The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a short number on the back or front of your credit card that exists for one reason: to confirm you're holding the actual card when you make a purchase. It's not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online or over the phone without also having the physical card in hand.
Visa and Mastercard call it CVV. American Express calls it CID. The number sits in a different place depending on your card type, and it's always printed in plain text — never embossed like your card number. When you enter it during checkout, the merchant sends it to your bank, which checks that it matches their records. If it doesn't, the transaction stops.
This is a security layer, not a may provide. It reduces one specific type of fraud — card-not-present theft — but it doesn't protect you if someone has both your number and your CVV, or if a merchant's website is compromised.
Key Takeaways
- The CVV is a three- or four-digit code that proves you have the physical card, separate from your card number itself.
- Visa and Mastercard print the CVV on the back of the card in a three-digit format; American Express prints a four-digit code on the front.
- You enter the CVV when shopping online or over the phone, and the merchant's bank checks it against their records before approving the charge.
- The CVV is not stored in your card's chip or magnetic stripe, so thieves who steal only your card number cannot use it without the physical card.
- Sharing your CVV with anyone — even someone claiming to be from your bank — puts your card at risk and is never necessary for legitimate transactions.
Where the CVV appears on different card types
On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, to the right of the signature strip. You'll see your full card number, then an empty space, then the three-digit code. It's the last thing printed on that line.
American Express cards are different. The four-digit code (called the CID) appears on the front of the card, above and to the right of your card number. Because American Express prints it on the front, it's slightly more visible, but the principle is the same.
Discover cards follow the Visa and Mastercard format: three digits on the back, to the right of the signature strip. If you're unsure which number is your CVV, the safest approach is to look at the back of the card first — that's where it lives on most cards you'll encounter.
Why merchants ask for it during online and phone purchases
When you shop in a store and hand your card to a cashier, they can see that you have the physical card. Online and over the phone, the merchant has no way to verify this — they only see a string of numbers on a screen. The CVV bridges that gap by requiring a number that exists only on the card itself, not in any database the merchant can access.
The merchant never stores your CVV. Payment processors are required by law to delete it when ready after the transaction is approved. This means even if a hacker breaks into a merchant's system and steals card numbers, the CVV won't be there — it was discarded the moment the charge went through.
This is why you need to enter it every time you use a new device or browser, even if that website remembers your card number. The number they remember is useless without the CVV, which you must provide fresh each time.
What the CVV does not protect you from
The CVV does not protect you if someone has both your card number and your CVV. If a merchant's website is compromised, or if you enter your information on a fake website, a thief gets both pieces of information at once. The CVV cannot stop that.
The CVV also does not protect you against fraud on your card if someone uses it in person. A thief with your physical card can make purchases at any store without needing the CVV — the card itself is the proof. The CVV only matters for card-not-present transactions: online, by phone, or by mail.
It also does not protect you against identity theft or account takeover. If someone gains access to your online banking login, they can change your address, request a new card, or make other changes without ever needing your CVV.
Why you should never share your CVV
Your bank will never ask you for your CVV by phone, email, or text message. If someone contacts you claiming to be from your bank and asks for it, that is fraud. Hang up and call your bank directly using the number on the back of your card.
The only time you should enter your CVV is when you are the one initiating a purchase — you're typing it into a checkout form or reading it to a merchant you called. You should never give it to someone else, even if they claim to be processing a refund or investigating fraud on your account.
If you've accidentally shared your CVV with someone, contact your card issuer right away. They can cancel your card and issue a replacement. The faster you act, the less time a fraudster has to use the information.
How the CVV works behind the scenes
When you enter your CVV during checkout, the merchant's payment processor sends it to your card issuer's computer system. Your issuer checks whether the CVV in the system matches the one you provided. This happens in seconds, usually without you noticing.
If the numbers match, the transaction is approved. If they don't match — because you mistyped it, or because someone is using a stolen card number with a wrong CVV — the transaction is declined. The merchant sees only "declined" on their screen; they don't see why.
The entire CVV is deleted from the merchant's system when ready after approval. It's not stored in their database, not backed up, not kept for future reference. This is why you must enter it again the next time you shop, even at the same store.
What happens if you forget or mistype your CVV
If you enter the wrong CVV, your transaction will be declined. You'll see an error message asking you to check the number and try again. You can look at your card and re-enter it correctly, and the transaction will usually go through on the second attempt.
If you're shopping online and can't find your card, you have a few options. You can stop the transaction, find your card, and start over. You can call the merchant's customer service line and ask to complete the purchase by phone, reading the CVV to them directly. Or you can use a different payment method if the site offers one.
Repeatedly entering the wrong CVV — more than three or four times in a short period — may trigger a fraud alert on your account. Your bank might temporarily block the card to protect you. If this happens, call your bank to confirm the transactions are legitimate, and they'll unlock the card.
Frequently Asked Questions
Is the CVV the same as my card number?
No. Your card number is the 16 digits (or 15 for American Express) printed across the front of the card. The CVV is a separate three- or four-digit code printed on the back or front. A thief who has only your card number cannot use it online without the CVV.
Can I use my card online without entering the CVV?
Most online merchants require the CVV before they'll process your payment. Some stored payment methods (like saved cards in your Amazon or Apple account) may not ask for it on repeat purchases because the merchant already verified it once. But for a new purchase on a new device, you'll almost always need to enter it.
What should I do if I think someone has my CVV?
Call your card issuer when ready. Tell them you believe your CVV has been compromised. They will cancel your current card and send you a replacement with a new CVV. There's no charge for this, and it usually takes five to seven business days to receive the new card.
Do I need to memorize my CVV?
No. You should never memorize it or write it down. The only time you need it is when you're making a purchase and have your card in hand. Keeping it in your wallet with your card is the safest approach — it's only useful if you have the physical card anyway.
Can someone use my card if they only have my card number and CVV?
Yes, they can make online and phone purchases. They cannot use it in a store because they don't have the physical card. To protect yourself, monitor your statements regularly and report any charges you don't recognize to your bank within 60 days.