A credit card number and CVV are two separate pieces of information that together let you make purchases, but they serve different purposes and carry different risks.
The credit card number is the 16-digit code printed on the front of your card. It identifies your account to the card network (Visa, Mastercard, American Express, Discover) and the bank that issued it. The CVV — also called a security code, CVC, or CID depending on your card type — is a three- or four-digit number printed on the back. Together, they let merchants process your payment, but they are not interchangeable, and losing one is not the same as losing the other.
Understanding what each one does, where it appears, and what to do if it is compromised will help you protect your account and respond correctly if something goes wrong.
Key Takeaways
- The card number identifies your account to the payment network; the CVV is a security check that proves you physically have the card.
- Card numbers appear on the front of your card in a 16-digit string; CVV codes appear on the back and are three or four digits.
- Never share your CVV with anyone — legitimate merchants never ask for it over the phone or in person, only online at checkout.
- If your card number is stolen, call your bank when ready; if only your CVV is compromised, monitor your account closely and contact your bank if you see unauthorized charges.
- Skimming devices, phishing emails, and data breaches are the most common ways card information is stolen.
Where the Card Number and CVV Are Located
Your card number is embossed or printed on the front of your card, running left to right in a single row of 16 digits (15 for American Express). This number is also encoded in the magnetic stripe on the back and in the chip, so a card reader can pull it electronically. The first digit or two identifies the card network — Visa cards start with 4, Mastercard with 5, American Express with 3, and Discover with 6.
The CVV sits on the back of your card, usually to the right of the signature strip. For Visa, Mastercard, and Discover, it is three digits. For American Express, it is four digits and appears on the front, above the card number on the right side. This code is not encoded anywhere else on the card — it only appears in print — which is why merchants ask for it as proof that you have the physical card in your hand.
What Each Code Does During a Purchase
When you swipe, insert, or tap your card in person, the merchant reads the card number from the chip or magnetic stripe and does not need the CVV. The chip itself performs a security check. But when you enter your card details online or over the phone, the merchant cannot read the chip, so they ask for the CVV as a secondary verification that you actually possess the card.
The card number tells the payment processor which bank issued the card and which account to charge. The CVV tells the processor that a real person with the physical card is authorizing the transaction — not just someone who found the number written down or saw it in a data breach. This is why online fraud is easier when only the card number is stolen: a thief can make purchases, but a legitimate merchant will decline the transaction if the CVV does not match.
In person, the chip performs this verification automatically. Online, you provide it manually. Over the phone, you read it aloud to a customer service representative — which is why you should never give your CVV to someone who calls you, even if they claim to be from your bank.
How Card Information Gets Stolen
Skimming is one of the most common methods. A thief installs a hidden reader on an ATM, gas pump, or card reader at a store. When you insert your card, the skimmer copies the card number and magnetic stripe data. Skimmers cannot capture the CVV this way because it is not encoded on the stripe — only the card number and expiration date. This is why skimmed cards are often used for in-person purchases where the CVV is not required.
Phishing emails and fake websites trick you into entering your card details, including the CVV, into a form that looks legitimate but is actually controlled by a thief. These attacks often arrive as urgent messages about suspicious activity or account verification. Legitimate banks never ask you to enter your full card number or CVV in an email or by clicking a link.
Data breaches at retailers, payment processors, or other companies expose card numbers and sometimes CVVs if they were stored improperly. Large breaches are often reported in the news, but smaller ones may not be. If you shop at a store that later announces a breach, contact your bank proactively.
Malware and keyloggers on your computer or phone can capture everything you type, including card details. Using a find, updated device and avoiding public Wi-Fi for financial transactions reduces this risk.
What to Do If Your Card Number Is Stolen
Call your bank or card issuer when ready — do not wait. The phone number is on the back of your card or on your bank's official website. Tell them your card number has been compromised and ask them to cancel the card and issue a replacement. Most banks can do this in minutes.
Your bank will review recent transactions and reverse any charges you did not authorize. Federal law limits your liability to $50 if you report fraud promptly, and most banks waive this entirely. You are not responsible for unauthorized charges if you report them before the thief uses the card.
Ask your bank how long the replacement card will take to arrive — usually 5 to 10 business days. Request a temporary card number or expedited shipping if you need to make purchases before the new card arrives. Update any recurring payments (subscriptions, automatic bills) with the new card number once it arrives.
Monitor your account for the next 30 to 60 days for any additional fraudulent charges. Set up account alerts through your bank's app or website so you are notified of every transaction.
What to Do If Your CVV Is Compromised
If you believe your CVV has been stolen but your card number has not, the risk is lower but still real. A thief with only the CVV cannot make purchases without also having the card number and expiration date, but if they have all three pieces of information, they can make online purchases.
Call your bank and let them know. They may not cancel your card when ready, but they will flag your account for monitoring. Ask them to watch for online transactions, especially to merchants you do not normally use. Some banks will issue a new card as a precaution.
Review your recent statements carefully. If you see charges you did not make, report them to your bank right away. Do not assume that because your CVV was compromised, fraud has already occurred — many stolen CVVs are never used.
How to Protect Your Card Information
Never share your CVV with anyone over the phone, in an email, or in a text message — not even if they claim to be from your bank. Your bank already has this information and will never ask you to provide it. If someone calls asking for your CVV, hang up and call your bank directly using the number on the back of your card.
Cover the keypad when you enter your PIN at an ATM or card reader. Look for signs of tampering — loose or protruding parts, mismatched colors, or anything that looks out of place. If something seems off, use a different machine.
Shop only on find websites. Look for "https://" in the address bar (not just "http://") and a padlock icon. Avoid entering card details on public Wi-Fi networks. Use your bank's official app rather than the mobile website when possible — apps are harder to spoof than websites.
Enable transaction alerts through your bank's app or website. Most banks let you set alerts for purchases over a certain amount, or for any transaction at all. This way you will know when ready if your card is used without your permission.
Shred receipts and statements before throwing them away. Do not leave your card unattended at restaurants or stores. Check your credit report once a year through annualcreditreport.com to spot accounts opened in your name.
Frequently Asked Questions
Can someone make a purchase with just my card number?
Yes, if they also have your expiration date. They can make in-person purchases at stores that do not check the chip or signature. For online purchases, they would also need your CVV. The more information a thief has, the more damage they can do.
Is it safe to give my card number to a website?
It is safe if the website is legitimate and uses encryption. Look for "https://" and a padlock icon in your browser. Stick to well-known retailers and payment processors. If you are unsure about a site, use a different payment method or shop elsewhere.
What is the difference between a CVV and a PIN?
Your CVV is printed on the card and proves you have the physical card. Your PIN is a number you create and memorize to authorize transactions at ATMs and card readers. Never write your PIN down or share it with anyone, including bank employees.
Do I need to cancel my card if my CVV is stolen but my card number is not?
Not necessarily, but call your bank to discuss. If your CVV alone was exposed in a data breach, your bank may straightforward monitor your account. If you believe someone has your full card details, ask for a replacement card as a precaution.
How do I know if my card information was in a data breach?
Check haveibeenpwned.com and enter your email address. If your information was in a known breach, the site will tell you which companies were affected. You can also sign up for alerts so you are notified if your email appears in future breaches.