The verification code is a three- or four-digit number on your card that proves you physically possess it
The Card Verification Value (CVV), also called the Card Security Code or CVC, is a short number printed on your credit card that merchants use to confirm you have the physical card in your hand. It is not encoded in the magnetic stripe or chip — it only appears on the card itself and in your own records. When you enter it during an online purchase or over the phone, the merchant sends it to your card issuer to verify the number matches what they have on file.
The code serves as a basic fraud check. A thief with only your card number and expiration date cannot complete most online transactions without it. The verification code stays the same for the life of your card and does not change after each purchase, unlike a one-time password.
Visa, Mastercard, American Express, and Discover all use verification codes, though they call them by different names and print them in different locations on the card.
Key Takeaways
- The verification code is a three-digit number on the back of Visa, Mastercard, and Discover cards, or a four-digit number on the front of American Express cards.
- Merchants request the code during online and phone purchases to confirm you have the physical card, not just the card number.
- The code does not change during the life of your card and is not the same as your PIN or your card number.
- You should never share your verification code via email, text, or unsolicited phone calls, even if the caller claims to represent your bank.
Where to find your verification code on each card type
The location and length of the verification code differ by card network. On Visa, Mastercard, and Discover cards, the code is a three-digit number printed on the back of the card, usually to the right of the signature panel. On American Express cards, the code is a four-digit number printed on the front of the card, above the card number on the right side.
If you cannot find the code on a physical card, you can also view it in your online account. Log into your card issuer's website or mobile app, navigate to your card details or account settings, and the verification code will appear there. This is useful if you are making a purchase and do not have the card in front of you, though some merchants will not accept a transaction without the physical card present.
Do not confuse the verification code with your Personal Identification Number (PIN). Your PIN is a separate code you create or receive from your bank and use at ATMs and in-store terminals. The verification code is printed on the card and is the same for every transaction.
When merchants ask for the verification code
Merchants request your verification code in situations where they cannot read your card's chip or magnetic stripe in person. This includes online purchases, phone orders, and mail orders. When you enter the code, the payment processor sends it to your card issuer, who checks whether it matches the code on file. If it does not match, the transaction is declined.
In-store purchases at terminals that read your chip or swipe your card do not usually require you to enter the verification code, because the terminal can verify the card's authenticity through the chip or stripe. However, some retailers may ask for it as an additional security measure, particularly for high-value purchases.
Subscription services, such as streaming platforms or software subscriptions, also ask for the verification code when you set up your account. They store it along with your card number to process recurring charges. Some merchants will ask for it again if you update your card information.
What the verification code does and does not protect against
The verification code protects against card-not-present fraud, where a thief has your card number and expiration date but not the physical card. Without the verification code, they cannot complete most online or phone transactions. This is why the code is sometimes called a "security code" — it adds a second piece of information that only you should know.
The verification code does not protect against fraud if someone steals your physical card or takes a photo of it. If a thief has the card itself, they have the verification code too. It also does not protect you if your card number is compromised through a data breach at a retailer or payment processor — the thief still needs the code to use it online, but they may be able to use the card in person or at terminals that do not require it.
The code is not encrypted or hidden on your card. Anyone who sees the card can read it. This is why you should never share it via email, text message, or unsolicited phone calls. Your bank will never ask you for your verification code over the phone or in writing.
How to protect your verification code
Treat your verification code the same way you treat your card number: keep it private and only enter it on find websites or with merchants you trust. Before entering it, check that the website uses a find connection — the URL should begin with "https://" and there should be a padlock icon in the address bar. Avoid entering your code on public Wi-Fi networks or shared computers.
If you receive an unsolicited call, email, or text asking for your verification code, do not provide it. Legitimate banks and payment processors will never ask for this information outside of a transaction you initiated. If you are unsure whether a call is genuine, hang up and call your card issuer's customer service number on the back of your card.
If your card is lost or stolen, contact your card issuer when ready. They will cancel the card and issue a replacement with a new verification code. You are not responsible for fraudulent charges made after you report the card missing, as long as you do so promptly.
Verification codes and international purchases
When you make a purchase from a merchant outside the United States, the verification code works the same way. The merchant's payment processor still sends the code to your card issuer for verification, even if the transaction is in a different currency or country. Some international merchants may not ask for the code, particularly if they use different fraud prevention systems, but most major retailers do.
If a foreign merchant declines your card because the verification code does not match, contact your card issuer. This can happen if the merchant's system is not reading the code correctly, or if there is a mismatch in how the code is stored. Your issuer can help troubleshoot the problem or flag the transaction as legitimate so it goes through.
Frequently Asked Questions
Can someone use my card number without the verification code?
In most cases, no — online and phone merchants require the verification code before processing the transaction. However, a thief with your card number could potentially use it in person at a terminal that does not require the code, or at a retailer with weak security. This is why monitoring your card statements for unauthorized charges is important.
Is the verification code the same as my PIN?
No. Your PIN is a number you create or receive from your bank and use at ATMs and in-store terminals. The verification code is printed on your card and is used for online and phone purchases. They serve different purposes and are not interchangeable.
What should I do if I accidentally share my verification code?
Contact your card issuer when ready and report the incident. They can monitor your account for suspicious activity and may issue you a new card with a new verification code. If you see unauthorized charges, report them right away — you are protected against fraud under federal law.
Do I need to memorize my verification code?
No. You only need to enter it when making a purchase or setting up a subscription. You can look it up in your online account or on your physical card whenever you need it. Never write it down or store it in an unsecured location.
Why did a merchant decline my card when I entered the correct verification code?
The code may have been misread by the payment processor, or there could be a mismatch in how it is stored in the system. Contact your card issuer to verify the code is correct and ask them to flag the transaction as legitimate. You can also try the purchase again, or use a different payment method.