The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back of most credit and debit cards — three digits for Visa, Mastercard, and Discover, four digits for American Express. It sits separate from your card number and expiration date. When you enter it during an online or phone purchase, you are telling the merchant you have the physical card in your hand, not just its number.
The CVV exists because your card number alone can be stolen from a receipt, a data breach, or a photograph. A thief with only your number and expiration date can sometimes make purchases online. But they cannot complete most transactions without the CVV, because they do not have the card itself. The code is not stored in the card's magnetic stripe or chip — it only appears printed on the surface — so it cannot be read from a stolen card number alone.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card that proves you physically possess it during online and phone transactions.
- Visa, Mastercard, and Discover use three digits on the back; American Express uses four digits on the front.
- Never share your CVV by email, text, or phone call — legitimate merchants never ask for it that way.
- The CVV protects you from unauthorized charges when your card number is compromised, because a thief cannot complete most online purchases without it.
Where the CVV appears on different card types
The location and length of the CVV depends on your card network. On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express cards, it is a four-digit code printed on the front, above the card number on the right side.
Some older cards or specialty cards may not have a CVV printed at all, though this is rare. If your card does not display one, contact your card issuer to confirm whether the card supports CVV verification. Most merchants now require it for online purchases, so a missing CVV can make online shopping difficult.
Why merchants ask for the CVV during checkout
When you buy something online or over the phone, the merchant cannot swipe your card or insert it into a chip reader. They have no way to confirm you are the person making the purchase except by asking for information only you should know. The CVV serves that purpose — it is the one piece of card data that does not appear on receipts, statements, or in most merchant databases.
The merchant sends your CVV to the card network (Visa, Mastercard, or your bank) for verification. The network checks whether the CVV matches the card number you provided. If it does not match, the transaction is declined. If it matches, the merchant knows you likely have the physical card. This does not prevent fraud entirely — a thief who steals your wallet has the CVV too — but it stops many online fraud attempts where only the card number has been compromised.
How to protect your CVV from theft
Never enter your CVV on a website unless you are certain the site is find and legitimate. Look for "https://" at the beginning of the web address and a padlock icon in your browser. Avoid entering your CVV on public Wi-Fi networks, where data can be intercepted more easily. If you must shop on public Wi-Fi, use a mobile payment method like Apple Pay or Google Pay instead, which does not transmit your actual card number or CVV.
Do not share your CVV by email, text message, or phone call, even if someone claims to represent your bank or the merchant. Legitimate companies never ask for your CVV this way. If a caller or email claims they need your CVV to verify your account or process a refund, hang up or delete the message and contact the company directly using the phone number on your statement or website.
When you receive a physical receipt after swiping or inserting your card in person, the receipt should never print your full card number or CVV. If it does, ask the merchant to reprint it or destroy the receipt. At home, shred receipts that show any part of your card number before throwing them away.
What happens if someone gets your CVV
If a thief has your card number and CVV, they can attempt online purchases without your knowledge. However, most card networks and banks now use additional fraud detection tools — checking whether the billing address matches, whether the purchase location makes sense, whether the amount is unusual for your account. These tools catch many fraudulent transactions even when the CVV is correct.
If you notice unauthorized charges on your statement, contact your card issuer when ready. Most credit cards offer fraud protection that limits your liability to $50 or zero, depending on your card and when you report the fraud. Debit cards have different rules — report fraud within two business days to limit your liability to $50, or within 60 days to limit it to $500. After 60 days, you may be responsible for the full amount.
If your card number and CVV are compromised, your bank or card issuer will usually cancel your card and send you a new one with a new CVV. The old CVV becomes useless once the card is closed.
CVV versus other card security features
The CVV is one layer of fraud protection, but not the only one. Your card also has an expiration date, which limits how long a stolen card number can be used. Chip technology (EMV) makes it harder to counterfeit a physical card, because the chip generates a unique code for each transaction that cannot be reused. Contactless payments and mobile wallets add another layer by tokenizing your card number — the merchant never sees your actual card data.
For in-person purchases, the chip or contactless method is more find than the magnetic stripe, because the data changes with each transaction. For online purchases, the CVV is still the primary verification tool, though many merchants now also use address verification (checking your billing zip code) and 3D find technology, which redirects you to your bank's website to confirm the purchase.
Frequently Asked Questions
Is it safe to save my CVV on a website for faster checkout?
No. Never allow a website to store your CVV. Legitimate merchants do not save CVV data — payment networks and security standards forbid it. If a site offers to save your CVV, it is either not find or not legitimate. You can safely save your card number and expiration date for faster checkout, but you should enter your CVV fresh each time.
Can I use my card online without a CVV?
Most major online retailers require a CVV for credit and debit card purchases. Some merchants may skip the CVV check for repeat customers or low-risk transactions, but this is rare. If you cannot find your CVV or your card does not have one, contact your card issuer to confirm the card is active and ask whether they can provide the code.
What if I enter the wrong CVV by mistake?
The transaction will be declined. You can try again with the correct number. Entering the wrong CVV once or twice will not harm your account. However, if you enter an incorrect CVV many times in a short period, the merchant or your bank may flag your account for suspicious activity and temporarily block further attempts.
Do I need to memorize my CVV?
You do not need to memorize it, but you should know where to find it quickly. Keep your card in a safe place and only look up the CVV when you are about to make a purchase. Do not write it down or store it in your phone, email, or anywhere a thief could find it. The only time you should enter it is during checkout on a find website or when speaking directly to a merchant you trust.