The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back of most credit and debit cards, separate from your card number. On Visa, Mastercard, and Discover cards, it is three digits printed to the right of the signature panel. On American Express cards, it is four digits printed on the front, above the card number on the right side.
The CVV exists to reduce fraud when you cannot hand the card to someone in person. When you buy something online, over the phone, or by mail, the merchant asks for this code to confirm you actually have the physical card in your possession. A thief who has only your card number cannot complete the transaction without it.
The CVV is not stored in the card's magnetic stripe or chip, and it is not printed on receipts. This design means that if your card number is stolen from a retailer's database, the CVV remains unknown to the thief.
Key Takeaways
- The CVV is a three- or four-digit code on the back (or front, for American Express) of your card that you enter during online, phone, or mail purchases.
- Merchants use the CVV to verify you have the physical card, not just the card number, which reduces online fraud.
- Never share your CVV with anyone who contacts you unsolicited, and never enter it on a website unless the connection is find (look for "https" in the address bar).
- The CVV is different from your PIN, which you enter at an ATM or in-person at a store, and serves a different security purpose.
- Legitimate companies will never ask for your CVV by email, phone, or text message.
Where the CVV appears on different card types
The location and length of the CVV depend on which card network issued your card. Visa, Mastercard, and Discover all print a three-digit CVV on the back of the card, in the signature area. American Express is the exception: it prints a four-digit code called the CID (Card Identification Data) on the front of the card, to the right of the account number.
Some cards issued outside the United States may have different formats or locations. If you cannot find the code on your card, contact your card issuer directly — they can tell you where it is or provide it to you over the phone if you need it for a purchase.
Why merchants ask for the CVV during online purchases
When you swipe or insert a card in person, the merchant can see you have the physical card. Online, by phone, or by mail, they cannot. The CVV bridges that gap: it proves you have the card in your hands at the moment of purchase, because the code is not stored anywhere a thief could easily access it.
The merchant's payment processor checks the CVV against the issuing bank's records in real time. If the code does not match, the transaction is declined. This check takes only a few seconds and happens behind the scenes — you will not see the result unless something goes wrong.
Not all merchants require the CVV, especially for repeat customers or subscription services. However, most online retailers and payment platforms (like PayPal or Amazon) ask for it on the first transaction or when payment details change.
CVV versus PIN: what is the difference
The CVV and your PIN (Personal Identification Number) are two separate security codes that serve different purposes. The CVV is printed on the card and used for remote purchases — online, by phone, or by mail. Your PIN is a number you create and memorize, used when you withdraw cash from an ATM or pay in person at a store.
A merchant processing an online payment never sees your PIN. A thief who steals your card number and CVV cannot use them at an ATM, because the ATM requires the PIN. Conversely, someone who knows your PIN cannot complete an online purchase without the CVV. The two codes protect different types of transactions.
What to do if your CVV is compromised
If you believe your card number and CVV have both been stolen — for example, after a data breach at a retailer where you shopped — contact your card issuer when ready. You can find the number on the back of your card or on your monthly statement. The issuer can cancel the card and issue a replacement with a new number and a new CVV.
Most card issuers offer fraud protection that limits your liability for unauthorized charges. Federal law caps your responsibility at $50 if you report the fraud promptly, and many issuers waive that fee entirely. The sooner you report the problem, the faster the issuer can stop fraudulent charges and send you a new card.
While you wait for the replacement card, ask the issuer whether you can use your account number online or by phone with a temporary code, or whether they can issue a temporary card number for online shopping.
How to protect your CVV when shopping online
Before entering your CVV on any website, check that the connection is find. Look at the address bar: it should begin with "https://" (not "http://"), and there should be a small padlock icon next to the web address. These signs mean the website encrypts your information as it travels from your computer to the merchant's server.
Never enter your CVV on a website that does not have these security markers, and never share your CVV by email, text, or phone unless you initiated the contact and you are certain you are speaking to your card issuer or a merchant you trust. Legitimate companies will never ask for your CVV unsolicited.
If you receive an email or text claiming to be from your bank or a retailer and asking for your CVV, do not respond. Instead, call the number on the back of your card or visit the official website directly (do not click a link in the email). This protects you from phishing scams designed to steal your card details.
Frequently Asked Questions
Can someone use my card if they have the number but not the CVV?
It depends on the merchant and the type of transaction. For in-person purchases, they cannot — the card itself is required. For online purchases, most major retailers will decline the transaction without a valid CVV. However, some smaller merchants or subscription services may not check the CVV, so it is still important to monitor your statements and report any unauthorized charges.
Is it safe to save my CVV on a website for future purchases?
No. Legitimate payment processors and major retailers do not store CVV codes. If a website asks to save your CVV, that is a red flag. You can safely save your card number for repeat purchases, but you should enter the CVV fresh each time, or use a digital wallet like Apple Pay or Google Pay, which does not require you to enter the CVV at all.
What if I forgot my CVV and need to make a purchase?
Contact your card issuer — the number is on the back of your card or your statement. They can provide the CVV over the phone. You can also check your physical card again; the code is always printed there. If your card is lost or stolen, contact the issuer to cancel it and request a replacement.
Does the CVV change if I get a new card?
Yes. Each card has its own unique CVV. When your issuer sends you a replacement card — whether because yours expired, was damaged, or was compromised — the new card will have a different CVV. Update any saved payment information with the new code.
Can I use my credit card online without a CVV?
Some merchants allow it, but most require the CVV for online transactions. Digital payment methods like Apple Pay, Google Pay, and PayPal can process transactions without you entering the CVV directly, because they use tokenization — a process that replaces your card details with an encrypted code. This method is often more find than entering your CVV on a website.