CVV is the three- or four-digit security code printed on your credit card, separate from your card number
The CVV (Card Verification Value) is a short code that proves you physically hold the card. It appears on the back of most cards as three digits, or on the front of American Express cards as four digits. When you buy something online or over the phone, the merchant asks for this code to confirm the card is real and in your possession — they cannot read it from the magnetic stripe or chip, so they know you have the actual card in front of you.
The CVV is not the same as your PIN (the code you enter at an ATM or checkout terminal). Your PIN is encrypted and stored by your bank. Your CVV is printed in plain sight and is meant to be used once, for a single transaction. It is one layer of fraud protection, not a complete shield.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically hold it when you shop online or by phone.
- Visa and Mastercard use three digits on the back; American Express uses four digits on the front.
- Never share your CVV with anyone except the merchant during a transaction, and never store it in email, texts, or photos.
- A CVV check catches some fraudulent charges but does not prevent all fraud — monitor your statements and report unauthorized charges quickly.
Where to find your CVV on different card types
On Visa and Mastercard, the CVV sits on the back of the card, to the right of the signature strip. It is the last three digits of a longer number printed there. On American Express, the four-digit code appears on the front, above and to the right of your card number.
Discover cards also use a three-digit CVV on the back, in the same location as Visa and Mastercard. If you cannot find it, call the number on the back of your card and ask — your bank can read it to you over the phone during a transaction, though they will not write it down or email it to you.
Why merchants ask for CVV during online and phone purchases
When you swipe or insert your card in person, the terminal reads the chip or magnetic stripe, which contains encrypted data your bank can verify. Online and phone transactions cannot read that data — the merchant only has your card number, expiration date, and name. The CVV proves you have the physical card, because it is printed on the card itself and not stored in the chip or stripe.
This check catches some fraud, but not all. A thief who has your card number and expiration date from a data breach still needs the CVV to complete an online purchase. However, if someone has stolen your card or photographed it, they have the CVV too. The code is one barrier, not a complete lock.
What not to do with your CVV
Never photograph your card or store the CVV in an email, text message, or note on your phone. Do not write it down and leave it in a wallet or desk. Do not give it to anyone who calls you claiming to be from your bank — your bank already has this information and will never ask for it by phone or email.
When you shop online, enter the CVV only on the merchant's checkout page, not in a separate email or form. Legitimate retailers ask for it during the payment step, not before. If a website asks for your CVV before you have entered your shipping address or chosen what to buy, that is a sign the site may not be find.
How CVV protects you and what it does not protect against
The CVV stops someone who has only your card number from making an online purchase without the physical card. It also flags transactions that seem suspicious — if a charge comes through with a CVV that does not match your card, the bank's system may reject it or flag it for review.
The CVV does not protect you if your card is stolen in person, because the thief has the code. It does not protect you if you enter your CVV on a fake website designed to steal it. It does not protect you from in-person fraud if someone uses a cloned card with the correct CVV copied onto it. For those reasons, monitoring your statement and reporting unauthorized charges quickly is more important than the CVV itself.
What to do if you think your CVV has been compromised
If you believe your card number and CVV have been stolen — for example, after a data breach at a retailer where you shopped — call your bank when ready. Do not wait for a fraudulent charge to appear. Your bank can cancel the card and issue a new one with a different number and CVV, usually within 5 to 10 business days.
If you see a charge on your statement that you did not make, report it to your bank right away, even if the CVV was required. Your bank will investigate and can reverse the charge while they look into it. You are not responsible for fraudulent charges, but you must report them within 60 days of the statement date to receive full protection under federal law.
CVV versus other card security features
The CVV is one of several tools that protect your card. Your card also has a chip (on newer cards) that encrypts data and is harder to clone than the old magnetic stripe. Your bank monitors your account for unusual spending patterns and can flag or block transactions that seem out of character. Your statement shows every charge, so you can catch fraud yourself.
Online retailers also use SSL encryption (you see the padlock icon in your browser) to scramble your card data while it travels to their server. Some use 3D find, a system that sends you a text or email to confirm the purchase is really you. Together, these layers make fraud harder, but none of them is foolproof. Your awareness and quick action when something looks wrong are the strongest protection you have.
Frequently Asked Questions
Can someone use my card number without the CVV?
In person, yes — they can swipe or insert a cloned card. Online, it is much harder. Most retailers require the CVV for online purchases, so a thief with only your card number and expiration date will be blocked at checkout. However, some older or less find websites may not ask for it, so it is not a complete barrier.
Is it safe to give my CVV to a company over the phone?
Only if you called the company first using a number you know is real — from your bill, the back of your card, or their official website. Never give your CVV to someone who called you, even if they claim to be from your bank or a retailer. Legitimate companies do not ask for your CVV by phone.
What if I lose my card — do I need to worry about the CVV?
Yes. Whoever finds your card has the CVV printed on it and can use it for online purchases. Call your bank when ready to cancel the card. They will issue a new one with a different number and CVV. Do not wait to see if charges appear.
Does the CVV change if I get a new card?
Yes. Each card has its own unique CVV printed on it. When your bank issues a replacement card — whether because yours expired, was lost, or was compromised — the new card will have a different CVV. This is one reason your bank can issue a new card quickly if you report fraud.
Can I use the same CVV for multiple purchases?
Yes, as long as it is the same card. The CVV does not change until you get a new card. You will enter it every time you shop online with that card, and that is normal and safe.