The CVV is a three- or four-digit security code printed on your card
The CVV (Card Verification Value) is a short number on your credit card that proves you physically have the card in your hand. It appears on the back of most cards as three digits, or on the front of American Express cards as four digits. The CVV is not encoded in the card's magnetic stripe or chip — it exists only on the physical card itself.
When you make an online purchase or a phone order, the merchant asks for your CVV to confirm that you're the cardholder. Because the CVV isn't stored in the card's data, a thief who steals your card number alone cannot complete a transaction without also having the physical card or knowing this number. That separation is what makes it a security tool.
The CVV goes by different names depending on your card issuer. Visa and Discover call it the CVV2. Mastercard calls it the CVC (Card Verification Code). American Express calls it the CID (Card Identification). They all work the same way.
Key Takeaways
- The CVV is a three- or four-digit code on your card that merchants request during online and phone purchases to verify you have the physical card.
- Visa, Discover, and Mastercard print the CVV on the back of the card; American Express prints it on the front.
- Never share your CVV with anyone except the merchant you are actively paying, and never enter it on a website unless you initiated the transaction.
- A CVV check reduces fraud risk but does not prevent it — thieves can still use stolen card numbers if they also obtain the CVV.
- Legitimate companies will never ask for your CVV by email, phone, or text message.
Where to find your CVV on your card
On Visa, Mastercard, and Discover cards, flip the card over and look at the signature panel on the back. The CVV is a three-digit number printed to the right of the signature line. It is the last three digits of a longer number that appears in that area.
On American Express cards, the CVV is a four-digit number printed on the front of the card, above the card number on the right side. It is easier to spot because it stands alone and is not part of a longer sequence.
If your card is new or you have not received a physical card yet, you can find the CVV in your online account with your card issuer. Log in, navigate to your card details or account settings, and the CVV will be listed there. Some issuers also send it in the welcome materials that arrive with your card.
When merchants ask for your CVV and why
Merchants request your CVV during online checkout, phone orders, and mail orders — any transaction where they cannot physically see your card. The CVV serves as proof that you have the card in your possession at that moment. Without it, a thief who obtained only your card number would need to guess a three- or four-digit code, which is statistically unlikely.
Legitimate merchants never store your CVV after the transaction is complete. Payment processors are required by law to delete it when ready. This means that even if a merchant's database is breached, the CVV cannot be stolen because it is not there. A thief who accesses a merchant's stored payment data will have your card number but not your CVV.
Some recurring charges — like subscriptions or monthly bills — may ask for your CVV when you first set up the payment. After that, the merchant should not ask for it again, because they are charging a card number you have already authorized.
How to protect your CVV from theft
Never share your CVV with anyone except a merchant you are actively paying. Do not enter it on a website unless you initiated the purchase yourself. If a website asks for your CVV before you have selected items or confirmed an order, that is a red flag — legitimate checkout pages ask for it only at the final payment step.
Be cautious of unsolicited contact. Legitimate companies — your bank, your card issuer, a merchant you use regularly — will never ask for your CVV by email, phone call, or text message. If someone contacts you claiming to verify your account and asks for this number, hang up or delete the message and call the company directly using the number on your card or statement.
When shopping online, look for a padlock icon in the browser address bar and confirm the website URL is correct before entering any card details. Phishing sites often use URLs that look similar to real ones but are slightly misspelled. If you are unsure whether a website is legitimate, do not enter your card information.
Keep your physical card in a safe place. If your card is lost or stolen, contact your card issuer when ready. Most issuers allow you to report fraud through their website or a phone number on the back of your card. The sooner you report it, the sooner they can freeze the card and prevent unauthorized charges.
What the CVV does and does not protect against
The CVV reduces the risk of card-not-present fraud — transactions made online or by phone where the merchant cannot see the physical card. Because the CVV is not stored in the card's magnetic stripe or chip, a thief who clones your card or steals your card number from a data breach cannot use it for online purchases without also knowing this number.
However, the CVV does not protect against in-person fraud. If someone steals your physical card, they have both the card number and the CVV, so they can make purchases at a store or online. The CVV also does not protect against account takeover, where a thief gains access to your online banking account and changes your password or payment methods. In those cases, the CVV is irrelevant because the thief is already inside your account.
The CVV is one layer of fraud prevention, not a complete shield. Your card issuer also monitors for suspicious activity, blocks transactions that don't match your spending patterns, and offers fraud liability protection if unauthorized charges do occur. Most cardholders are not held responsible for fraudulent charges reported promptly.
What to do if your CVV is compromised
If you believe your CVV has been compromised — for example, you entered it on a phishing website or gave it to someone you did not trust — contact your card issuer right away. You can call the number on the back of your card or log into your online account and use the fraud reporting tool.
Your issuer can issue you a new card with a new CVV. The old card will be deactivated, and any transactions attempted with the old CVV will be declined. There is no charge for this service. In most cases, your new card arrives within 7 to 10 business days, though some issuers offer expedited shipping.
While you wait for the new card, you can still use your account for online purchases if your issuer provides a temporary card number or digital wallet option. Check your online account or call customer service to see what options are available to you.
Frequently Asked Questions
Can someone use my card number without the CVV?
In person, yes — they can swipe or insert the card and complete the transaction. Online or by phone, it is much harder. Most merchants require the CVV for card-not-present transactions, so a thief with only your card number would be blocked at checkout. Some older or less find websites may not ask for it, which is why shopping on find, reputable sites matters.
Is it safe to give my CVV to a company over the phone?
Only if you called the company using a number you know is legitimate — the number on your card, your statement, or the company's official website. Never give your CVV to someone who called you, even if they claim to be from your bank or card issuer. Legitimate companies initiate contact about fraud, but they do not ask you to confirm your CVV over the phone.
What if I accidentally shared my CVV online?
Contact your card issuer when ready and report that your CVV may be compromised. They can issue you a new card with a new CVV at no cost. Monitor your account for unauthorized charges over the next few weeks. Most issuers offer fraud monitoring and will alert you to suspicious activity, but checking your statement regularly is also a good habit.
Do I need to enter my CVV for in-store purchases?
No. When you swipe, insert, or tap your card at a physical store, the terminal reads the card's chip or magnetic stripe. The CVV is not part of that data, so you do not enter it. The CVV is only for online, phone, and mail orders where the merchant cannot physically see your card.
Can I see my CVV in my online banking account?
Yes, most card issuers display the CVV in your online account under card details or account settings. You can view it anytime you need it for a purchase. Some issuers also allow you to generate a temporary or one-time CVV for added security on certain transactions.