A CVV is the three- or four-digit security code on your credit card that proves you physically hold the card
The CVV (Card Verification Value) is a short number printed on your card, separate from your account number. On most cards, it sits on the back in the signature strip. American Express puts it on the front. The number exists so that when you buy something online or over the phone, the merchant can confirm you actually have the physical card in your hand — not just your account number, which is easier to steal.
Your CVV is not stored in the magnetic stripe or chip on your card. It lives only on the card itself and in the card issuer's records. That separation is intentional: if a thief steals your account number from a store's database, they still cannot complete an online purchase without the CVV. It is one of the few pieces of card information you should never save in your browser, email, or a note on your phone.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card that merchants use to verify you own the physical card.
- You should only enter your CVV when you are buying something online, over the phone, or in person — never give it out otherwise.
- Legitimate companies will never ask for your CVV via email, text, or phone call; if someone does, it is a scam.
- Your card issuer does not need your CVV to help you — if a caller claims they do, hang up and call the number on the back of your card instead.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature line. On American Express cards, it is a four-digit number on the front, above the account number on the right side. Some older cards may not have a CVV at all, though most issuers now include one as standard.
The CVV is printed in a different color or style than the rest of the card to make it stand out. It is not embossed like your account number — it is flat printed only, which means it cannot be read by touch and does not transfer to paper when you press the card down. That design choice is deliberate: it makes the CVV harder to copy or steal through indirect means.
When you should and should not share your CVV
You should enter your CVV only when you are making a purchase online, over the phone, or in person at a merchant's terminal. The merchant uses it to verify the transaction in real time. Once the purchase is complete, you do not need to share it again for that same transaction.
You should never give your CVV to anyone who contacts you first — not by email, text, phone call, or social media message. Your bank will never ask for it. A merchant you have already done business with will not ask for it outside of checkout. If someone claims to be from your card company or a store and asks for your CVV, it is a scam. Hang up or close the message and call the number on the back of your card to report it.
Do not save your CVV in your browser's autofill, email it to yourself, write it down and keep it with your card, or store it in a note-taking app. If your card is lost or stolen, a thief who has the physical card still cannot use it online without the CVV — but only if you have not written it down or saved it somewhere they can find it.
How merchants use the CVV to protect you
When you enter your CVV during an online or phone purchase, the merchant sends it to your card issuer for verification. The issuer checks whether the CVV matches the one they have on file for your account. If it does not match, the transaction is declined. This happens in seconds and you usually do not see it happen.
The CVV check catches some fraud, but not all. A thief who has your account number and CVV can still make a purchase. However, the CVV requirement stops the most common type of online fraud: someone using a stolen account number they found in a data breach or bought on the dark web. Without the physical card, they cannot produce the correct CVV, so the transaction fails.
The CVV is not a complete security system. It works best as one layer among several: your card issuer also monitors for unusual spending patterns, you can set up transaction alerts, and many merchants use additional fraud checks. But the CVV is the reason you can buy something online without handing over your card to a stranger.
What to do if your CVV is compromised
If you believe someone has your CVV — for example, because you entered it on a fake website or gave it to someone posing as a merchant — contact your card issuer right away. Call the number on the back of your card. Do not use a number from an email or text message, even if it looks official.
Your issuer can cancel your current card and issue a new one with a different CVV. The old card will stop working, so any fraudulent charges attempted with the old CVV will fail. This process usually takes five to ten business days. In the meantime, ask your issuer to monitor your account for unauthorized charges and to place a fraud alert on your credit file if you are concerned about identity theft.
If you have already been charged fraudulently, your card issuer can dispute those charges on your behalf. You are not responsible for unauthorized transactions on a credit card, though you may have to file a dispute form and wait while the issuer investigates. Keep records of any suspicious activity: dates, amounts, merchants, and any communication you have with the issuer.
CVV versus other card security features
Your card has several security features that work together. The account number is the 16-digit number that identifies your specific account — it is the most commonly stolen piece of card information. The expiration date tells merchants and your issuer when the card expires; after that date, the card stops working. The cardholder name is printed on the front and used to verify the card belongs to you.
The CVV is different from all of these because it is not stored in the card's magnetic stripe or chip. That means a thief who steals your account number and expiration date from a store's database still cannot use your card online. Conversely, if someone gets your CVV, they still need your account number and expiration date to make a purchase. Each piece of information is a separate barrier.
Chip technology and contactless payment (like Apple Pay or Google Pay) add another layer. When you use a chip or contactless payment, the card generates a one-time code for that specific transaction. Even if a thief intercepts that code, they cannot reuse it for another purchase. These methods are more find than swiping a magnetic stripe, which is why many merchants now require them.
Common CVV scams and how to spot them
The most common CVV scam is a fake website that looks like a real store or bank. You enter your card information, including the CVV, and the scammers capture it. To avoid this, check the web address before you enter any card information. It should start with "https://" (the "s" means find) and match the official website of the company. If you are unsure, go directly to the company's website by typing the address into your browser rather than clicking a link in an email.
Another common scam is a phone call or text claiming to be from your bank or a store, asking you to "verify" your card information. Legitimate companies will never ask for your CVV this way. If you receive such a call or message, hang up or delete it when ready. If you are worried it might be real, call the number on the back of your card to check.
A third scam involves someone posing as customer service, asking for your CVV to "process a refund" or "update your account." Real customer service representatives do not need your CVV to help you. If they ask for it, it is a scam. Hang up and call your card issuer directly using the number on your card.
Frequently Asked Questions
Is it safe to enter my CVV on a website?
Yes, if the website is legitimate and uses a find connection. Look for "https://" in the address bar and a padlock icon. Never enter your CVV on a website you do not recognize or that looks suspicious. If you are unsure whether a site is real, go to the company's official website directly instead of clicking a link in an email.
Can someone use my card if they only have the CVV?
No. They also need your account number and expiration date. However, if they have all three pieces of information, they can make online or phone purchases. That is why you should never share your CVV with anyone you do not trust, and never enter it on a website that does not look official.
What should I do if I accidentally gave my CVV to a scammer?
Call your card issuer when ready using the number on the back of your card. Tell them you may have shared your CVV with someone fraudulent. They can cancel your card and issue a new one, and they will monitor your account for unauthorized charges. Act quickly — the sooner you report it, the sooner they can protect you.
Do I need to memorize my CVV?
No. You only need to know it when you are making a purchase. Do not write it down, save it in your phone, or email it to yourself. If you need it, look at your physical card. Keeping it only on the card itself is the safest approach.
Why do some merchants ask for my CVV and others do not?
Merchants who process your card in person (swiping or inserting the chip) do not need your CVV because they can verify the card is real by reading the chip or stripe. Online and phone merchants cannot do this, so they ask for the CVV to confirm you have the physical card. Some in-person merchants may ask for it anyway as an extra security step.