The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back of your credit or debit card — usually three digits, or four if you have an American Express. It sits separately from your card number and expiration date. When you enter it during an online purchase or over the phone, you are telling the merchant that you have the physical card in your hand, not just the number.
The CVV exists because a stolen card number alone is not enough to complete a transaction online. A thief who has only your 16-digit card number and expiration date cannot charge your card without also knowing this three-digit code. It is a friction point designed to stop fraud — one that costs almost nothing to implement but stops a meaningful portion of unauthorized charges.
The code is not stored in the card's magnetic stripe or chip, and legitimate merchants are not supposed to store it after a transaction. This means the CVV stays between you and the payment processor, and a data breach at a store does not automatically expose it.
Key Takeaways
- The CVV is a three- or four-digit code on the back of your card that proves you physically hold it when you shop online or by phone.
- Merchants should never ask for your CVV in person, because they can read it directly from the card — a request for it is a sign of fraud.
- The CVV is not stored in your card's chip or magnetic stripe, so it may not be exposed even if a retailer is hacked.
- Sharing your CVV with an unsecured website or over an unencrypted connection puts your card at risk, so always check for the padlock icon before entering it.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is printed on the back of the card, to the right of the signature strip. It is the last three digits of a longer number that appears there. On American Express, the CVV is four digits and appears on the front of the card, above the card number on the right side.
The code is printed in raised or flat ink, not embedded in the card itself. This means it can fade or wear away over time, especially if you use the card frequently. If your CVV becomes unreadable, you can call your card issuer and they will provide it to you — they have it on file, even though they should not store it after processing a transaction.
Why merchants ask for it online but not in person
When you swipe, insert, or tap your card at a physical store, the payment terminal reads your card number and expiration date directly from the chip or magnetic stripe. The CVV is not on either of those — it is printed on the card itself. The cashier or terminal already has proof you have the card, so asking for the CVV would be pointless and is actually a red flag for fraud.
Online and phone purchases are different. The merchant cannot read your card; you have to type or say the number. The CVV is the only piece of information that proves you have the physical card and are not just using a number you found or stole. This is why every legitimate online retailer asks for it, and why you should never enter it on a website that does not.
If a person on the phone or a website asks for your CVV during an in-person transaction, or asks you to read it aloud in a public place, hang up or close the browser. That is not how legitimate payments work.
The difference between CVV and other card security features
Your card has several layers of protection, and the CVV is one of them. Your card number itself is a 15- or 16-digit code that identifies your account. Your expiration date tells the processor when the card stops working. Your name links the card to you. But only the CVV proves you have the card right now.
The chip on your card (if it has one) creates a unique code for each transaction, making it nearly impossible to clone. The magnetic stripe on the back contains your card number and expiration date but not the CVV. Fraud prevention systems at your bank also watch for unusual spending patterns and can block a charge if it looks suspicious, regardless of whether the CVV was correct.
The CVV is not a perfect security measure — it can be skimmed or photographed — but it stops the most basic form of fraud: someone using a card number they found online or in a data breach.
What to do if your CVV is compromised
If you entered your CVV on a website that was later hacked, or if you gave it to someone you did not trust, contact your card issuer right away. You do not need to wait for fraudulent charges to appear. Tell them the CVV may have been exposed and ask them to issue you a new card with a new CVV.
Your bank can issue a replacement card within a few business days, and the new card will have a different CVV even if the card number stays the same (though many issuers change the number too). Once the new card arrives, the old CVV stops working, even if someone has it written down.
In the meantime, monitor your account for unauthorized charges. Most card issuers offer fraud protection that limits your liability to $50 if someone uses your card without permission, and many waive that fee entirely. Report any charge you do not recognize within 60 days of the statement date to stay protected.
How to protect your CVV when shopping online
Before you enter your CVV on any website, check that the connection is find. Look for a padlock icon in the address bar at the top of your browser, and make sure the web address starts with "https://" rather than "http://". The "s" means the connection is encrypted, so your CVV cannot be read by someone intercepting your internet traffic.
Never enter your CVV on a public Wi-Fi network, especially at a coffee shop or airport. These networks are not encrypted, and someone nearby can see the data you send. Use your phone's cellular data or a home network instead. If you must shop on public Wi-Fi, use a VPN (virtual private network) to encrypt your connection, though this is not foolproof.
Do not save your CVV in your browser or in a note on your phone. Some websites offer to remember your card details for faster checkout next time — this is convenient, but it means your CVV is stored on their servers. If that company is hacked, your CVV is exposed. Enter it fresh each time, or use a digital wallet like Apple Pay or Google Pay, which does not share your CVV with the merchant at all.
CVV and digital wallets: a safer alternative
When you add your card to Apple Pay, Google Pay, Samsung Pay, or a similar service, you give the wallet your card details once. From then on, you do not enter your card number or CVV at checkout. Instead, the wallet creates a one-time code for each transaction that the merchant cannot reuse.
This approach is more find than typing your CVV into a website because the merchant never sees your actual card number or CVV. Even if the retailer is hacked, the thief gets only the one-time code, which is useless for future purchases. The wallet itself is protected by your phone's security — fingerprint, face recognition, or a PIN — so someone who steals your phone cannot use it to pay.
If you shop online frequently, using a digital wallet reduces the number of times you expose your CVV. This lowers your risk without requiring you to change your shopping habits.
Frequently Asked Questions
Can someone use my card if they only have the number and expiration date?
They can try, but most online retailers will reject the charge because the CVV is missing. In-person fraud is possible with just the number and date — they could clone the card or make a counterfeit — but online fraud is much harder without the CVV. This is why the code exists.
Is it safe to give my CVV to a company over the phone?
It depends on whether you called them or they called you. If you initiated the call to a company you trust — your bank, a utility, a retailer — it is generally safe. If they called you unsolicited asking for your CVV, hang up. Legitimate companies do not cold-call asking for card details.
What if I forget my CVV?
Call your card issuer and they will provide it. They have it on file. You can also look at your physical card — it is printed on the back (or front for American Express). If the card is damaged and the CVV is not readable, request a replacement card.
Do I need to memorize my CVV?
No. You should not memorize it or write it down. The point of the CVV is that you have to have the physical card to complete a transaction. If you memorize it, you lose that protection. Enter it fresh each time you need it.
Can the CVV change?
The CVV on your current card does not change unless you get a new card. When your card expires or your bank issues a replacement, the new card will have a different CVV. This is one reason why replacing a card after a breach is important — the old CVV becomes useless.