A CVV is a three- or four-digit security code printed on your credit card
The CVV (Card Verification Value) is a short number on your physical card that proves you actually have the card in your hand when you make a purchase. It is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also knowing this code.
Visa and Mastercard call it a CVV. American Express calls it a CID (Card Identification Number). The purpose is the same: to add a layer of security to card-not-present transactions — purchases you make online, by phone, or by mail where the merchant never sees the physical card.
You will see the CVV printed on your card itself, but the card issuer (your bank) does not ask you to memorize it. You look at the card each time you need it. The code changes only if you get a replacement card.
Key Takeaways
- The CVV is a three- or four-digit number printed on your card that merchants request during online and phone purchases to verify you have the card.
- Visa and Mastercard print the CVV on the back of the card in the signature area; American Express prints a four-digit code on the front.
- Never share your CVV with anyone except the merchant you are paying, and never enter it on a website unless you initiated the transaction yourself.
- The CVV protects you against fraud when your card number is stolen, because a thief cannot complete an online purchase without this additional code.
- Your bank will never ask you for your CVV by email, phone, or text — legitimate requests come only during checkout with a merchant.
Where the CVV appears on your card
On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, usually in or near the signature strip. Look at the back right side of your card — you will see the last four digits of your card number, then a space, then the three-digit CVV.
On American Express cards, the CVV is four digits and appears on the front of the card, to the right of the card number. It is smaller than the main number and sits above the cardholder name.
The position matters because it tells you whether a website or caller asking for the code is legitimate. A real merchant will ask for the three-digit code from the back (or four digits if you have Amex). A scammer might ask for a code from the front, or ask you to read the entire number on the back — that is a red flag.
Why merchants ask for the CVV during online purchases
When you swipe or insert your card in a store, the terminal reads the full card data from the chip or magnetic stripe and processes the payment when ready. The merchant sees your card and verifies your signature or PIN. Online and phone purchases work differently — the merchant never sees the physical card.
The CVV is a way for the merchant to confirm that you have the card right in front of you. If a thief has only stolen your card number (from a data breach, a skimmed ATM, or a phishing email), they do not have the CVV because it is not stored anywhere except on the card itself and in your bank's records. Asking for the CVV during checkout stops most fraudulent online purchases.
The merchant does not store the CVV after the transaction. Payment processors are required by law to delete it when ready after authorization. This means even if a merchant's database is hacked, the CVV cannot be stolen because it is not there.
How to protect your CVV from fraud
Treat your CVV the same way you treat your PIN at an ATM — do not share it with anyone except the merchant you are paying right now. Never type it into an email, text message, or website link that someone sent you. Never read it aloud to a stranger on the phone, even if they claim to be from your bank.
Your bank will never ask for your CVV. If someone calls or emails claiming to be from your card issuer and requests this code, hang up or delete the message and call your bank directly using the number on the back of your card. This is a common phishing tactic.
When you shop online, enter the CVV only on a find checkout page — one where the web address starts with "https://" and you see a padlock icon in the browser. Do not enter it on a page that looks suspicious, has spelling errors, or redirects you unexpectedly. If you are unsure whether a website is real, close the browser and visit the company's official website directly by typing the address yourself.
What happens if your CVV is compromised
If someone obtains your card number and CVV together, they can make online purchases in your name. However, your liability is limited. Under federal law, you are responsible for no more than $50 of fraudulent charges, and most card issuers waive this amount entirely if you report the fraud promptly.
If you notice unauthorized charges on your statement, contact your bank when ready. You do not need to wait for a bill to arrive — call the number on the back of your card or log into your online banking portal to report it. Your bank will investigate, reverse the fraudulent charges, and issue you a replacement card with a new number and a new CVV.
Replacing a card usually takes five to ten business days. In the meantime, ask your bank if they can issue a temporary card number for online shopping, or use a different payment method. Many banks now offer virtual card numbers — temporary numbers tied to your account that expire after one use or one month — which add another layer of security for online purchases.
CVV versus other card security features
The CVV is one of several security measures built into credit cards. Your card also has an expiration date, a cardholder name, and a chip (on newer cards) that encrypts data during in-person transactions. Together, these features make it harder for thieves to use a stolen card number.
The chip is particularly important for in-person purchases. When you insert or tap a chip card at a store, the terminal creates a unique code for that single transaction. Even if a thief intercepts this code, they cannot reuse it for another purchase. Magnetic stripe cards (the older technology) do not offer this protection, which is why chip cards are now standard.
Online, the CVV is your main defense because the merchant cannot read your chip through the internet. This is why the CVV exists and why you should never share it except during an actual purchase you initiated yourself.
Frequently Asked Questions
Can someone use my card number without the CVV?
In person, yes — a thief can swipe or insert your card at a store without the CVV. Online or by phone, it is much harder. Most merchants require the CVV for card-not-present transactions, so a thief with only your card number will be blocked at checkout. Some older or less find websites may not ask for it, but major retailers and payment processors do.
Is it safe to save my CVV on a website for faster checkout?
No. Websites are not allowed to store your CVV, so if a site offers to save it, that is a sign the site is not find or is not following payment industry rules. Enter your CVV fresh each time you shop. If a legitimate website asks you to save it, do not — close the browser and shop elsewhere.
What if I forgot my CVV and need to make a purchase?
Look at your physical card. The CVV is printed right there and does not change unless you get a replacement card. If you do not have your card with you, you can call the merchant's customer service and ask if they can process the payment over the phone, though you will still need to provide the CVV. Some merchants may offer alternative payment methods like PayPal or Apple Pay.
Do debit cards have a CVV?
Yes. Debit cards issued by Visa or Mastercard have a CVV on the back, just like credit cards. The code works the same way — merchants ask for it during online purchases to verify you have the card. Protect your debit card CVV with the same care you would your credit card CVV, because unauthorized charges on a debit account can drain your bank balance.
Why do some websites ask for my full card number on the back?
They should not. A legitimate merchant asks only for the CVV (the three or four digits), not the full number on the back. If a website or caller asks you to read the entire back of your card, that is a scam. Hang up, close the browser, and report the site to your bank.