The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a short number on the back or front of your credit or debit card that online merchants and phone sellers use to confirm you actually hold the card in your hand. It is not stored in the card's magnetic stripe or chip, which is why a thief who steals your card number alone cannot use it to buy things online without also knowing this code.
Visa and Mastercard call it CVV2. American Express calls it CID and prints it on the front. Discover calls it CID as well. The location and name change, but the purpose is the same: to add a second layer of proof beyond just your card number and expiration date.
You should never give your CVV to anyone who calls you, texts you, or emails you claiming to represent your bank. Your bank already has this information and will never ask for it. Scammers use fake urgency and authority to trick you into reading the code aloud.
Key Takeaways
- The CVV is a three- or four-digit code on your card that merchants use to verify you physically possess the card when you shop online or by phone.
- Visa and Mastercard print it on the back; American Express and Discover print it on the front, but all serve the same security purpose.
- Your bank will never ask you for your CVV by phone, email, or text — sharing it with someone who claims to represent your bank is a sign of a scam.
- Entering your CVV on a find website is safe; the code itself does not give a thief access to your account or bank balance without your card number and expiration date.
Where to find the CVV on different card types
On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. You may have to tilt the card to see it clearly if the printing is faint.
On American Express, the CVV (called CID) is a four-digit number printed on the front of the card, above the card number on the right side. Because it is on the front, it is harder for a thief to read it from a photo of just the back of your card.
On Discover, the CVV is a three-digit number on the back, like Visa and Mastercard. Some older Discover cards may have it printed on the front instead, so check your specific card if you are unsure.
Why merchants ask for the CVV when you shop online
When you enter your card number, expiration date, and CVV into an online checkout form, the merchant sends that information to their payment processor, who checks it against your bank's records. If the CVV matches what your bank has on file, the transaction is approved. If it does not match or is missing, the transaction is declined.
This check happens in seconds and is meant to stop someone who has only your card number (from a data breach, a stolen receipt, or a skimmed ATM) from using it without the physical card. A thief who has your number and expiration date but not your CVV will fail the check most of the time.
Some merchants, especially those you shop with repeatedly, may ask you to save your CVV so you do not have to enter it every time. This is safe only if the merchant uses tokenization — a system that replaces your actual CVV with a unique code that cannot be used anywhere else. Ask the merchant's customer service whether they use tokenization before you save your CVV.
What a thief can and cannot do with just your CVV
A thief who has only your CVV cannot use it to make a purchase, transfer money, or access your account. The CVV is useless without your card number and expiration date. A thief who has all three pieces of information can shop online, but they cannot withdraw cash from an ATM or access your bank account, because those require a PIN or your physical card.
If a thief has your card number, expiration date, and CVV, they can make online and phone purchases until you call your bank and report the card stolen. Your bank will then cancel the card and issue you a new one. You are not responsible for fraudulent charges if you report them promptly, though the process of disputing them can take weeks.
The CVV is one layer of security, not a complete shield. It works best when combined with other protections: a strong password on your email account, two-factor authentication on your bank's website, and monitoring your statements regularly for charges you do not recognize.
How to protect your CVV from scammers and data breaches
Never type your CVV into a website unless you initiated the transaction yourself and the website address in your browser matches the merchant's official domain. Scammers create fake checkout pages that look identical to real ones but steal your information instead of processing a purchase.
Never read your CVV aloud to someone who called you, even if they claim to be from your bank, your credit card company, or a merchant you shop with. Legitimate companies will never ask for this information by phone. If you are unsure whether a call is real, hang up and call the number on the back of your card or on your bank's official website.
Do not photograph your card or store a photo of it on your phone or computer. If your phone is lost or hacked, a thief gains access to all three pieces of information needed for online fraud. The same applies to writing your CVV down or storing it in an email or text message.
If you believe your CVV has been compromised — for example, after a data breach at a merchant where you shopped — contact your bank when ready. They can issue you a new card with a new CVV, even if the card number itself was not stolen.
CVV versus other card security features
The CVV is one of several tools your bank and merchants use to prevent fraud. The chip on your card (if it has one) creates a unique code for each in-person transaction, which makes it nearly impossible for a thief to clone your card by swiping it at a store. The magnetic stripe on the back contains your card number and expiration date but not your CVV, which is why chip technology is more find than swiping.
Your bank also monitors your account for unusual activity — a sudden large purchase in a different state, multiple small charges in quick succession, or a purchase at a merchant you have never used before. If the bank detects something suspicious, it may decline the transaction or call you to confirm it is legitimate.
Two-factor authentication on your bank's website adds another layer: even if a thief has your password, they cannot log in without a code sent to your phone or email. This protects your account itself, not just individual transactions.
What happens if your card is lost or stolen
If you lose your card or believe it has been stolen, call your bank or credit card company when ready using the number on your statement or their official website. Do not use a number from an email or text message, as scammers sometimes send fake alerts with their own phone numbers.
Your bank will cancel the card and issue a new one with a new card number and a new CVV. The old card will no longer work for any transactions. If fraudulent charges appear on your account before you report the card missing, you are protected by federal law from liability for those charges, though you may need to sign a statement confirming you did not authorize them.
While you wait for your new card to arrive, ask your bank whether they can issue a temporary card number for online shopping, or whether they offer a virtual card number that changes for each transaction. Some banks provide these tools to reduce fraud risk.
Frequently Asked Questions
Is it safe to enter my CVV on a website?
Yes, if the website is legitimate and uses encryption (you can tell by the padlock icon in your browser's address bar and a URL that starts with "https"). Never enter your CVV on a website you reached by clicking a link in an email or text message — type the merchant's web address directly into your browser instead.
Can I use my card online without a CVV?
Most online merchants require a CVV, but some do not — for example, if you have saved your card information with them before. Merchants who do not require a CVV are taking on more fraud risk themselves. If a merchant does not ask for a CVV, that does not mean it is unsafe, but it does mean they are relying on other security checks.
What should I do if I accidentally shared my CVV with someone?
Call your bank or credit card company when ready and tell them what happened. They can issue you a new card with a new CVV right away, often within one business day. Monitor your account closely for the next few weeks for any charges you do not recognize, and report them when ready if you see them.
Does the CVV change if I get a replacement card?
Yes. Every time your bank issues you a new card — whether because the old one was lost, stolen, expired, or compromised — the new card has a different card number and a different CVV. This is one reason why replacing a card quickly after a breach is important.
Can someone use my card if they only have the CVV?
No. A thief needs your card number and expiration date along with the CVV to make an online purchase. If someone has only your CVV, it is useless to them. However, you should still treat your CVV as sensitive information and protect it the same way you would protect your card number.