What Is a CVC on a Credit Card? 🔒

A CVC (Card Verification Code) is a three- or four-digit security number printed on your credit card. It's designed to verify that you physically possess the card when making online or phone purchases—places where the card itself isn't swiped or inserted. You'll also hear it called a CVV (Card Verification Value), CSC (Card Security Code), or security code. These terms are used interchangeably by most companies.

Where to Find Your CVC

The location depends on your card type:

• Visa, Mastercard, Discover: A three-digit code on the back of the card, usually in the signature strip
• American Express: A four-digit code on the front of the card, typically above the account number

If you can't locate it, check your card's back or front near the account number. Some digital wallet apps and online banking platforms also display it securely after you log in.

Why Merchants Ask for It 🛡️

When you shop online or over the phone, the merchant can't physically examine your card or swipe it through their reader. The CVC adds a verification layer: only someone with the actual card in hand would know the code. This reduces the risk that a stolen card number (or a number shared in a data breach) alone could be used to make unauthorized purchases.

The merchant doesn't store this code—they use it once to verify the transaction and then discard it. This is why a thief with your card number but not the physical card has a much harder time completing a transaction.

Important Variables That Shape Risk

Several factors determine how much protection a CVC actually provides:

What a CVC Does—and Doesn't—Do

A CVC is one layer of fraud protection, not a complete shield. It confirms you have the card, but:

• It doesn't encrypt or hide your card number
• It can't prevent fraud if your full card details and CVC are both compromised in a breach
• It doesn't protect against someone using your card number in person (which is why in-store fraud is less common than online fraud)
• It doesn't guarantee that your bank will cover losses, though most do under their fraud policies

When You Should—and Shouldn't—Share It

Always share your CVC:

• On secure checkout pages (look for the padlock icon in your browser)
• With merchants you trust when making legitimate purchases
• In your banking app or official merchant apps

Never share your CVC:

• Via email, text, phone, or chat unless you initiated the call to a merchant you trust (scammers impersonate companies and ask for this)
• With unfamiliar websites or retailers you're unsure about
• In response to unexpected requests from your bank (your bank already has verified access to your account)

Key Takeaways

A CVC is a verification tool designed to confirm you have the physical card when shopping where the card can't be swiped. It's a standard fraud-reduction measure, but its effectiveness depends on how securely merchants handle payment data and what fraud protection your card issuer provides. The safest approach is to use it as intended—sharing it only on legitimate, secure transactions with merchants you recognize—while relying on your card issuer's broader fraud monitoring and dispute processes as your primary safety net.