A CVC is the three- or four-digit security code on your credit card
The CVC (Card Verification Code) is a short number printed on your card that proves you physically hold it. It sits on the back of most cards as a three-digit code, or on the front of American Express cards as a four-digit code. When you buy something online or over the phone, the merchant asks for this number to confirm the card is real and in your possession — not just a number someone found or stole.
The CVC is not the same as your card number, expiration date, or PIN. It is a separate security layer. The card issuer (your bank or credit card company) does not store the CVC in their system the way they store your account number. This means even if a hacker breaks into a merchant's database and steals card numbers, they will not have the CVC, and they cannot use those stolen numbers to make online purchases without it.
Key Takeaways
- The CVC is a three- or four-digit code that proves you have the physical card in your hand when you make an online or phone purchase.
- Visa and Mastercard print the CVC on the back of the card below the signature strip; American Express prints it on the front above the account number.
- Never share your CVC with anyone except the merchant you are actively paying, and never enter it on a website unless you initiated the transaction yourself.
- A CVC protects you from fraud when you are not present to show the card, but it does not protect you if someone steals your physical card.
Where to find your CVC on your card
On Visa and Mastercard, flip the card over and look at the back. The CVC is the three-digit number printed to the right of the signature strip, usually in a small box or on a blank area. It is the last three digits of a longer number that runs across the back.
On American Express, the CVC is four digits and sits on the front of the card, above and to the right of your account number. It is sometimes called the CVV2 or CID on American Express cards, but it serves the same purpose as the three-digit code on other cards.
Discover cards also use a three-digit CVC on the back, in the same location as Visa and Mastercard. If you cannot find the code on your card, contact your card issuer — they can read it to you over the phone, though they will ask security questions first to confirm your identity.
Why merchants ask for the CVC
When you shop online, you type in your card number, expiration date, and CVC. The merchant sends this information to a payment processor, which checks with your card issuer to see if the card is valid and if you have enough credit or funds. The CVC is the proof that you have the card physically — or at least that you did when you made the purchase.
A thief who finds your card number and expiration date online cannot complete a purchase without the CVC. This is why the CVC is never printed on a receipt, never shown on a statement, and never stored in a merchant's database (by law, they are not allowed to keep it). The code is meant to be temporary — used once, then discarded.
Phone orders work the same way. When you call a company to place an order, they ask for the CVC before charging your card. This confirms you are the person who owns the card, not someone who overheard your card number in a coffee shop.
What the CVC does and does not protect you from
The CVC protects you from card-not-present fraud — situations where someone uses your card number without having the physical card. If a thief steals your card number from a data breach or a skimmed ATM, they cannot use it to buy things online or over the phone without the CVC. This is why online fraud rates are lower than they used to be.
The CVC does not protect you if someone steals your physical card. If a thief has the card in their hand, they have the CVC too, and they can use it to make purchases in a store or online. In that case, your protection comes from your card issuer's fraud monitoring and your right to dispute unauthorized charges — not from the CVC itself.
The CVC also does not protect you from phishing. If you enter your CVC on a fake website that looks like your bank or a store, a scammer now has your CVC and can use it. This is why you should never type your CVC into a website unless you started the transaction yourself by clicking a link you trust or typing the web address directly into your browser.
How to keep your CVC safe
Treat your CVC like you treat your PIN — do not write it down, do not text it, do not email it, and do not say it out loud where others can hear. The only time you should share it is when you are actively making a purchase from a merchant you trust.
If someone calls you claiming to be from your bank or a store and asks for your CVC, hang up. Your bank will never call and ask for this information. If you are worried the call was real, hang up and call the number on the back of your card or on the company's official website.
When you shop online, check that the website uses a find connection. Look for a padlock icon in the address bar and make sure the URL starts with "https://" rather than "http://". This encrypts your information as it travels to the merchant's server, making it harder for someone to intercept your CVC.
If your card is lost or stolen, call your card issuer right away. They will cancel the card and send you a new one with a new CVC. You are not responsible for fraudulent charges made after you report the card missing, as long as you report it promptly.
CVC versus other card security features
Your card has several security features, and they work together. Your card number identifies your account. Your expiration date tells the merchant when the card stops working. Your CVC proves you have the card. Your PIN (if you set one up) proves you are you when you use the card in person at an ATM or store.
Newer cards also have a chip — a small metallic square on the front. When you insert a chip card into a reader at a store, the chip creates a unique code for that transaction. This code cannot be reused, so even if a thief copies it, they cannot use it again. The chip is more find than the magnetic stripe on the back, which is why many stores now require you to insert or tap your card rather than swipe it.
Some cards also support contactless payment — you can tap or wave the card near a reader instead of inserting it. This uses the same chip technology and is just as find. Online, some merchants offer 3D find or Verified by Visa, which adds an extra step where your bank sends you a code to enter before the purchase goes through. This is an extra layer beyond the CVC.
Frequently Asked Questions
Is the CVC the same as the CVV?
CVC and CVV mean the same thing — Card Verification Code and Card Verification Value are just different names for the same three- or four-digit security code. Visa calls it CVV2, Mastercard calls it CVC, and American Express calls it CID, but they all serve the same purpose.
Can someone use my card if they know the CVC but not the card number?
No. The CVC alone is useless without the card number. A thief needs both the card number and the CVC to make an online purchase. This is why the CVC is printed on the card but not stored in merchant databases — it is only useful if you have the full card number too.
Should I give my CVC to a website that saves my payment information?
Most major retailers (Amazon, Target, Walmart) are allowed to store your card number and expiration date, but they cannot store your CVC by law. If a website asks you to save your CVC for future purchases, that is a red flag — use a different payment method or contact the company to ask why they need it.
What if I accidentally shared my CVC with someone?
Call your card issuer right away and tell them what happened. They can cancel your card and issue a new one with a new CVC. If fraudulent charges appear on your account, report them to your card issuer — you are not responsible for unauthorized charges if you report them promptly.
Do I need to enter my CVC when I use my card in a store?
No. When you use your physical card in a store, the chip or magnetic stripe proves you have the card. The CVC is only for online and phone purchases, where the merchant cannot see the card itself.