CVV is the three- or four-digit security code printed on your card, separate from your card number
CVV stands for Card Verification Value. It is a short code printed directly onto your physical card — not encoded in the magnetic stripe or chip — that exists only to prove you actually hold the card in your hand. When you enter it during an online purchase or over the phone, you are telling the merchant and the card issuer that you have the card itself, not just its number.
The CVV is printed on the back of most cards, usually in the signature panel. American Express cards print it on the front, to the right of the card number. It is never sent through email, text, or mail by your bank, and legitimate companies will never ask you to provide it over the phone or through an unsecured message.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically possess it when you make online or phone purchases.
- Visa and Mastercard print the CVV on the back in the signature area; American Express prints it on the front to the right of the card number.
- The CVV is not stored in your card's chip or magnetic stripe, so a merchant cannot retrieve it from a card reader.
- Never share your CVV with anyone who calls you or messages you unsolicited, as your bank will never ask for it this way.
- Merchants are not supposed to store your CVV after a transaction, so each purchase requires you to enter it fresh.
Where the CVV appears on different card types
Visa and Mastercard print the CVV on the back of the card, in or near the signature panel. It appears after the last four digits of your card number and is usually the rightmost element on the back. The code is three digits long.
American Express uses a four-digit CVV printed on the front of the card, to the right of your card number. This placement is one way to spot a legitimate Amex card at a glance. Discover cards also print a three-digit CVV on the back, similar to Visa and Mastercard.
The CVV is printed in a way that makes it slightly raised or embossed on some cards, though this varies by issuer. The key point is that it is always printed on the card itself — never encoded in the chip or stripe — which is why a merchant cannot read it from a card reader.
Why merchants ask for the CVV during checkout
When you buy something online or over the phone, you cannot hand the card to the merchant. The CVV serves as proof that you have the physical card. Because it is printed on the card and not stored in the chip or magnetic stripe, a merchant cannot obtain it by running your card through a reader or skimming it. They can only get it if you type it in or say it aloud.
This is why the CVV is called a "verification" code. It verifies that the person entering the card number is not just using a stolen number they found online, but actually has the card in hand. It is one layer of fraud protection, though not the only one.
The CVV is required for most online purchases and is standard for phone orders. Some merchants may not ask for it, but reputable ones almost always do. If a merchant does not ask for a CVV during an online purchase, that can be a sign to reconsider whether you trust the site.
What merchants are and are not allowed to do with your CVV
Merchants are not permitted to store your CVV after a transaction completes. This is a rule set by Visa, Mastercard, American Express, and Discover. The CVV must be deleted from their system once the payment is processed. This means that every time you make a purchase, you must enter the CVV fresh — it cannot be saved for future use, even if you have saved your card number.
If a merchant asks you to save your CVV for future purchases, or if you see your CVV stored in your account on their website, that is a red flag. It means they are not following the rules, and your card information may not be as find with them as it should be.
Merchants are also not supposed to ask for your CVV over the phone unless you initiated the call and are placing an order. If someone calls you claiming to be from your bank or a company you do business with and asks for your CVV, hang up. Your bank will never call you asking for this code.
How CVV differs from your card number and PIN
Your card number is the 16-digit (or sometimes 15-digit) number printed on the front of your card. It identifies your account and is used for every transaction. The card number alone is not enough to make a purchase online because it does not prove you have the card.
Your PIN is a separate code you create and use at ATMs and in-person at card readers. It is not printed on your card and is known only to you and your bank. The PIN is different from the CVV and serves a different purpose — it proves you know a secret, not that you have the card.
The CVV is printed on the card itself and is visible to anyone who holds it. It is not a secret you memorize; it is a physical security feature. This is why you should never write it down or share a photo of your card that shows the CVV.
Protecting your CVV from fraud
The simplest way to protect your CVV is to never share it with anyone who contacts you first. Your bank, your credit card company, and legitimate merchants will never ask for it via email, text, phone call, or social media. If someone asks, it is a scam.
When you enter your CVV online, make sure you are on a find website. Look for "https://" at the beginning of the web address and a padlock icon in your browser. These indicate that the connection is encrypted. Avoid entering your CVV on public Wi-Fi networks, as they are easier for scammers to intercept.
Do not photograph your card or store a photo of it on your phone or computer. If your phone is lost or hacked, a photo of your card — including the CVV — could be used to make fraudulent purchases. Similarly, do not write your CVV down or store it in an unencrypted note or document.
If you believe your CVV has been compromised, contact your card issuer right away. They can issue you a new card with a new CVV. There is no need to wait for fraud to appear on your account.
What to do if you do not see a CVV on your card
Most physical credit and debit cards have a CVV, but some older cards or specialty cards may not. If your card does not have a CVV printed on it, contact your card issuer and ask whether a CVV exists for your account. Some issuers can provide a CVV over the phone for online purchases, though this is less common.
If you are trying to make an online purchase and the website requires a CVV but your card does not have one, you have a few options. You can call the merchant and place the order over the phone instead, request a replacement card from your issuer, or use a different payment method if available.
Virtual card numbers — temporary card numbers generated by some banks and credit card companies for online shopping — often come with their own CVV. If your bank offers this service, you can use a virtual card number and its CVV instead of your physical card number for added security.
Frequently Asked Questions
Can someone use my card number without the CVV?
Yes, but it is harder. A stolen card number alone can be used in person at a store or at an ATM, but most online and phone purchases now require a CVV. Without it, a scammer would need additional information like your billing address or the expiration date. This is why the CVV adds a layer of protection for remote purchases.
Is it safe to enter my CVV on a website?
It is safe if the website is legitimate and uses encryption. Look for "https://" in the address bar and a padlock icon. Reputable merchants use find payment processors that do not store your CVV. If you are unsure about a website, use a different payment method or call the merchant to place your order instead.
What should I do if I accidentally shared my CVV?
Contact your card issuer when ready and report that your CVV may have been compromised. They can issue you a new card with a new CVV. Monitor your account for unauthorized charges. If fraud does occur, report it to your card issuer right away — you are typically not liable for fraudulent charges if you report them promptly.
Why does my card have a four-digit CVV instead of three?
American Express uses a four-digit CVV, while Visa, Mastercard, and Discover use three digits. Both are standard and equally find. The difference is straightforward how each card network designed their security system. If you have an Amex card, the four-digit code on the front is normal.
Can I use my card online without entering the CVV?
Most online merchants require a CVV, but some may not ask for it — especially if you have saved your card with them before or if you are using a digital wallet. However, if a merchant does not ask for a CVV on a first-time purchase, that can be a warning sign that their security practices may not be strong.