CVV is the three- or four-digit security code on your credit card that proves you physically have the card when you buy something online or over the phone
The CVV (Card Verification Value) is a short number printed on your card, separate from your card number. Visa and Mastercard call it CVV2. American Express calls it CID. It sits on the back of most cards as a three-digit number; American Express puts a four-digit code on the front.
When you enter your card number online or read it over the phone, a merchant has no way to know if you actually own that card or if someone stole the number. The CVV solves that problem. You can only provide it if you have the physical card in your hand. The merchant sends your CVV to the card network (Visa, Mastercard, etc.) in a separate message from your card number. The network checks it against the real code on file and tells the merchant yes or no.
This is why the CVV reduces fraud: a thief who has your card number from a data breach or a skimmed ATM cannot complete an online purchase without also having the card itself. It is also why you should never give your CVV to anyone who calls you claiming to be from your bank — your bank already has it and will never ask for it.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card that proves you physically possess it when you make an online or phone purchase.
- Merchants never store your CVV after a transaction, and the card network checks it separately from your card number to reduce fraud.
- You should never share your CVV with anyone who contacts you, including people claiming to represent your bank or card issuer.
- A CVV mismatch will block a legitimate purchase, so double-check the number when you enter it online.
- Losing your card does not expose your CVV to the same risk as losing your card number, because the CVV is not printed on receipts or stored in most merchant systems.
Where the CVV sits on your card
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number on the back of the card, usually printed to the right of the signature strip. It is the last three digits of a longer number that appears there.
On American Express cards, the CVV is a four-digit number printed on the front, above the card number on the right side. American Express calls this the CID instead of CVV, but it serves the same purpose.
The CVV is never embossed or raised like your card number — it is always printed flat on the surface. This matters because it means the CVV cannot be read by a card reader that swipes or dips your card. It can only be read by someone looking at the card directly or by you typing it in.
How merchants use your CVV
When you enter your card number and CVV online, the merchant's payment processor sends both pieces of information to the card network. The network checks the CVV against the code it has on file for your card. If they match, the transaction moves forward. If they do not match, the transaction is declined.
Critically, the merchant is not supposed to store your CVV after the transaction completes. Payment Card Industry (PCI) rules forbid it. This means that even if a hacker breaks into a merchant's database and steals card numbers, the CVV should not be there. The CVV stays with the card network only, where it is encrypted and protected.
When you use your physical card in a store — swiping, inserting, or tapping it — the CVV is not transmitted at all. The card reader communicates with the network using encrypted chip or wireless data, not the CVV. This is one reason why in-person card fraud is less common than online fraud: the thief would need the physical card and the PIN, not just the number.
Why CVV does not prevent all fraud
The CVV reduces fraud, but it is not a complete shield. A thief who has your card number, expiration date, and name can still make some purchases. Many older websites and phone merchants do not require a CVV. Some merchants accept transactions without checking it. And if a thief has your physical card, they have the CVV too.
The CVV also does not protect you if your card information is compromised at the point of sale — for instance, if a gas pump has a skimming device that reads your card as you swipe it. The skimmer captures your card number and expiration date but usually not the CVV, which is why the CVV still matters. But if a merchant's system is breached and your full card data is stolen, the CVV alone cannot stop someone from using that information elsewhere.
This is why credit card companies offer fraud protection that goes beyond the CVV. If someone uses your card without permission, you can dispute the charge and the card issuer will usually refund it. You are not liable for unauthorized charges on a credit card, though you may have to report the fraud and wait for an investigation.
What to do if your CVV is compromised
If you believe your card number and CVV have both been stolen — for instance, if your physical card was lost or stolen — contact your card issuer when ready. They will cancel the card and send you a new one with a new CVV. The old CVV becomes useless because it is tied to the old card number.
If you entered your CVV on a website you did not recognize or that looked suspicious, call your card issuer and describe what happened. They can monitor your account for fraud and may cancel the card as a precaution. Do not wait to see if fraudulent charges appear.
If you see charges on your statement that you did not make, report them to your card issuer within 60 days. Most card companies have a fraud dispute process that takes a few weeks. You will not be charged for the fraudulent purchase while the investigation is underway.
CVV versus other card security features
The CVV is one layer of fraud prevention, but modern cards have others. Many cards now have a chip (also called an EMV chip) that encrypts your card data when you insert or tap the card in a reader. The chip makes it much harder for a thief to clone your card because the data changes with each transaction.
Some cards also offer virtual card numbers — a temporary number generated for a single online purchase that is tied to your real card number but expires after one use. If a merchant is breached, the virtual number is worthless because it no longer works. American Express, Capital One, and some other issuers offer this feature.
Your card issuer may also use machine learning to flag unusual purchases — a charge in another country, a very large purchase, or a purchase at a merchant where you have never shopped before. These systems catch fraud that the CVV alone would not.
Common CVV mistakes and how to avoid them
The most common mistake is entering your CVV incorrectly. If you mistype it, the transaction will be declined. Double-check the number before you submit your payment, especially if you are reading it from the card while typing.
Another mistake is sharing your CVV with someone who contacts you by phone or email. Your bank will never ask for it. If someone calls claiming to verify your account and asks for your CVV, hang up and call your bank directly using the number on the back of your card. Scammers often pose as bank employees to steal card information.
Do not take a photo of your card that includes the CVV and store it on your phone or email it to yourself. If your phone is lost or hacked, a thief could access that photo. If you need to remember your CVV, memorize it instead.
Frequently Asked Questions
Can someone use my card number without the CVV?
Yes, though it is riskier for the thief. Many older merchants and phone-based businesses do not require a CVV. Some online stores have weak security and do not check it. But most major retailers and payment processors now require the CVV, which is why it reduces fraud significantly.
Is my CVV the same as my PIN?
No. Your PIN is a number you create and enter at an ATM or in-store card reader to prove you own the card. Your CVV is a number printed on the card by the issuer that you use for online and phone purchases. They are separate and serve different purposes.
What if I enter the wrong CVV three times?
Most payment processors will decline your transaction after a few failed attempts. You will need to try again later or contact your card issuer to make sure your account is not locked. This is a security feature to prevent someone from guessing your CVV.
Does the CVV change if I get a new card?
Yes. Every time your card issuer sends you a new card — whether because the old one expired, was lost, or was compromised — the new card has a different CVV. The old CVV no longer works with the new card number.
Can I use my card online if I do not have the physical card?
No, not safely. If you do not have the card in front of you, you cannot see the CVV. Trying to guess or use an old CVV will fail. If your card is lost or stolen, contact your issuer when ready to cancel it and request a replacement.