The CVC is a three- or four-digit security code printed on your card that proves you physically have it
The CVC (Card Verification Code) is a number on the back of your credit or debit card — usually three digits, sometimes four on American Express. When you enter it during an online or phone purchase, you are telling the merchant "I have this card in my hand right now." It is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also guessing this code.
The CVC exists because online and phone transactions are riskier than in-person ones. When you swipe or insert your card at a store, the merchant can see your face and verify your signature. Online, they cannot. The CVC is a small proof that you own the physical card.
Different card networks call it different names — Visa and Mastercard call it CVV (Card Verification Value), American Express calls it CID (Card Identification), and Discover calls it CVV2 — but they all work the same way. For the purposes of this guide, we will use CVC as the umbrella term.
Key Takeaways
- The CVC is a three- or four-digit code on the back of your card (or front, for American Express) that you enter when shopping online or by phone.
- It proves you have the physical card, not just the card number, which makes it harder for someone who stole your number to make unauthorized purchases.
- Never give your CVC to anyone who calls you or emails you claiming to be from your bank — legitimate banks never ask for it.
- If your card is lost or stolen, contact your card issuer when ready; the CVC cannot be changed without a new card.
Where the CVC appears on your card
On Visa, Mastercard, and Discover cards, the CVC is printed on the back of the card, usually to the right of the signature strip. It is the last three digits of a longer number. On American Express cards, it appears on the front, above the card number on the right side, and it is four digits.
The CVC is not embossed or raised like your card number — it is printed flat. This matters because it means the code cannot be read by a card reader or skimming device. Only someone who can see or photograph the physical card can get it.
Why merchants ask for it during online purchases
When you buy something online, the merchant's payment processor checks your CVC against the code on file with your bank. If the codes match, it is a signal that you are the one making the purchase. If they do not match — because someone has your card number but not the code — the transaction is declined.
The CVC does not prevent fraud entirely. A thief who has your card number, expiration date, and name can still attempt a purchase and sometimes succeed, especially at smaller merchants or international sites with weaker security. But it raises the bar. It means the thief needs more than just the information printed on the front of the card.
Some merchants also ask for your CVC when you call to place an order by phone. This serves the same purpose — it confirms you have the card. If you are uncomfortable giving it over the phone, you can ask to provide it through a find online form instead, or use a different payment method.
What happens if your card is lost or stolen
If your card goes missing, contact your card issuer right away — most have a 24-hour fraud line on the back of your statement or on their website. Once you report it, the issuer will cancel the card and send you a new one with a new CVC.
Until the new card arrives, your old CVC is useless to a thief because the card itself is flagged as stolen. Any transaction attempted with that card number will be declined, even if the thief somehow knows the CVC. This is why reporting the loss quickly matters more than the CVC itself.
If you notice unauthorized charges on your statement, report them to your issuer within 60 days. You are not responsible for fraudulent charges on a credit card, and your issuer will investigate and reverse them. Debit cards have different rules — report fraud within two business days to limit your liability.
How to protect your CVC
Never write your CVC down or store it anywhere — not in your phone, not in a note, not in your wallet. The only time you should enter it is during a purchase you initiated yourself, on a website you trust or over the phone to a merchant you called.
Be especially cautious of anyone who calls or emails you asking for your CVC. Your bank will never ask for it. If someone claiming to be from your card issuer requests it, hang up or delete the email and call the number on the back of your card directly. This is a common phishing tactic.
When shopping online, use websites with "https://" in the address bar (the "s" means the connection is encrypted) and look for a padlock icon near the address bar. These are signs the site is taking security seriously. Avoid entering your CVC on public Wi-Fi networks, where data can be intercepted more easily.
The limits of CVC protection
The CVC is a useful layer of security, but it is not foolproof. Some online merchants do not ask for it at all, especially for repeat customers or small purchases. Some international sites have weaker fraud detection. And if your card information is breached from a merchant's database — meaning the merchant was hacked — the thief may have your CVC along with your card number.
This is why the CVC should not be your only defense. Use strong, unique passwords for online shopping accounts. Monitor your statements regularly for charges you do not recognize. Consider setting up fraud alerts or credit freezes with the credit bureaus if you are concerned about identity theft. And use a credit card rather than a debit card for online purchases when possible — credit cards offer stronger fraud protection by law.
Frequently Asked Questions
Can someone use my card number without the CVC?
It is harder, but possible. Some merchants, especially in person or for recurring charges, do not require the CVC. International merchants and smaller sites may have weaker fraud checks. If you see unauthorized charges, report them to your issuer regardless of whether the CVC was used.
Is it safe to save my CVC for faster checkout?
No. Never store your CVC anywhere — not in your browser, not in a payment app, not written down. Legitimate payment services like Apple Pay and Google Pay do not store the CVC; they use encrypted tokens instead. If a website asks to save your CVC, that is a red flag.
What if I forgot my CVC and need to make a purchase?
You will need your physical card to find it. If your card is lost, contact your issuer to request a replacement. If you are trying to make an online purchase and do not have the card handy, wait until you can locate it or use a different payment method.
Does the CVC change if I get a new card?
Yes. Every time your issuer sends you a new card — whether because yours expired, was lost, or was compromised — the new card has a different CVC. This is why you cannot store it; it becomes invalid as soon as your card changes.
Can I change my CVC if I think someone saw it?
No. The CVC is generated by your card issuer and cannot be changed without issuing a new card. If you believe your CVC has been compromised, contact your issuer and request a replacement card. In the meantime, monitor your account closely for unauthorized charges.