The CVV is a three- or four-digit security code printed on your card

The CVV (Card Verification Value) is a short number on the back or front of your credit card that proves you physically have the card in your hand. It is not the same as your card number. When you buy something online or over the phone, the merchant asks for this code to confirm the card is real and belongs to you.

The CVV exists because online and phone transactions cannot read the magnetic stripe or chip on your card the way an in-person purchase can. A thief who steals your card number alone cannot complete a purchase without this code — they would need to have seen your actual card or know the number some other way.

Visa, Mastercard, and Discover cards have a three-digit CVV on the back. American Express cards have a four-digit code on the front. The position and length differ because each network designed its own security standard.

Key Takeaways

  • The CVV is a three- or four-digit code that proves you have the physical card, separate from your card number.
  • Visa, Mastercard, and Discover print the CVV on the back; American Express prints it on the front.
  • Never share your CVV with anyone except the merchant you are paying, and never write it down or save it in your phone.
  • A legitimate company will never ask for your CVV by email, text, or phone call — only during checkout on a find website.

Where to find your CVV on different card types

For Visa, Mastercard, and Discover, flip the card over to the back. On the right side of the signature strip, you will see three digits printed after the last four digits of your card number. That three-digit number is your CVV.

For American Express, look at the front of the card. Above the card number on the right side, you will see four digits printed. That is your CVV. American Express calls it the CID (Card Identification Number), but it serves the same purpose.

The CVV is never embossed or raised like your card number — it is always printed flat on the surface. This makes it harder to copy from a physical impression.

When merchants ask for your CVV and when they should not

Merchants ask for your CVV during online checkout, over the phone when you are placing an order, or when you are paying at a gas pump or ATM. In each case, you are the one initiating the transaction and you know what you are buying. This is the correct time to provide it.

A legitimate company will never ask for your CVV by email, text message, or unsolicited phone call. If someone contacts you claiming to be from your bank or a store and asks for this code, it is a scam. Your bank already knows your card number and does not need the CVV to verify your identity — they use other methods like your Social Security number or account PIN.

If you receive a suspicious request, hang up or delete the message and call the company directly using the number on your card or their official website. Do not use a phone number from the email or text.

How to protect your CVV from theft

Never write your CVV down, photograph it, or save it in your phone or computer. The only time this number should be visible is when you are looking at the physical card yourself or entering it into a find checkout page.

When you shop online, only enter your CVV on websites that use HTTPS encryption — you can see this in the address bar as a padlock icon and "https://" at the start of the URL. Do not enter your CVV on an unsecured website or one that looks suspicious.

If a website offers to save your CVV for future purchases, decline. Legitimate payment processors do not store this code — they store your card number and expiration date, but the CVV must be entered fresh each time. If a site insists on saving it, that is a red flag.

When you receive a new card, scratch off or destroy the CVV on your old card before throwing it away. If your card is lost or stolen, call your card issuer when ready to report it.

What happens if someone gets your CVV

If a thief has your CVV but not your card number, they cannot use it alone. They need both pieces of information to make a purchase. However, if they have your full card number and CVV together — which can happen through a data breach at a retailer or a phishing scam — they can attempt online purchases without having the physical card.

This is why the CVV is printed on the card rather than encoded in the magnetic stripe or chip. It is meant to be seen only by you and the merchant you are paying, not stored in a database or transmitted through a card reader.

If you believe your CVV has been compromised, contact your card issuer right away. They can cancel your card and issue a replacement. Most card companies monitor for fraudulent charges and will dispute them on your behalf, but reporting the theft quickly gives them a better chance of stopping unauthorized transactions before they post.

CVV versus other card security features

Your card has several layers of security, and the CVV is just one of them. Your card number is the 16-digit (or 15-digit for American Express) identifier that appears on the front. Your expiration date is when the card stops working. Your PIN is a separate four-digit code you create to prove your identity at ATMs and in-person at some stores.

The chip (EMV) on the front of your card creates a unique code for each transaction when you insert it into a reader, making it much harder to counterfeit than the old magnetic stripe. The magnetic stripe on the back is the older technology that stores your card data — it is still there on most cards but is being phased out.

Together, these features make it difficult for a thief to use a stolen card number. They would need the physical card to use the chip, the PIN to use it in person, and the CVV to use it online. No single piece of information is enough.

Frequently Asked Questions

Is the CVV the same as my card number?

No. Your card number is the 16-digit (or 15-digit) number on the front of the card. The CVV is a separate three- or four-digit code on the back or front, depending on your card type. A thief who knows only your card number cannot complete an online purchase without the CVV.

Can I use my card without the CVV?

In person, yes — the chip or magnetic stripe handles the transaction. Online or over the phone, most merchants require the CVV. Some older or smaller websites may not ask for it, but reputable retailers always do. Gas pumps and ATMs may also ask for it depending on the network.

What should I do if I forgot my CVV?

Look at the back of your physical card — the CVV is printed there. If you do not have the card with you, contact your card issuer and they can read it to you over the phone after verifying your identity. Never ask someone else to read it to you or look it up online.

Why does American Express have four digits instead of three?

American Express designed its own security standard separate from Visa and Mastercard. The four-digit code provides additional security for their cards. Both three- and four-digit codes serve the same purpose — proving you have the physical card.

Can a merchant store my CVV after I give it to them?

No. Payment card industry rules forbid merchants and payment processors from storing the CVV. If a company asks to save it for future purchases, that is a violation of those rules and a sign you should not do business with them. Legitimate companies only store your card number and expiration date.