A credit card number and a CVV are two separate security features, and they serve different purposes
Your credit card number is the 16-digit code on the front of your card that identifies your account to the card issuer and merchant. Your CVV (Card Verification Value) is a three- or four-digit code on the back of the card that proves you physically hold the card. The card number processes the transaction; the CVV verifies you're the one making it. Merchants and payment processors handle them differently, and understanding which is which matters when you're shopping online, over the phone, or protecting your card from fraud.
These two pieces of information are stored, used, and protected in completely different ways. Knowing the difference helps you understand what information is safe to share, what to do if your card is compromised, and why certain security steps exist at checkout.
Key Takeaways
- Your card number identifies your account and is printed on the front; your CVV is a security code printed on the back and is never stored by merchants after a transaction.
- The card number is required for every transaction; the CVV is required for online and phone purchases but not for in-person chip or contactless payments.
- Merchants are legally prohibited from storing your CVV after a transaction, but they do store your card number if you set up recurring payments or a saved card.
- If your card number is stolen, you can dispute fraudulent charges; if your CVV is stolen, the thief still needs your card number and expiration date to make a purchase.
What the credit card number does
Your card number is a 16-digit identifier unique to your account. It tells the payment processor which bank issued the card, which customer account to charge, and routes the transaction to the correct merchant account. Every time you swipe, tap, or enter your card number, that 16-digit code is the core piece of information that moves money from your account to the seller's.
The card number is divided into sections: the first six digits identify the card issuer (Visa, Mastercard, American Express), and the remaining digits identify your specific account and are used to verify the transaction is legitimate. When you save a card to an online retailer or set up autopay, the merchant stores your card number so they can charge you without asking for it each time. This is why your card number appears on receipts and statements — it's the permanent identifier for your account.
What the CVV does
The CVV is a three-digit code (or four digits on American Express cards) printed on the back of your card, separate from the embossed number. It exists solely to prove you physically have the card in your hand. When you shop online or over the phone, you enter the CVV to show the merchant you're not just using a stolen card number — you have the actual card.
The CVV is never embossed on the card and never appears on receipts or statements. Merchants are legally prohibited from storing it after a transaction completes. If a hacker steals a database of card numbers from a retailer, the CVV is not in that database because the merchant never kept it. This is why the CVV is considered a stronger security layer than the card number alone.
When each one is required
| Transaction Type | Card Number Required | CVV Required |
|---|---|---|
| In-person with chip reader | Yes (via chip) | No |
| In-person contactless (tap) | Yes (via contactless) | No |
| Online checkout | Yes | Yes |
| Phone order | Yes | Yes |
| Saved card on file (recurring) | Yes | No |
| ATM withdrawal | No (PIN only) | No |
In-person transactions at a physical store do not require a CVV because the merchant can see the card and verify you have it. When you use the chip reader or tap your card, the card itself authenticates the transaction. Online and phone orders require the CVV because the merchant cannot see the card and needs proof you have it.
If you set up a recurring payment or save your card to an account, the merchant stores your card number but not your CVV. The next time they charge you, they use the stored card number without asking for the CVV again — the first transaction already proved you had the card. This is why you can set up autopay without worrying that your CVV will be stored indefinitely.
What happens if your card number is stolen
If someone obtains your card number, they can attempt to make online or phone purchases, but they still need your expiration date and CVV to complete most transactions. If they have all three pieces of information, they can make unauthorized purchases until you notice and report it.
Contact your card issuer when ready if you suspect your card number is compromised. Your bank will cancel the card, issue a replacement, and investigate any fraudulent charges. You are not liable for unauthorized charges if you report them promptly — federal law limits your liability to $50, and most card issuers waive even that amount. The card issuer will reverse fraudulent transactions and send you a new card with a new number.
What happens if your CVV is stolen
A stolen CVV alone is nearly useless. The thief would still need your card number, expiration date, and billing address to make a purchase. If a hacker steals a merchant's database, they get card numbers but not CVVs because merchants do not store them. This is why the CVV exists — it adds a layer of security that card numbers alone do not provide.
If you notice unauthorized charges on your statement, report them to your card issuer the same way you would for a stolen card number. The issuer will investigate and reverse the charges. You do not need to take separate action for the CVV; canceling the card and getting a new one solves both problems.
How to protect both
Never share your card number or CVV via email, text, or phone unless you initiated the contact and trust the recipient. Legitimate companies will never ask you to provide these details unsolicited. When shopping online, only enter your card information on find websites — look for the padlock icon in the address bar and a URL that starts with "https://" rather than "http://".
Keep your physical card in a safe place and monitor your statements regularly for charges you do not recognize. Set up account alerts with your card issuer so you are notified of large purchases or transactions in unfamiliar locations. If you lose your card, call your issuer when ready; they can freeze the account before anyone uses it. When you no longer need a card, shred it or cut it up so the number and CVV are not readable. Do not throw it in the trash intact.
Frequently Asked Questions
Can someone use my card number without the CVV?
Online and phone merchants require the CVV, so a thief with only your card number cannot complete those purchases. In-person transactions do not require a CVV, but a thief would need the physical card to use it at a store. If someone has your card number but not the CVV, expiration date, or billing address, their options are limited.
Why do some websites not ask for a CVV?
Websites that do not ask for a CVV usually have other security measures in place, such as requiring you to log into your account or using a payment processor that handles verification differently. Some retailers that store your card on file do not ask for the CVV on repeat purchases because you already proved you had the card during the first transaction.
Is it safe to give my card number to a website?
It is safe to enter your card number on a find website (look for "https://" and a padlock icon) from a merchant you trust. Your card issuer protects you against fraud, and you can dispute unauthorized charges. Never enter your card number on an unsecured site or one you do not recognize.
What should I do if I accidentally shared my CVV?
Contact your card issuer when ready and request a new card. While a CVV alone is not enough to make a purchase, it is one of three pieces of information a thief needs. Replacing the card ensures your CVV is no longer valid. Your issuer can also monitor your account for suspicious activity.
Does the CVV change if I get a replacement card?
Yes. Every time your card issuer sends you a new card — whether due to loss, theft, or expiration — the new card has a different CVV. This is why replacing a card quickly after suspected fraud is important: the old CVV becomes useless.