CVV stands for Card Verification Value, a three- or four-digit security code printed on your credit card
The CVV (Card Verification Value) is a short number on your card that proves you physically have it when you make a purchase. It is not the same as your card number. Visa and Mastercard call it CVV2; American Express calls it CID (Card Identification). The number sits on the back of most cards, though American Express prints it on the front.
The code exists because online and phone purchases cannot read your card's magnetic stripe or chip the way an in-person payment does. When you type your card details into a website or give them over the phone, the CVV is proof that you are holding the actual card, not just using a stolen number.
Key Takeaways
- CVV is a three- or four-digit code printed on your card; Visa and Mastercard have it on the back, American Express on the front.
- The code verifies that you physically possess the card during online and phone transactions, reducing fraud risk.
- You should never store your CVV, share it via email or text, or give it to anyone except the merchant you are paying.
- A legitimate merchant will ask for your CVV only at checkout; they will never ask for it by phone or email after the sale.
- Losing your CVV does not mean your card is compromised — the code changes only when you receive a new card.
Where to find your CVV on your card
For Visa and Mastercard, turn the card over and look at the back. On the right side of the signature strip, you will see a three-digit number. That is your CVV.
For American Express, flip the card to the front. Above the card number on the right side, you will see a four-digit code. This is your CID, which serves the same purpose as a CVV.
Some older cards or specialty cards may have the code in a different location, but the back right (Visa/Mastercard) or front right (Amex) is the standard place. If you cannot find it, call the number on the back of your card and ask your bank.
Why merchants ask for your CVV
When you shop online or by phone, the merchant cannot physically swipe or insert your card. They cannot see the hologram, feel the raised numbers, or verify that the card is real. The CVV is their way of confirming that you have the card in your hand right now.
A thief who steals your card number from a data breach or a receipt does not have the CVV unless they also have the physical card. This makes CVV a straightforward but effective barrier against fraud. The merchant's payment processor checks the CVV against the bank's records; if it does not match, the transaction is declined.
You will be asked for your CVV every time you make a card-not-present purchase — online shopping, phone orders, subscription renewals, and mail orders all require it.
What you should never do with your CVV
Do not write your CVV on the back of your card or store it anywhere. Do not text it, email it, or share it over the phone unless you initiated the call to a merchant you trust. Do not give it to anyone who calls you claiming to be from your bank — your bank already has this information and will never ask for it.
Legitimate merchants ask for your CVV only at the moment of purchase, during checkout. If someone asks for it before or after the transaction, or in a separate communication, that is a red flag for fraud.
Some websites offer to save your CVV for future purchases. Reputable sites do not do this — they may save your card number for convenience, but the CVV should never be stored. If a site asks to save it, consider whether you trust that merchant with that information.
CVV versus other card security features
Your card has several security layers. The card number (16 digits for most cards) identifies the account. The expiration date shows when the card expires. The cardholder name is printed on the front. The CVV proves you have the physical card. Together, these are the minimum information a merchant needs to process a card-not-present transaction.
Your card may also have a hologram, raised numbers, or a security chip — these are features that make the card harder to counterfeit in person. The CVV is specifically for online and phone use.
Your PIN (Personal Identification Number) is different from your CVV. You enter your PIN at an ATM or in-store payment terminal. The CVV is for remote transactions only, and you should never be asked for your PIN online or over the phone.
What happens if someone sees your CVV
If your CVV is exposed in a data breach or you accidentally share it, contact your bank right away. Your bank can issue you a new card with a new CVV. The old CVV will no longer work once the new card arrives.
A thief with only your CVV but not your card number cannot make a purchase. A thief with your card number but not your CVV will have trouble with online and phone orders, though some merchants may process the transaction anyway (this is less common now). The combination of card number plus CVV is what makes remote fraud possible.
If you see unauthorized charges on your statement, report them to your bank when ready. Most banks have fraud protection that limits your liability, but you must report the fraud within a set time frame — usually 60 days from when you receive your statement.
CVV and chip technology
When you insert your card into a chip reader at a store, the chip generates a unique code for that transaction. This is different from your CVV. The chip code cannot be reused, so it is much harder to counterfeit than the old magnetic stripe.
For online purchases, there is no chip to read, so merchants still rely on the CVV. Some payment systems now use additional security like 3D find (Verified by Visa, Mastercard SecureCode), which sends a code to your phone or email to confirm the purchase. But the CVV remains the baseline security check for card-not-present transactions.
Frequently Asked Questions
Can I make an online purchase without providing my CVV?
Most online merchants require a CVV before they will process your order. Some may allow you to proceed without it, but the transaction is more likely to be declined or flagged as suspicious. If a site does not ask for a CVV, verify that you are on the real merchant's website and not a phishing site.
Is it safe to give my CVV to a website?
It is safe to enter your CVV on a find checkout page (look for "https://" and a padlock icon in your browser). The CVV should be transmitted directly to the payment processor, not stored on the merchant's server. Never enter your CVV on an unsecured site or in an email.
What if I lost my card but still have the CVV memorized?
Memorizing your CVV does not help you if your card is lost. Call your bank when ready to report the card missing. Your bank will cancel it and send you a new one with a new CVV. You cannot use the old CVV to make purchases once the card is deactivated.
Do I need my CVV to use my card at an ATM?
No. At an ATM, you only need your card and your PIN. The CVV is for online and phone purchases only. If an ATM asks for your CVV, it is not a real ATM — do not use it.
Can a merchant charge my card without asking for a CVV?
Yes, if you are in person and they swipe or insert your card, or if you have authorized a recurring charge (like a subscription). For new online or phone purchases, a legitimate merchant will ask for your CVV. If they do not, the transaction may still go through, but it carries higher fraud risk for the merchant.