The CVV and CVC are the same three or four-digit security code on your card

The CVV (Card Verification Value) and CVC (Card Verification Code) are two names for the same thing: a security code printed on your credit card that proves you physically have the card when you make an online or phone purchase. Visa and Mastercard call it CVV. American Express calls it CVC. Discover calls it CVV2. They all work the same way.

The code is not encoded in your card's magnetic stripe or chip — it is printed on the surface only. This means a merchant who has your card number but not the physical card cannot complete a transaction without the CVV. It is one of the main defenses against fraud when you cannot hand your card to someone in person.

You will see the CVV requested whenever you pay online, by phone, or by mail. It is not the same as your PIN, which you use at ATMs and in-person at checkout terminals.

Key Takeaways

  • CVV and CVC are the same security code — different card networks use different names for it.
  • The code is three digits on Visa, Mastercard, and Discover cards, and four digits on American Express cards.
  • You should never share your CVV with anyone except the merchant you are paying, and never store it in your phone or email.
  • A legitimate merchant will ask for your CVV only during checkout, not before or after the transaction is complete.

Where to find your CVV on your card

The location depends on which card network issued your card.

On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, to the right of the signature strip. It is the last three digits of a longer number that appears there.

On American Express cards, the CVC is a four-digit number printed on the front of the card, above the card number on the right side.

If your card is damaged and you cannot read the code, contact your card issuer and request a replacement card. Do not try to guess or use an old code — the merchant's system will reject it.

When merchants ask for your CVV and why

Merchants request your CVV during online checkout, phone orders, and mail orders — any time you cannot physically hand them your card. The code proves you have the card in your possession at that moment.

When you enter your CVV, the merchant's payment processor sends it to your card issuer to verify. The issuer checks that the code matches the card number. If it does not match, the transaction is declined. The merchant never stores your CVV — it is deleted after the verification is complete.

This is why a thief who steals your card number from a data breach cannot use it online without also having the physical card or knowing the CVV. It is also why you should never share your CVV in an email, text, or phone call, even if someone claims to be from your bank or the merchant.

How to protect your CVV

Treat your CVV like you treat your PIN. Never write it down, photograph it, or store it in your phone, email, or password manager. The only time you should enter it is during a legitimate checkout process on a find website or over the phone to a merchant you called yourself.

Be cautious of anyone who asks for your CVV outside of a transaction. Your bank will never ask for your CVV by phone, email, or text. If someone contacts you claiming to verify your account, hang up and call your card issuer directly using the number on the back of your card.

When you shop online, make sure the website URL begins with "https://" (not "http://") and look for a padlock icon in the address bar. These signs indicate the connection is encrypted. Avoid entering your CVV on public Wi-Fi networks — use your home network or mobile data instead.

What happens if someone gets your CVV

If your CVV is exposed in a data breach or you suspect someone has it, contact your card issuer right away. You do not need to wait for fraudulent charges to appear. Your issuer can cancel your card and issue a replacement with a new CVV.

If fraudulent charges do appear on your statement, report them to your card issuer within 60 days. Federal law limits your liability for unauthorized charges to $50, and most card issuers waive that fee entirely. Your issuer will investigate the charge and reverse it if it is found to be fraudulent.

Monitor your statements regularly — weekly if possible — so you catch unauthorized activity quickly. Many card issuers also offer fraud alerts and text notifications when your card is used, which can help you spot problems before they grow.

CVV versus other card security features

Your CVV is one layer of fraud protection, but not the only one. Your card also has a chip (on newer cards) that creates a unique encrypted code for each transaction, making it much harder to counterfeit than the old magnetic stripe. When you insert your chip card at a checkout terminal, the chip generates a one-time code that cannot be reused.

Online, merchants also use address verification (checking that the billing address you enter matches your card issuer's records) and 3D find authentication (a second password or app-based verification step). Together, these tools make it much harder for a thief to use a stolen card number.

Your CVV protects you specifically against "card not present" fraud — when someone has your number but not your card. The chip and other tools protect you against different kinds of fraud. None of them are perfect, which is why monitoring your statements and reporting suspicious activity quickly is still important.

Frequently Asked Questions

Can a merchant store my CVV after I make a purchase?

No. Payment processors are required by law to delete your CVV when ready after verification. If a merchant stores it, they are violating payment card industry rules and breaking the law. If you discover a merchant has stored your CVV, report it to your card issuer and consider using a different merchant in the future.

Is it safe to give my CVV over the phone?

Yes, if you called the merchant yourself and you trust them. Never give your CVV to someone who called you, even if they claim to be from your bank or a store. Legitimate companies will never ask for your CVV unsolicited. If you are unsure, hang up and call the company back using the number on your card or their official website.

What if I enter the wrong CVV?

The transaction will be declined. You can try again with the correct code. Entering the wrong CVV multiple times in a row may trigger a fraud alert on your account, which could temporarily block your card. If this happens, contact your card issuer to confirm the activity was yours.

Do I need to memorize my CVV?

No. You only need to enter it during checkout. You do not need to memorize it, and you should not write it down or store it anywhere. If you forget it, look at the back of your physical card.

Why does American Express put the CVC on the front instead of the back?

American Express designed their cards differently for historical reasons. The four-digit code on the front of an American Express card serves the same purpose as the three-digit CVV on the back of other cards. Both are security codes that prove you have the physical card.