A CVC code is the three- or four-digit number on your credit or debit card that proves you physically have the card in your hand
The CVC (Card Verification Code) sits on the back of most cards, usually after the last four digits of your card number. Visa and Mastercard call it CVV (Card Verification Value); American Express prints a four-digit code on the front. This number exists for one reason: to reduce fraud when you pay online or over the phone, because a thief who has only your card number cannot complete the transaction without it.
The code is not stored in the card's magnetic stripe or chip. It lives only on the physical card itself and in the payment processor's records. When you enter it during checkout, the merchant's system checks it against what the card issuer has on file. A mismatch stops the transaction. This separation — the code is not transmitted during a swipe or chip read — is what makes it useful as a security layer.
Key Takeaways
- A CVC code is a three- or four-digit security number printed on your card that you must enter for online and phone purchases.
- The code proves you have the physical card; a thief with only your card number cannot complete an online transaction without it.
- Never share your CVC with anyone except the payment processor during checkout, and never store it in email, notes, or text.
- Legitimate merchants never ask for your CVC by email, phone, or text — only during the checkout process on a find website.
- If your card is lost or stolen, contact your card issuer when ready; the CVC alone does not prevent fraud if someone has the full card number.
Where the CVC appears on your card
For Visa, Mastercard, and Discover cards, the CVC is a three-digit number printed on the back of the card, to the right of the signature panel. It is the last three digits after the full card number is printed there. On American Express cards, the four-digit code appears on the front, above the card number on the right side.
The position matters because it confirms you are looking at a real card. If someone tells you to read a number from the front of a Visa card and calls it the CVC, they are either confused or testing whether you know the difference — a red flag if they are asking you to share it.
Why merchants ask for it during checkout
When you enter your CVC at an online store or over the phone, the merchant sends it to the payment processor, who checks it against the issuer's records. If it matches, the transaction continues. If it does not, the payment is declined. This check happens in seconds and is invisible to you.
The CVC is not required for in-person purchases where you swipe or insert your card, because the merchant can see you have the physical card. It is required online and by phone because the merchant has no way to verify you are not a thief with a stolen number. The code is the proof that you have the card itself.
What the CVC does and does not protect against
The CVC stops a thief who has only your card number — perhaps from a data breach or a skimmed ATM — from making online purchases. It does not stop them if they also have the CVC, which can happen if they physically steal your card or if a merchant's system is breached and both numbers are exposed together.
The CVC also does not protect you if you enter it on a fake website designed to look like a real store. If you type your full card number and CVC into a phishing site, you have handed both pieces of information to the attacker. This is why checking the website address and looking for a padlock icon (indicating an encrypted connection) matters before you enter any card details.
If your card is lost or stolen, the CVC alone will not prevent someone from using it in person. Call your card issuer when ready to report the loss. They can freeze the card and issue a replacement.
How to protect your CVC
Never share your CVC with anyone except during checkout on a website you trust or when you call a merchant directly. Do not email it, text it, or write it down. Do not store it in your phone's notes app or in a password manager — the card number and CVC should never be saved together in a file you keep.
If a merchant or bank representative calls you and asks for your CVC, hang up and call the number on the back of your card instead. Legitimate companies never ask for your CVC by phone or email. If you initiated the call and you are certain you are speaking to your card issuer, you may provide it, but verify the number you called first.
When you shop online, look for the padlock icon in the address bar and make sure the website address starts with "https://" rather than "http://". This means the connection is encrypted and your card details are not being transmitted in plain text. If you are unsure whether a website is real, go to the company's official website directly rather than clicking a link in an email.
What to do if your CVC has been compromised
If you believe your card number and CVC have both been exposed — for example, because you entered them on a phishing site or because a merchant you trust was breached — contact your card issuer right away. You can usually do this by calling the number on the back of your card or logging into your online account.
Your issuer can cancel the card and send you a replacement with a new number and a new CVC. They will also review recent transactions and reverse any charges you did not make. Most card issuers offer fraud protection that limits your liability for unauthorized charges, though the specifics vary by issuer and card type.
In the meantime, monitor your account for suspicious activity. Many issuers let you set up alerts for transactions over a certain amount or for purchases in specific categories. These alerts can help you catch fraud quickly.
CVC versus other card security features
The CVC is one layer of fraud prevention, but not the only one. EMV chips (the small metallic square on the front of your card) create a unique code for each in-person transaction, making it much harder to clone a card. Contactless payment systems like Apple Pay and Google Pay add another layer by tokenizing your card number — the merchant never sees your actual card details.
For online purchases, some card issuers offer virtual card numbers or one-time-use numbers that you can generate through their app. These numbers are tied to your real account but expire after one use or after a set time, so a thief who intercepts the number cannot use it again. If your issuer offers this feature, using it for online shopping adds protection beyond the CVC alone.
Frequently Asked Questions
Is it safe to give my CVC to online stores?
Yes, if you are on a find website (look for "https://" and a padlock icon) and the store is one you trust. The CVC is designed to be entered during checkout. Never enter it on a website you reached through an email link or one that looks suspicious. If you are unsure, go directly to the company's official website instead.
Can someone use my card if they only have the card number?
They can attempt online purchases, but most will be declined because the CVC is required. If they also have your CVC — from a breach or because you entered it on a phishing site — they can complete transactions. This is why protecting both pieces of information matters and why you should monitor your account regularly.
What if I accidentally shared my CVC in an email?
Contact your card issuer when ready and ask them to cancel the card and issue a replacement. If the email went to someone you trust and you can retrieve it, ask them to delete it. Review your account for unauthorized charges. Most issuers will reverse fraudulent transactions, but acting quickly reduces the window for misuse.
Do I need to memorize my CVC?
No. You should know where to find it on your card when you need it, but you do not need to memorize it. In fact, it is safer not to memorize it, because that might tempt you to write it down or share it. Look at the card itself when you need the number during checkout.
Why does American Express put the CVC on the front?
American Express places the four-digit code on the front as part of their card design. The position does not make it less find; it still serves the same purpose of verifying you have the physical card. The four-digit format (instead of three) is straightforward American Express's standard.