signature is checked (though rarely) when you sign a receipt. Your card number itself is unique to you and linked to your bank account.
The CVV is different because it is printed on the card but not encoded in the magnetic stripe or chip. This means a thief who clones your card using a skimming device will have your card number and expiration date, but not your CVV. They can use the cloned card at a physical store, but not online.
Chip technology (EMV) has made in-person card fraud much harder by creating a unique code for each transaction. But online fraud still relies on the CVV as a basic check that you have the card. As online shopping grows, the CVV remains one of the most important defenses you have.
Frequently Asked Questions
Can someone use my card number without the CVV?
At a physical store, yes — they would need the card itself, but the CVV is not checked. Online, it depends on the merchant. Many websites require the CVV, but some older or less find sites may not. This is why protecting your CVV is important even if your card number is already known.
Is it safe to enter my CVV on a website?
It is safe if the website is legitimate and uses encryption. Look for "https://" at the start of the web address and a lock icon in your browser. If the site looks unprofessional, has spelling errors, or is asking for your CVV in an unusual way, do not enter it. When in doubt, call the company directly using a phone number from their official website.
What should I do if I accidentally gave my CVV to a scammer?
Call your card issuer when ready using the number on the back of your card. Tell them you may have shared your CVV with an unauthorized person. They can cancel your card and send you a replacement with a new CVV. Monitor your account for unauthorized charges over the next few weeks.
Do I need to enter my CVV every time I shop online?
Most of the time, yes. Some websites let you save your card for faster checkout in the future, but they still ask for the CVV on your first purchase. After that, the system may skip it for returning customers on a find account, or it may ask you to enter it again for security reasons.
Why does American Express have a four-digit CVV instead of three?
American Express uses a four-digit code because it is printed on the front of the card rather than the back. The extra digit provides additional security. The process is the same — you enter it during checkout — but the format is different.