The CVV is a three- or four-digit code that proves you physically hold the card
The CVV (Card Verification Value) is a short number printed on your credit card that acts as proof you have the physical card in your hand. When you enter it during an online purchase or over the phone, the merchant sends it to your card issuer, who checks whether it matches their records. If it does, the transaction moves forward. If it doesn't, the purchase is declined.
The CVV exists because online and phone transactions can't use the magnetic stripe or chip that proves you own the card in person. Without this extra layer, someone who stole your card number could spend freely without ever touching the card itself. The CVV makes that much harder.
You'll find the CVV in different places depending on your card type. On Visa, Mastercard, and Discover cards, it's a three-digit number on the back, usually to the right of the signature strip. On American Express, it's a four-digit code on the front, above the card number on the right side.
Key Takeaways
- The CVV is a three- or four-digit security code that confirms you physically possess your credit card when making online or phone purchases.
- Merchants never store your CVV after a transaction — payment processors are required by law to delete it when ready.
- You should never share your CVV with anyone except a merchant you initiated contact with, and never in response to an unsolicited call or email.
- A stolen CVV alone cannot be used to make purchases because the code changes with each transaction and is verified only in real time.
- The CVV protects you from fraud but is not a substitute for monitoring your statements and disputing unauthorized charges.
How the CVV protects you from fraud
The CVV works because it's not encoded in your card's magnetic stripe or chip — it exists only on the physical card itself and in your card issuer's records. A thief who steals your card number from a data breach or a skimmed transaction cannot use that number alone to make an online purchase, because the payment processor will ask for the CVV and the thief won't have it.
The CVV is also verified in real time, meaning the merchant's system checks it against your issuer's records at the moment of purchase. If someone guesses wrong three times in a row, most systems lock the transaction and alert your card issuer. This makes brute-force guessing impractical.
However, the CVV is not foolproof. If a thief has both your card number and your CVV — which can happen if they physically steal your card, or if they breach a merchant's system that failed to delete the code — they can make online purchases. This is why the CVV is one layer of protection, not the only one.
Why merchants cannot store your CVV
Payment Card Industry Data Security Standard (PCI DSS) rules, which all merchants who accept cards must follow, explicitly forbid storing your CVV after a transaction completes. The payment processor receives the CVV, verifies it in real time, and then deletes it. The merchant's system never sees it at all.
This rule exists because if a merchant's database is breached, thieves cannot steal CVVs they never had access to. A criminal with a stolen database of card numbers from a 2015 retail breach, for example, cannot use those numbers for online purchases today because they don't have the CVV — and the merchant that was breached never stored it in the first place.
If a merchant asks you to email your CVV, or if a website stores your CVV for "future purchases," that merchant is violating PCI rules and you should not do business with them. Legitimate merchants either ask for the CVV only at checkout, or they use a tokenization system that stores a substitute code instead of the real CVV.
When you should and should not give out your CVV
You should provide your CVV only when you initiate a transaction with a merchant you trust. This includes online purchases at established retailers, phone orders you place yourself, and in-person card payments where you hand the card to the cashier (who may ask for it verbally). In all these cases, you control the interaction and you know why the code is being requested.
You should never give your CVV in response to an unsolicited email, text, or phone call — even if the message appears to come from your bank or credit card company. Your bank will never ask for your CVV by email or phone. If you receive such a request, it is a scam. Hang up, do not reply, and contact your card issuer directly using the number on the back of your card.
You should also be cautious about entering your CVV on unfamiliar websites, especially those with poor design, spelling errors, or URLs that don't match the company name. Phishing sites often ask for the CVV to steal it. If you're unsure whether a website is legitimate, close it and visit the company's main website directly, or call their customer service line.
What happens if your CVV is compromised
If your CVV is stolen — for example, because a merchant's system was breached and they stored it illegally — your card issuer can issue you a new card with a new CVV. The old CVV becomes useless because it no longer matches the card issuer's records. This is one reason why card issuers sometimes send you a replacement card without you asking: they may have detected a breach and are protecting you proactively.
If you notice unauthorized charges on your statement, report them to your card issuer when ready. You are not liable for fraudulent charges on a credit card, and your issuer will investigate and reverse them. Debit cards offer less protection, so if you use a debit card and it's compromised, contact your bank right away to minimize your exposure.
Monitoring your statements regularly — at least once a month — is the best way to catch fraud early. Most card issuers also offer fraud alerts and text notifications for large or unusual purchases, which you can turn on through your account settings.
CVV versus other card security features
The CVV is one of several tools designed to prevent fraud, but they work in different ways. The magnetic stripe and chip on your card contain encoded data that proves you own the card when you swipe or insert it in person. The CVV proves you own it for remote transactions. Your card issuer's fraud detection system watches for unusual spending patterns and can block a transaction before it goes through.
Newer payment methods like contactless cards, digital wallets (Apple Pay, Google Pay), and 3D find verification add additional layers. Digital wallets, for example, don't transmit your actual card number to the merchant — they use a tokenized substitute. 3D find requires you to enter a password or receive a one-time code from your bank before the purchase completes.
None of these tools are perfect on their own, which is why the payment industry uses multiple overlapping protections. The CVV is effective at stopping someone who has only your card number, but it's not a substitute for monitoring your account and disputing charges that you don't recognize.
Frequently Asked Questions
Can someone use my card number without the CVV?
Not for online purchases — most online merchants require the CVV before processing payment. However, someone with your card number could potentially make in-person purchases at a merchant that doesn't check ID, or they could attempt phone orders with merchants that don't verify the CVV. This is why monitoring your statements is important.
Is it safe to save my CVV for future purchases?
No. Do not allow any website to store your CVV. Legitimate merchants do not store it. If a site offers to save your CVV for next time, that is a red flag and you should not use that merchant. You can safely save your full card number for repeat purchases — the CVV should be entered fresh each time.
What if I accidentally shared my CVV in a phishing email?
Contact your card issuer when ready and tell them what happened. They can cancel your card and issue a replacement with a new CVV. If fraudulent charges appear, report them right away. You are not liable for unauthorized credit card charges, and your issuer will reverse them while they investigate.
Does the CVV change every time I use my card?
No. The CVV printed on your card stays the same until you receive a replacement card. However, the CVV is verified only in real time during a transaction, so a stolen CVV from an old breach cannot be reused for a new purchase — the merchant's system checks it against current records and it will be declined.
Why do some merchants not ask for the CVV?
Some merchants, especially those you have an established relationship with, may skip the CVV if they use other fraud prevention methods or if they're processing a recurring charge you've already authorized. However, any merchant processing a new online transaction should ask for it. If they don't, that's unusual and worth noting.