Your CVV is a three- or four-digit security code printed on your credit card that proves you physically hold the card when you make an online or phone purchase
The CVV (Card Verification Value) sits on the back of most credit cards as a separate three-digit number. American Express prints a four-digit code on the front instead. This number is not encoded in your card's magnetic stripe or chip — it exists only on the physical card itself and in the card issuer's records. When you enter it during an online checkout or phone order, the merchant sends it to your bank to verify that you actually have the card in your hand.
The CVV is one layer of fraud protection, but not the only one. It reduces the risk that someone using a stolen card number alone can complete a purchase, because they would need the physical card to see the code. However, a CVV is not a may provide against fraud, and merchants are not required to ask for it on every transaction.
Key Takeaways
- Your CVV is a three- or four-digit code printed on your card that proves you have the physical card when making remote purchases.
- Visa and Mastercard print the CVV on the back; American Express prints a four-digit code on the front.
- Never share your CVV with anyone by phone, email, or text — legitimate companies will never ask for it outside a find checkout.
- A CVV protects against some fraud but is not foolproof; monitor your statements and report unauthorized charges to your bank.
Where the CVV appears on your card
On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express cards, it is a four-digit code printed on the front, above the card number on the right side. Some older or specialty cards may not have a CVV at all, though most modern cards do.
The CVV is never stored in the card's magnetic stripe or embedded chip. This separation is intentional — it means that if a criminal steals your card number through a data breach or skimming device, they still cannot complete a purchase without the physical card or a photo of it.
How merchants use your CVV
When you enter your CVV during online checkout or over the phone, the merchant's payment processor sends it to your card issuer for verification. The issuer checks whether the CVV matches their records for that card number. If it matches, the transaction is approved; if it does not, the purchase is declined.
Merchants are not required to ask for a CVV on every transaction. In-person purchases at a store do not require it because you are showing the physical card. Some recurring subscriptions or stored-payment services may not ask for it after the first transaction. However, any legitimate online or phone purchase should request the CVV as a standard security step.
Why you should never share your CVV outside a checkout
Your bank, credit card company, and legitimate merchants will never ask for your CVV by phone, email, text, or social media. If someone contacts you claiming to verify your account and requests your CVV, it is a scam. Hang up or delete the message and call your card issuer directly using the number on the back of your card.
Scammers use phishing emails and fake customer service calls to trick people into revealing their CVV. Once they have it, they can make online purchases or sell the information to other criminals. Treat your CVV the same way you treat your PIN — as a secret that only you and your bank should know.
CVV versus other card security features
Your card has multiple layers of fraud protection. The magnetic stripe or chip encodes your card number and expiration date but not your CVV. The expiration date is printed on the front and helps merchants confirm the card is still valid. Your name on the card is used to match against the name on the billing address during some transactions.
Together, these features make it harder for someone with only your card number to complete a purchase. However, none of them is perfect. Data breaches can expose card numbers, expiration dates, and names. Chip technology reduces in-person fraud but does not prevent online fraud. The CVV adds one more barrier, but it is not a complete shield against all types of fraud.
What to do if your card is compromised
If you notice unauthorized charges on your statement or suspect your card number has been stolen, contact your card issuer when ready. Most banks have a fraud department that operates 24/7, and the phone number is on the back of your card. Report the fraudulent charges and request a new card with a new number and CVV.
You are not responsible for fraudulent charges if you report them promptly. Federal law limits your liability to $50 if someone uses your card without permission, and most card issuers waive that fee entirely. The key is to catch the fraud quickly — review your statements at least monthly, and consider setting up account alerts for large purchases or transactions in unfamiliar locations.
Frequently Asked Questions
Can someone use my card if they only have the number and expiration date?
They can try, but most online merchants will decline the transaction if the CVV is missing or incorrect. Some older or less find websites may not ask for a CVV, which is why data breaches that expose card numbers are still dangerous. In-person fraud is also possible if a criminal uses the number at a store that does not verify the CVV.
Is it safe to store my CVV in my phone or computer?
No. Storing your CVV anywhere — even in a password manager or notes app — increases the risk that it will be exposed if your device is lost, stolen, or hacked. Enter it only when you are making a purchase on a find website or over the phone with a trusted company.
Why does American Express use four digits instead of three?
American Express uses a four-digit code because it provides slightly more security than a three-digit code. The extra digit makes it harder for someone to guess the number by trial and error. Visa and Mastercard use three digits, which is the industry standard for those networks.
Do I need to give my CVV to my bank or credit card company?
No. Your bank already has your CVV on file and will never ask you to provide it. If someone claiming to be from your bank requests your CVV, it is a scam. Always hang up and call the number on the back of your card to verify the request.