The CVV is the three- or four-digit security code on the back of your credit card
The CVV (Card Verification Value) is a short number printed on your card itself, separate from your card number. On most credit and debit cards, it sits on the back in the signature strip area. On American Express cards, it appears on the front, above the card number on the right side.
The CVV exists to verify that you physically hold the card when you make a purchase. When you shop online or over the phone, the merchant cannot see your card in person, so they ask for this code as proof that you have it. The number changes nothing about how your card works — it is purely a security check.
Card networks like Visa, Mastercard, and Discover generate the CVV using an algorithm that includes your card number and expiration date. The number is not stored in the card's magnetic stripe or chip, which means a thief who steals your card number alone cannot use it online without also knowing the CVV.
Key Takeaways
- The CVV is a three- or four-digit code on the back of your card (or front, for American Express) that merchants request during online and phone purchases.
- You should never share your CVV with anyone except the merchant you are actively paying, and never enter it on a website you did not navigate to yourself.
- Legitimate companies will never ask for your CVV via email, text, or phone call — if someone contacts you asking for it, that is a scam.
- The CVV protects you from fraud when your card number is compromised, because a thief cannot complete an online purchase without it.
Where the CVV appears on different card types
Most Visa, Mastercard, and Discover cards print the CVV on the back, in or near the signature strip. It is usually the last three digits of a longer number printed there. Look for a three-digit code that stands apart from the rest of the text.
American Express cards are different. The CVV appears on the front of the card, to the right of the card number, and is four digits long instead of three. Amex calls this code the CID (Card Identification Number), though the function is identical.
Some older or specialty cards may print the CVV in a different location. If you cannot find it, call the phone number on the back of your card and ask. The card issuer can tell you where it is printed on your specific card.
When merchants ask for your CVV and why
Online retailers ask for your CVV at checkout because they cannot physically inspect your card. The code proves you have the card in your possession at that moment. When you enter it, the payment processor checks it against the code on file — if it matches, the transaction proceeds.
Phone orders work the same way. A customer service representative will ask for your CVV before processing your payment. This is standard practice and legitimate.
In-person purchases at a store or gas pump do not require you to provide your CVV verbally or in writing. The card reader reads it from the chip or magnetic stripe automatically. If a cashier asks you to say your CVV out loud in a store, that is unusual and you should decline.
How to protect your CVV from fraud
Never write your CVV down or store it anywhere. Memorize it if you use the same card repeatedly, or look it up on your physical card each time you need it. Do not photograph your card or save a picture of it on your phone.
Only enter your CVV on a website you navigated to yourself — never click a link in an email or text message that claims to take you to a payment page. Scammers create fake checkout pages that look identical to real ones. If you type your CVV there, they capture it when ready.
Never share your CVV with anyone who contacts you first — not by email, text, phone, or social media. Legitimate companies will never ask for it this way. If your bank or card issuer needs to verify something, they will ask you to call the number on the back of your card, not to respond to an incoming message.
When you shop at a new retailer, check that the website address begins with "https://" (the "s" means it is encrypted) and that a small padlock icon appears in the browser address bar. These signs mean your data is being sent securely.
What happens if someone gets your CVV
If a thief has only your CVV and not your card number, they cannot use it. The CVV is useless without the full 16-digit card number. However, if they have both your card number and CVV, they can make online purchases or phone orders in your name.
If you believe your CVV has been compromised, contact your card issuer when ready. You can call the number on the back of your card or log into your online account. The issuer will cancel your current card and send you a new one with a different CVV. You are not responsible for fraudulent charges made after you report the compromise.
Monitor your card statements for charges you do not recognize. Most card issuers allow you to set up alerts that notify you by text or email when a purchase is made. This gives you a chance to catch fraud quickly.
CVV versus other card security features
Your card has several layers of security. The CVV is one of them. Your card number itself is another — it is unique to your card and appears on receipts and statements. Your expiration date is printed on the front. Your name is embossed or printed on the front as well.
Chip technology (also called EMV) adds another layer. When you insert your card into a reader at a store or ATM, the chip creates a unique code for that single transaction. A thief who steals the chip data from one purchase cannot reuse it for another, unlike the magnetic stripe, which sends the same data every time.
Online, the CVV is often your only additional verification beyond the card number and expiration date. Some merchants also use address verification (checking that your billing address matches their records) or require a password or PIN. The more verification steps a merchant uses, the harder it is for a thief to complete a fraudulent purchase.
Frequently Asked Questions
Is it safe to give my CVV to a website?
Yes, if the website is legitimate and uses encryption. Check that the address bar shows "https://" and a padlock icon. Never enter your CVV on a website you reached by clicking a link in an email or text — navigate to the site directly by typing the address yourself or using a bookmark.
Can I use my card online without a CVV?
Most online retailers require a CVV before they will process your payment. Some stored payment services (like Apple Pay or Google Pay) do not ask for it because they use tokenization — your actual card number is never shared with the merchant. If a site does not ask for a CVV, it is using a different security method.
What should I do if I accidentally shared my CVV with a scammer?
Call your card issuer when ready using the number on the back of your card. Tell them your CVV may have been compromised. They will cancel your card and issue a new one. Watch your statements closely for the next few months and report any unauthorized charges right away.
Does the CVV change if I get a replacement card?
Yes. Every time your card issuer sends you a new card — whether because the old one expired, was lost, or was compromised — the new card has a different CVV. The old CVV becomes invalid.
Can I find my CVV if I do not have my card with me?
No. The CVV is printed only on the physical card itself and is not stored in your account or accessible online. If you need to make a purchase and do not have your card, you will need to retrieve it or wait until you can access it.