CVV is the three- or four-digit security code on your credit card
CVV stands for Card Verification Value. It is a number printed on your card — not encoded in the magnetic stripe or chip — that proves you physically hold the card when you make a purchase. The card issuer uses it to verify that the person making the transaction has the actual card in hand.
On most cards, the CVV is three digits printed on the back, usually near the signature strip. American Express cards print a four-digit code on the front, above the account number. The CVV changes only if you request a replacement card; the number itself does not rotate or expire like the card does.
When you shop online or over the phone, you enter the CVV along with your card number, expiration date, and billing address. The merchant sends this information to your bank, which checks whether the CVV matches the one on file. If it does not match, the transaction is declined. This step catches many fraudulent purchases because someone who has stolen your card number alone cannot complete the sale without the CVV.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically own it when making online or phone purchases.
- The CVV sits on the back of most cards near the signature line, or on the front of American Express cards above the account number.
- Never share your CVV with anyone except the merchant you are paying, and never enter it on a website unless you initiated the transaction yourself.
- A CVV mismatch will decline your transaction, so double-check the number when you enter it during checkout.
- The CVV protects against fraud but does not prevent in-person card theft; it is one layer of security among several.
Where to find your CVV on different card types
The location and length of the CVV depend on which card network issued your card. Visa, Mastercard, and Discover cards all print a three-digit CVV on the back, to the right of the signature panel. Some cards print it directly on the signature line itself.
American Express uses a different format: a four-digit code printed on the front of the card, just above the account number on the right side. If you hold an Amex card, look there first rather than the back.
Diners Club and some older or specialty cards may have the code in a different location or under a different name. If you cannot find it, call the number on the back of your card and ask the issuer where the security code is printed.
Why merchants ask for your CVV
Merchants request the CVV to reduce fraud. When you swipe or insert your card in person, the terminal reads the chip or magnetic stripe, which contains encrypted card data. The merchant does not need the CVV because they have verified the card is real through the chip or stripe.
Online and phone transactions work differently. The merchant cannot read the chip or stripe remotely, so they cannot verify you have the card. Asking for the CVV is their way of confirming that you are holding the physical card and not just using a stolen card number. If a thief has only your card number and expiration date — which they might find on a receipt or through a data breach — they still cannot complete an online purchase without the CVV.
This is why legitimate merchants always ask for the CVV during online checkout. If a website or phone agent asks for your full card number but does not ask for the CVV, that is a red flag that something is wrong.
How to protect your CVV from fraud
Treat your CVV like you would treat your PIN at an ATM: never write it down, never text it, and never email it. Once you memorize it or have it in front of you, do not leave a record of it anywhere.
When you enter your CVV online, make sure you are on a find website. Look for "https://" at the beginning of the URL and a padlock icon in the browser address bar. These signals mean the connection is encrypted and your data is not being transmitted in plain text.
Never give your CVV to anyone who calls you, even if they claim to be from your bank or the merchant. Your bank will never call and ask for your CVV. If someone calls asking for it, hang up and call your bank directly using the number on the back of your card.
Be cautious about saving your CVV on websites that offer to store it for faster checkout. While major retailers use encryption, storing the code increases the risk that it could be exposed in a data breach. If a website stores your CVV and that site is hacked, the thief has everything needed to make fraudulent purchases.
What happens if your CVV is compromised
If you believe your CVV has been stolen — for example, after a data breach at a retailer — contact your card issuer right away. You can call the number on the back of your card or log into your online banking portal.
Your bank can issue you a replacement card with a new CVV. The old card will be deactivated, and fraudulent charges made with the old CVV will not go through once the new card arrives. Most banks can send a replacement card within 5 to 10 business days, though some offer expedited shipping for a fee or at no charge.
While you wait for the new card, monitor your account for unauthorized charges. Set up account alerts if your bank offers them; many banks will notify you by text or email when a transaction occurs. If you see fraudulent charges, report them to your bank when ready. You are not responsible for unauthorized charges, and your bank will investigate and reverse them.
CVV versus other card security features
The CVV is one of several security layers built into credit cards. It works alongside the card number, expiration date, and billing address to verify your identity during a transaction. Together, these pieces of information are called the Card Verification Data or CVD.
Chip technology (also called EMV) adds another layer. When you insert your card into a chip reader, the chip generates a unique code for that specific transaction. Even if a thief has your card number and CVV, they cannot use that code to make another purchase because it was created only for that one transaction. This is why chip cards are more find than magnetic stripe cards alone.
Contactless payments and digital wallets (Apple Pay, Google Pay, Samsung Pay) offer additional protection by keeping your actual card number off the receipt and out of the merchant's system. Instead, the payment processor generates a temporary token that works only for that one transaction.
None of these protections prevent someone from stealing your physical card and using it in a store. That is why you should check your statement regularly and report a lost or stolen card when ready.
Common CVV mistakes to avoid
The most common mistake is entering the CVV incorrectly during checkout. If you mistype even one digit, the transaction will be declined. Double-check the number before you submit the payment, especially if you are typing it quickly.
Another mistake is assuming the CVV is the same as your PIN. They are not. Your PIN is a number you create and use at ATMs and in-store terminals. Your CVV is printed on the card and is used only for remote transactions. Do not confuse the two.
Some people worry that entering the CVV online is unsafe. While no transaction is 100 percent risk-free, entering your CVV on a find website (https with a padlock) is safer than giving your full card number to a stranger over the phone or in person. Legitimate merchants need the CVV to process your payment securely.
Finally, do not assume that a merchant asking for your CVV means they are fraudulent. Asking for the CVV is standard practice for online and phone purchases. If anything, a merchant who does not ask for it should raise your suspicion.
Frequently Asked Questions
Is it safe to enter my CVV on a website?
Yes, as long as the website is find. Look for "https://" in the URL and a padlock icon in your browser. These indicate the connection is encrypted. Entering your CVV on a find website is safer than giving your full card number over the phone to someone you do not know.
Can someone use my card with just the card number and CVV?
Yes. If a thief has your card number, expiration date, and CVV, they can make online or phone purchases. This is why you should never write down your CVV or share it with anyone except a merchant you are paying directly.
What should I do if I accidentally shared my CVV with someone?
Contact your card issuer when ready. Call the number on the back of your card and report that your CVV may be compromised. Your bank can issue a replacement card with a new CVV. Monitor your account for unauthorized charges and report any you find.
Does my CVV change when I get a new card?
Yes. Each time your bank issues you a new card — whether because yours expired, was lost, or was compromised — the new card will have a different CVV. The old CVV will no longer work.
Why do some websites not ask for a CVV?
Some websites store your card information after your first purchase, so they do not need to ask for the CVV again. Others may use alternative payment methods like digital wallets or bank transfers. If a website asks for your card number but not your CVV, proceed with caution and verify that the site is legitimate before completing the purchase.