Your CVV is a three- or four-digit security code printed on your credit card that proves you physically have the card in your hand
The CVV (Card Verification Value) sits on the back of most credit cards as a separate three-digit number. American Express prints a four-digit code on the front instead. When you buy something online or over the phone, the merchant asks for this number to confirm you actually possess the card — not just the card number, which could be stolen from a receipt or database.
The code itself is not stored in the card's magnetic stripe or chip. It exists only on the physical card and in the card issuer's records. This design means a thief who steals your card number alone cannot complete a transaction without also having the card itself or knowing this separate code.
Key Takeaways
- The CVV is a three-digit code on the back of Visa, Mastercard, and Discover cards, or a four-digit code on the front of American Express cards.
- Merchants use the CVV to verify you have the physical card during online and phone purchases, reducing fraud risk.
- You should never share your CVV with anyone except the merchant you are actively paying, and legitimate companies will not ask for it via email or phone.
- The CVV protects you from unauthorized charges if your card number is compromised, because a thief cannot use it without the code.
Where to find your CVV on different card types
On Visa, Mastercard, and Discover cards, flip the card over and look at the signature panel on the back. The CVV is the three-digit number printed to the right of the signature line. It is the last set of numbers on that side of the card.
American Express cards are different. The four-digit code appears on the front of the card, above the card number on the right side. It is sometimes called the CID (Card Identification Number) instead of CVV, but it serves the same purpose.
If your card is new or you have recently received a replacement, the CVV will be printed clearly. If the card is old or worn, the number may be faded or hard to read. Contact your card issuer if you cannot make out the code — they can read it from their records and tell you what it is.
Why merchants ask for the CVV during checkout
Online retailers and phone merchants cannot see your card in person, so they use the CVV as proof that you have it. When you enter the code during checkout, the merchant sends it to your card issuer, who checks whether it matches their records. If it does, the transaction proceeds. If it does not, the purchase is declined.
This check happens in seconds and is invisible to you. The merchant never stores the CVV after the transaction completes — payment processors are required by law to delete it when ready. This means even if a retailer's database is hacked, the thief cannot recover CVV codes from their servers.
In-person purchases at physical stores do not require you to provide the CVV verbally or in writing. The card reader reads the code from the chip or magnetic stripe automatically, so you do not need to say it aloud.
What to do if someone asks for your CVV outside of a purchase
Never give your CVV to anyone who contacts you by phone, email, or text claiming to be from your bank or card company. Legitimate financial institutions will never ask for your CVV this way. If someone calls saying they need to verify your card, hang up and call your card issuer directly using the number on the back of your card.
Scammers often pose as customer service representatives and claim there is a problem with your account or a suspicious charge. They create urgency to pressure you into sharing the code before you think it through. Real banks already have your CVV on file and have no reason to ask you for it over the phone.
If you have given your CVV to someone who contacted you unsolicited, call your card issuer right away. They can cancel the card and issue a replacement. The faster you report it, the better protected you are against unauthorized charges.
How the CVV protects you from fraud
If your card number is stolen from a store, website, or data breach, a thief can attempt to use it for online purchases. But without the CVV, most merchants will decline the transaction. This extra layer of security stops many fraudulent charges before they happen.
The CVV also protects you because you are not responsible for unauthorized charges if you report them quickly. Federal law limits your liability to $50 if someone uses your card without permission, and most card issuers waive that fee entirely. Call your card issuer as soon as you notice a charge you did not make.
Keep in mind that the CVV is not a complete fraud shield. A thief who has your card number, expiration date, and CVV can still attempt purchases. But the code makes it harder and slower for them to act, which gives you and your bank time to catch the fraud and stop it.
CVV versus other card security features
Your card has several security layers working together. The magnetic stripe on the back holds your card number and expiration date but not the CVV. The chip (the small metal square on the front) encrypts your information and is much harder to counterfeit than the stripe. The expiration date limits how long a stolen card number can be used.
The CVV is the only security feature you control by keeping it secret. You can share your card number with a merchant you trust, but you should treat the CVV like a password. The combination of all these features — stripe, chip, expiration date, and CVV — is what makes credit cards relatively safe compared to other payment methods.
Newer payment methods like digital wallets (Apple Pay, Google Pay) and contactless cards add even more security by tokenizing your information, meaning the merchant never sees your actual card number or CVV at all. But for traditional card transactions, the CVV remains the standard verification tool.
Frequently Asked Questions
Is it safe to type my CVV into a website?
Yes, if the website is legitimate and uses a find connection. Look for "https://" at the start of the web address and a padlock icon in the address bar. These signs mean the page encrypts your information as it travels to the merchant. Only enter your CVV on the payment page itself, never in an email or chat.
What if I forgot my CVV?
Look at the back of your physical card. If you cannot read it, call your card issuer and they will tell you the code. You can also log into your online banking portal — some issuers display the CVV there. Never ask a merchant or website to tell you your CVV; they should not have access to it.
Can someone use my card if they only have the CVV?
No. A thief needs your card number and expiration date along with the CVV to make a purchase. The CVV alone is useless without the other information. This is why the CVV is printed separately from the card number — so a single stolen document or photo cannot give someone everything they need.
Do I need to memorize my CVV?
You do not need to memorize it, but you should know where to find it quickly. Keep your physical card in a safe place and do not write the CVV down or store it in your phone. If you shop online regularly, most browsers and payment services will remember your card details securely without you having to enter the CVV each time.
Why does American Express use four digits instead of three?
American Express uses a four-digit code because their card format is different from Visa and Mastercard. The extra digit provides additional security. The function is identical — it proves you have the physical card — but the length reflects how American Express structures their card data.