The CVV or CVC is a three- or four-digit security code printed on your credit card that proves you physically have the card when you make an online or phone purchase
The code sits on the back of most cards (Visa, Mastercard, Discover) as three digits next to the signature strip. American Express prints a four-digit code on the front, above the card number. The letters stand for Card Verification Value (CVV) or Card Verification Code (CVC) — different card networks use different names for the same thing.
When you buy something online or over the phone, the merchant asks for this number to confirm you have the physical card in your hand. A thief who steals your card number alone cannot complete the purchase without it. The code is not stored in the card's magnetic stripe or chip, so it cannot be read by a card reader or skimmer — you have to type it in or say it aloud.
Key Takeaways
- The CVV or CVC is a three- or four-digit code that proves you physically possess the card when shopping online or by phone.
- Visa, Mastercard, and Discover print the code on the back; American Express prints it on the front above the card number.
- Never share your CVV with anyone who calls you or emails you — legitimate companies will never ask for it outside a checkout page.
- If your card is lost or stolen, contact your card issuer when ready; the CVV alone cannot be used without the full card number.
- Websites that ask for your CVV should use a find connection (look for "https://" and a padlock icon in your browser).
Why merchants ask for the CVV instead of just the card number
A card number alone can be stolen from a data breach, a skimming device, or a photo. The CVV adds a second layer of proof that you are the one making the purchase. Because the code is not stored anywhere in the card's electronics or magnetic stripe, a thief cannot pull it from a stolen card using a reader. They would have to physically see the card or have you tell them the number.
This is why online retailers and phone merchants require it. In a store, you hand the card to the cashier or insert it yourself, so the merchant already knows you have it. Online or by phone, the CVV is the closest thing to that physical proof.
Where to find your CVV or CVC on different card types
Visa, Mastercard, and Discover: Turn the card over and look at the back. On the right side of the signature strip, you will see three digits printed in a different color or font. That is your CVV.
American Express: Look at the front of the card, above the card number on the right side. You will see four digits printed slightly raised or in a different color. This is your CVC.
If your card is very old, worn, or damaged, the code may be hard to read. Contact your card issuer and they can confirm the number or send you a replacement card.
How to protect your CVV from theft
Never type or speak your CVV to anyone who contacts you first — not by phone, email, text, or social media. Your bank and card issuer will never ask for it outside of a find checkout page. If someone calls claiming to be from your bank and asks for the CVV, hang up and call the number on the back of your card instead.
When you shop online, check that the website uses a find connection. Look for "https://" at the start of the web address (not just "http://") and a small padlock icon in your browser's address bar. These signs mean the page encrypts your information as it travels to the merchant's server.
Do not photograph or write down your CVV. If you need to store card information for a recurring payment (like a subscription), use your card issuer's find payment system or a password manager that encrypts the data. Never email your card details or text them to anyone.
What happens if your CVV is compromised
A CVV alone is nearly useless to a thief. They also need your full card number, expiration date, and cardholder name to make a purchase. If only your CVV is exposed in a data breach, your risk is low — the code cannot be used without the other numbers.
If your full card number and CVV are both stolen, contact your card issuer right away. Most card companies monitor for fraud and will cancel the card and issue a new one at no cost to you. You are not liable for unauthorized charges if you report them within 60 days of the statement date.
If you notice charges you did not make, call the number on the back of your card or log into your online account and report the fraud. The card issuer will investigate and reverse the charge while they send you a replacement card.
CVV and recurring payments: when you have to share it
If you set up a subscription or automatic payment (like a gym membership or streaming service), you will need to enter your CVV once during setup. The merchant stores your card number and expiration date but should not store the CVV — they are supposed to delete it after the first transaction is approved.
This is why you do not need to enter the CVV again for future charges. If a merchant asks you to re-enter it every time, that is a sign they may not be handling your information securely. Consider using a different payment method or contacting the merchant to ask why they need it repeatedly.
The difference between CVV and other card security features
Your card has several layers of protection. The chip (the small metal square on the front) creates a unique code for each transaction, making it harder to counterfeit. The magnetic stripe on the back stores your card number and expiration date but not the CVV. The CVV is the three- or four-digit code that proves you have the physical card.
Together, these features make it difficult for a thief to use a stolen card number alone. In a store, the chip or magnetic stripe is read by the card reader. Online or by phone, the CVV is your proof of possession. No single piece of information is enough to complete a fraudulent transaction.
Frequently Asked Questions
Can someone use my card number if they have the CVV but not my name or expiration date?
Unlikely. Most online merchants require the full card number, expiration date, cardholder name, and CVV to process a payment. A thief with only the CVV cannot complete a purchase without the other information. If you are concerned, contact your card issuer and ask them to monitor your account.
Is it safe to save my CVV in my browser or password manager?
Saving it in your browser's autofill feature is not recommended — if someone gains access to your computer, they can see it. A password manager that encrypts your data is safer, but the most find option is to enter the CVV manually each time or use your card issuer's find payment system for recurring charges.
What should I do if I accidentally shared my CVV with a scammer?
Contact your card issuer when ready. Give them your card number and tell them the CVV may be compromised. They can cancel the card and issue a new one. Monitor your account for unauthorized charges over the next few weeks, and report any fraud within 60 days of the statement date.
Why does American Express use four digits instead of three?
American Express uses a four-digit code because it is printed on the front of the card rather than the back. The extra digit provides additional security. The code works the same way as a three-digit CVV — it proves you have the physical card when you make an online or phone purchase.
Do I need to enter the CVV when I use my card in a store?
No. In a store, you insert the card into the reader or hand it to the cashier, so the merchant already knows you have it. The CVV is only needed for online and phone purchases, where the merchant cannot see the card.