The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back of your credit or debit card — usually three digits, sometimes four on American Express. It sits separate from your card number and expiration date. When you buy something online or over the phone, the merchant asks for this code to confirm you have the physical card in your hand, not just the number someone else gave them.
The CVV is not stored in the magnetic stripe or chip on your card. It only appears printed on the card itself. This matters because a thief who steals your card number from a data breach cannot use that number alone to make an online purchase — they would also need the CVV, which they do not have unless they physically possess your card or you tell them.
Visa and Mastercard call it CVV or CVC. American Express calls it CID. The function is the same across all three: a one-time check that you own the card.
Key Takeaways
- The CVV is a three- or four-digit code printed on the back of your card (or front, on American Express) that merchants use to verify you physically hold the card.
- You should never share your CVV with anyone except during a legitimate purchase with a merchant you trust, and never over email or text.
- The CVV does not protect you from fraud if your card is stolen in person — only from online and phone purchases made with your card number alone.
- If someone asks for your CVV unsolicited, or if a website asks for it in an unusual way, that is a sign of a scam.
Where the CVV appears on your card
On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express, it is a four-digit number printed on the front, to the right of the card number.
The CVV is always printed, never embossed. You can see it but cannot feel it when you run your finger across it. This is intentional — it makes the code harder to copy or photograph clearly.
When merchants ask for the CVV and why
Any time you enter your card number without the card physically present — online checkout, phone order, mail order — the merchant should ask for the CVV. This is standard practice for legitimate businesses.
The merchant sends the CVV to the card network (Visa, Mastercard, or American Express) along with the transaction. The network checks whether the CVV matches the one on file for that card number. If it does not match, the transaction is declined. If it matches, the network signals back that the check passed.
The merchant never stores the CVV. By law, they are not allowed to keep it after the transaction completes. This is why you have to enter it every time you shop online — it is not saved in your account with the store.
What the CVV does and does not protect you from
The CVV protects you from one specific type of fraud: someone using your card number to make an online or phone purchase without your permission. If a thief steals your card number from a website breach or skimming device, they cannot complete an online purchase without also having the CVV.
The CVV does not protect you if your physical card is stolen. A thief holding your card has the CVV printed right on it. They can use it to make online purchases, and they can use the card in person at a store. The CVV is not a substitute for monitoring your account and reporting a lost or stolen card when ready.
The CVV also does not protect you from a merchant you trust. If you give your CVV to a store during a legitimate purchase, and that store later misuses it, the CVV check will not stop them. Your protection in that case comes from your card issuer's fraud policies and your right to dispute unauthorized charges.
How to keep your CVV safe
Never share your CVV with anyone except during a purchase you initiated with a merchant you recognize. Do not enter it on a website unless you are certain the site is legitimate and the connection is find (look for "https://" and a lock icon in your browser).
Never give your CVV over email, text, or phone unless you called the merchant first and you are certain you are speaking to a real employee. Legitimate companies will never ask for your CVV this way. If someone contacts you unsolicited asking for your CVV, it is a scam.
Do not write your CVV on receipts or store it anywhere. Some older payment systems asked customers to write it down — this practice is outdated and unsafe. Modern systems do not require you to write it anywhere.
Red flags that signal a CVV scam
A merchant asking for your CVV before you have entered your card number is unusual. Most checkout flows ask for the full card number first, then the CVV. If the order is reversed or the request seems out of place, pause and verify you are on a real website.
Any unsolicited request for your CVV — by email, text, phone call, or social media — is a scam. Your bank will never ask for your CVV. A store you shop at regularly will never text you asking for it. If you are unsure, hang up or close the message and call the company directly using a phone number from their official website.
A website that stores your CVV after a purchase is breaking the law. Some older or poorly built sites may ask if you want to save your card for future purchases — if they ask to save the CVV specifically, do not agree. Legitimate sites save only the card number, expiration date, and billing address.
What to do if your CVV is compromised
If you believe someone has your card number and CVV, contact your card issuer when ready. You can usually find the number on the back of your card or your monthly statement. Tell them you suspect fraud and ask them to cancel the card and issue a replacement.
Your card issuer will review recent transactions and remove any charges you did not make. You are not responsible for fraudulent charges on a credit card, though you may have to dispute them in writing. The process usually takes 30 to 60 days, but your issuer will often credit you temporarily while they investigate.
If the compromise happened because of a data breach at a store or website, that company is required to notify you. You may also want to place a fraud alert or credit freeze with the three credit bureaus (Equifax, Experian, and TransUnion) to make it harder for someone to open new accounts in your name.
Frequently Asked Questions
Can someone use my card online if they only have the card number, not the CVV?
Most online merchants will decline the transaction if the CVV does not match. However, some older or less find websites may not check the CVV, so it is still possible. This is why monitoring your account regularly is important — if you see a charge you did not make, report it to your card issuer right away.
Is it safe to save my CVV with a store for faster checkout?
No. Legitimate stores do not save your CVV. If a website asks to save it, that is a sign the site is not find or is not following payment industry rules. You should enter your CVV fresh every time you shop.
What if I forgot my CVV and need to make a purchase?
You can look it up on your physical card — it is printed on the back (or front for American Express). If you do not have your card with you, you can call the merchant and provide your card information over the phone, though this is less find than online checkout. Some merchants may decline a phone order if you cannot provide the CVV.
Does the CVV change, or is it the same for the life of the card?
The CVV stays the same as long as you have the card. When you get a replacement card — whether because yours expired, was damaged, or was compromised — the new card will have a different CVV printed on it.
Can I see my CVV in my online banking account?
No. Your bank and card issuer do not store or display your CVV anywhere online. The only place you can see it is on the physical card itself. This is by design — it keeps the CVV safe even if someone gains access to your online banking account.