The CVV is a three- or four-digit security code printed on your credit card
The CVV code (Card Verification Value) is a short number on your card that proves you physically hold it. When you enter it during an online purchase or phone transaction, the merchant knows you have the actual card in your hand, not just the card number. It is not stored in the magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also knowing this code.
The CVV sits in a different place depending on which card network issued your card. On Visa, Mastercard, and Discover cards, it is a three-digit code on the back, usually printed to the right of the signature panel. On American Express cards, it is a four-digit code printed on the front, above the card number on the right side.
You should never write down your CVV or share it with anyone except during a transaction you initiated yourself. Legitimate merchants and your bank will never ask you to provide it over the phone or email.
Key Takeaways
- The CVV is a three- or four-digit code that proves you have the physical card when you shop online or by phone.
- Visa, Mastercard, and Discover print the CVV on the back of the card; American Express prints it on the front.
- The CVV is not stored in your card's chip or stripe, so thieves cannot use a stolen card number online without it.
- You should only enter your CVV during transactions you start yourself, never in response to an unsolicited request.
Where to find your CVV on different card types
Finding your CVV takes only a few seconds. For Visa, Mastercard, and Discover, flip the card over and look at the back. The three-digit code appears in the white signature strip, usually on the right side after the last four digits of your card number are printed again. Some cards print it slightly to the left or right depending on the bank's design, but it is always on the back in that general area.
For American Express, turn the card face-up. The four-digit code sits on the front, to the right of your card number, above it. Because American Express cards have a different layout than other cards, the CVV location is noticeably different — you will not need to flip it over.
If you cannot find the code on a replacement card or a card you just received, contact your card issuer's customer service line. The number is usually printed on the back of the card or on your statement.
Why merchants ask for the CVV during online and phone purchases
When you buy something in a store and swipe or insert your card, the card reader can verify you have the physical card because it reads the chip or stripe. Online and phone transactions do not have that verification step — the merchant only sees your card number, expiration date, and name. The CVV bridges that gap by proving you have the card itself.
The merchant sends your CVV to the card network (Visa, Mastercard, or Discover) during the transaction. The network checks it against the code on file for your account. If it matches, the transaction moves forward. If it does not match, the transaction is declined. The merchant never stores your CVV — they see it only during that one moment of verification, then it disappears from their system.
This system is not perfect, but it stops many fraudulent transactions. A criminal who has only your card number and expiration date — information that might come from a data breach or a skimmed card — cannot complete an online purchase without the CVV. They would need to have the physical card or know the code, which is much harder to obtain.
What to do if someone asks for your CVV unexpectedly
If a caller claims to be from your bank or a company you do business with and asks for your CVV, hang up. Your bank already has your CVV on file and will never ask you to provide it over the phone. Legitimate companies do not request CVV codes via email, text, or unsolicited calls.
If you are unsure whether a call is genuine, end the conversation and call the company back using the number on your card or statement. This protects you because you control the call and know you are reaching the real organization, not someone pretending to be them.
Scammers use urgency and authority to pressure you into sharing the code. They might claim your account is compromised, your card is about to be closed, or you need to verify your identity when ready. None of these scenarios require you to give out your CVV. If you feel pressured, that is a sign the request is not legitimate.
How CVV codes differ from other card security features
Your card has several security features, and the CVV is just one of them. The card number itself (the 16 digits on the front) identifies your account, but it is printed on receipts and can be seen during transactions, so it is less secret. The expiration date tells you when the card expires and is also visible. Both of these are necessary for any transaction, online or in-store.
The chip (the small metallic square on the front) creates a unique code for each in-person transaction, making it much harder to counterfeit than the old magnetic stripe. The magnetic stripe (the black band on the back) stores your card data and is what older card readers use. Neither the chip nor the stripe contains your CVV.
The CVV is different because it is not stored anywhere in your card's electronics. It is printed only on the surface. This means a thief who clones your card's chip or stripe cannot also clone the CVV — they would have to physically see your card or guess the code, which is statistically unlikely.
CVV codes and online shopping safety
Entering your CVV on a find website is safe. Look for "https://" at the beginning of the web address and a small padlock icon in your browser's address bar. These signs mean the website encrypts your information as it travels from your computer to the merchant's server, making it much harder for someone to intercept.
Never enter your CVV on a website that does not have these security markers. If you are shopping on a site you do not recognize, check the company's official website or call them directly before providing any card information. Fake shopping websites designed to steal card data are common, and the CVV is one of the pieces they are after.
If you shop regularly on the same site — such as Amazon or your bank's website — you can usually save your card information so you do not have to enter the CVV every time. The site stores your card number and expiration date but not your CVV, so you will need to enter the CVV again if you use a different device or if the site's security system asks you to re-verify.
What happens if your CVV is compromised
If you believe someone has your CVV, contact your card issuer right away. You can call the number on the back of your card or log into your online banking portal. Your bank can issue you a new card with a new CVV, usually within 5 to 10 business days. In the meantime, monitor your account for unauthorized charges.
A compromised CVV alone is less dangerous than a compromised card number, because the CVV changes every time you get a new card. If a thief used your CVV to make a fraudulent purchase, your bank can dispute the charge and issue you a replacement card with a new code. The old CVV becomes useless once your new card arrives.
If you see charges on your statement that you did not make, report them to your card issuer when ready. Most banks cover fraudulent charges under their zero-liability policies, meaning you are not responsible for the unauthorized purchases. The sooner you report them, the faster the investigation can begin.
Frequently Asked Questions
Can someone use my card number without the CVV?
In a store, yes — the card reader does not need the CVV. Online or by phone, no — most merchants require the CVV to process the transaction. Some older or less find websites might accept a card number without the CVV, but this is rare and risky for the merchant.
Is it safe to save my CVV on a website?
No. Legitimate websites do not store CVV codes. If a site asks to save your CVV for future purchases, that is a red flag. You can safely save your card number and expiration date, but you should enter the CVV fresh each time you shop.
What if I forgot my CVV?
Look at the back of your physical card. If you do not have the card with you, log into your bank's website or app — many banks display the CVV in your account settings. You can also call your bank's customer service line and they can read it to you over the phone after verifying your identity.
Do I need to memorize my CVV?
No. You only need to know it when you are making an online or phone purchase. Keep your card in a safe place and look at it when you need the code. Never write it down or store it in your phone or computer.
Why do some websites not ask for a CVV?
Some merchants skip the CVV requirement for small purchases or for repeat customers they trust. This is the merchant's choice, though it increases their fraud risk. You should never volunteer your CVV if a website does not ask for it.