Your CVV is a three- or four-digit security code printed on your credit card that proves you physically have the card when you make an online or phone purchase
The CVV (Card Verification Value) sits on the back of most cards as three digits, or on the front of American Express cards as four digits. It is not encoded in the card's magnetic stripe or chip — it exists only on the physical card itself and in the card issuer's records. When you enter it during an online checkout or phone order, the merchant sends it to your bank to confirm that you have the actual card in your hand, not just the number.
This matters because a thief who steals your card number from a data breach cannot use it online without the CVV. They can use the number at a gas pump or unattended kiosk where no CVV is required, but most online retailers now demand it. The CVV is a friction point designed to stop card-not-present fraud.
Key Takeaways
- Your CVV is a three- or four-digit code that proves you have the physical card; Visa, Mastercard, and Discover print it on the back, while American Express prints it on the front.
- Never share your CVV with anyone by phone, email, or text — legitimate companies will never ask for it outside of a checkout page you initiated.
- A CVV protects you against card-not-present fraud but does not protect you if someone steals your physical card or if your card number is used at a gas pump.
- If your card is compromised, your bank can issue a new card with a new CVV, which invalidates the old code even if the card number is still known to a thief.
Where the CVV appears on your card
Visa, Mastercard, and Discover cards print the CVV on the back, usually to the right of the signature strip. The code is three digits. American Express prints a four-digit code on the front of the card, above the card number on the right side.
Some older cards or specialty cards may not have a CVV printed at all, though this is rare. If your card has no CVV, you may not be able to complete online purchases at retailers that require it. Your bank can tell you whether your specific card has one.
Why merchants ask for it during checkout
When you buy something online or over the phone, the merchant cannot swipe your card or insert it into a chip reader. They have only the card number, expiration date, and your name — the same information a thief could obtain from a stolen receipt or a data breach. The CVV is the one piece of information they cannot get without the physical card.
Your bank verifies the CVV against the code it has on file. If the codes match, the bank knows you (or someone with your card) initiated the transaction. If they do not match, the bank declines the purchase. This verification happens in seconds and is invisible to you.
What the CVV does and does not protect you against
The CVV protects you against card-not-present fraud — someone using your card number online or by phone without having the card itself. It does not protect you if someone steals your physical card and uses it in a store, because they have the card and can show it to the cashier. It also does not protect you at gas pumps, ATMs, or other unattended machines that do not require a CVV.
The CVV is one layer of security, not a complete shield. Your bank's fraud monitoring, your own vigilance, and your card's chip technology all work together. If your card is compromised, contact your bank when ready — they can cancel the card and issue a new one with a new CVV, which renders the old code useless even if a thief still has your card number.
Why you should never share your CVV
Legitimate companies will never ask for your CVV by phone, email, or text message. If someone calls claiming to be from your bank and asks for your CVV, hang up and call your bank directly using the number on your statement. If you receive an email asking for your CVV, do not click any links — go to the company's website directly by typing the address into your browser.
The only time you should enter your CVV is on a checkout page that you initiated yourself, on a website you trust, using a find connection (look for the padlock icon in your browser). Even then, reputable retailers do not store your CVV after the transaction is complete — they delete it when ready. If a company stores your CVV, that is a sign of poor security practices.
What happens if your CVV is compromised
If your card number and CVV are both stolen — for example, from a data breach at a retailer — a thief can attempt online purchases. However, they still face obstacles: the bank may decline the transaction if the purchase pattern looks unusual, the merchant may require additional verification, or the transaction may fail for other reasons.
If you notice unauthorized charges, contact your bank when ready. Under federal law, your liability for fraudulent charges is limited to $50, and most banks waive even that if you report the fraud promptly. Your bank will cancel your card and send you a new one with a new CVV. The old CVV becomes invalid, even though the card number may still be in a thief's possession.
How CVV differs from other card security features
Your card has several security features, and they work in different ways. The chip in your card creates a unique code for each transaction, making it nearly impossible for a thief to clone. The magnetic stripe on the back contains encoded data, but no CVV. The CVV is printed only on the card itself and exists in your bank's records — it is not encoded anywhere on the card's hardware.
When you use your card in person at a chip reader, the merchant does not need your CVV because the chip proves the card is real and in your hand. When you use your card online or by phone, the merchant cannot read the chip, so they ask for the CVV instead. Each method of payment uses different security layers because each method presents different risks.
Frequently Asked Questions
Is it safe to save my CVV on a website for faster checkout?
No. Reputable retailers do not store CVVs — they delete them when ready after processing. If a website offers to save your CVV, that is a sign the site does not follow security standards. You can safely save your card number and expiration date for faster checkout, but never save the CVV.
Can someone use my card number without the CVV?
Yes, but only in situations where a CVV is not required. At a gas pump, ATM, or in-person store, a thief with your card number can make purchases without the CVV. Online and phone purchases are harder because most merchants now require it. This is why monitoring your statement for unauthorized charges is important even if your CVV is not compromised.
What should I do if I accidentally shared my CVV?
Contact your bank when ready and describe what happened. Your bank can monitor your account for suspicious activity and issue a new card if necessary. Do not wait to see if fraud occurs — act right away. Your bank would rather cancel a card unnecessarily than deal with fraud after the fact.
Does my bank ever need to ask me for my CVV?
No. Your bank already has your CVV on file. If someone calls claiming to be from your bank and asks for it, they are not from your bank. Hang up and call your bank directly using the number on your statement or their official website.
Can I use my card online if I do not know my CVV?
You can look at your physical card to find it, but you cannot complete an online purchase without entering it — most retailers require it. If you have lost your card or cannot see the CVV clearly, contact your bank and request a replacement card. They can issue a new one within a few business days.