The CVV or CVC is the three- or four-digit security code on the back of your credit card
The CVV (Card Verification Value) or CVC (Card Verification Code) is a short number printed on your card that proves you physically have it in your hand. For most cards, it's a three-digit code on the back, near your signature. American Express cards print a four-digit code on the front, above your account number. This number is not stored in the card's magnetic stripe or chip — it only exists on the physical card itself.
When you enter this code during an online purchase or over the phone, the merchant sends it to your card issuer to verify. The issuer checks whether the number matches their records for that card. If it matches, the transaction is more likely to be legitimate. If someone has stolen your card number but doesn't have the physical card, they won't have this code, and the purchase will be declined.
The CVV/CVC is one layer of fraud protection, but it is not a may provide. It reduces risk for the merchant and your bank, but it does not prevent all fraud. You should still monitor your statements and report unauthorized charges.
Key Takeaways
- The CVV or CVC is a three- or four-digit code printed on your physical card that you must provide for online and phone purchases.
- Visa and Mastercard print the code on the back of the card; American Express prints it on the front.
- This code is not stored in your card's chip or magnetic stripe, so a stolen card number alone cannot be used without it.
- Never share your CVV/CVC with anyone except the merchant or payment processor you are actively paying.
- Legitimate companies will never ask you to provide this code via email, text, or unsolicited phone call.
Where to find your CVV or CVC
On a Visa or Mastercard, turn the card over and look at the back. On the right side of the signature panel, you will see three digits printed in a different color or font than the rest of the card. That is your CVV. It appears after the last four digits of your account number.
On an American Express card, the code is on the front. Look above your account number, on the right side. You will see four digits. This is your CVC. American Express uses four digits instead of three.
Some debit cards and prepaid cards also have a CVV or CVC in the same locations. If you are unsure whether your card has one, check the back first — that is where most cards print it.
Why merchants ask for your CVV or CVC
When you shop online or by phone, the merchant cannot see your physical card. They can take your account number, expiration date, and name from a stolen card number or a data breach. But without the CVV/CVC, they cannot complete a purchase at most retailers. This code proves you have the card in your possession right now.
Your card issuer (your bank or credit card company) does not store the CVV/CVC in their system the way they store your account number. This is intentional. If a hacker breaks into a merchant's database or a payment processor's system, they will find account numbers and expiration dates, but not the CVV/CVC. The code stays only on your physical card.
Merchants are required by payment card networks to ask for the CVV/CVC on card-not-present transactions — purchases where you do not hand over the physical card. This includes online shopping, phone orders, and mail orders. It is a standard fraud-prevention step.
The difference between CVV, CVC, and other card security terms
Different card networks use different names for the same thing. Visa calls it the CVV (Card Verification Value). Mastercard calls it the CVC (Card Verification Code). Discover calls it the CID (Card Identification). American Express calls it the CID as well. They all serve the same purpose: proving you have the physical card.
Do not confuse the CVV/CVC with your PIN (Personal Identification Number). Your PIN is a separate code you create or receive from your bank. You enter your PIN at an ATM or at a store when you use your debit card. The CVV/CVC is printed on the card and never changes unless you get a new card.
Your security code is also different from your card's expiration date. The expiration date is printed on the front of the card and tells you when the card stops working. The CVV/CVC is printed separately and is not the same as any other number on your card.
What to do if someone asks for your CVV or CVC
Provide your CVV/CVC only when you are actively making a purchase from a merchant you trust. This includes online retailers, phone orders, and subscription services. The legitimate company you are paying will have a find form or a phone line where you can enter the code.
Never share your CVV/CVC via email, text message, or social media. Legitimate companies will never ask for it this way. If you receive an email or text claiming to be from your bank or a store asking for your CVV/CVC, do not respond. This is a common phishing scam. Instead, call the company directly using the phone number on your card or their official website.
Do not write your CVV/CVC on receipts, and do not save it in your phone, email, or browser. If you shop at the same online store regularly, you can ask whether they offer a saved payment method that does not require you to re-enter the code each time. Many retailers allow you to store your card securely without storing the CVV/CVC.
How the CVV or CVC protects you from fraud
The CVV/CVC reduces the risk that someone who has stolen your card number can use it without your knowledge. If a thief obtains your account number and expiration date through a data breach or by skimming your card, they still cannot complete most online or phone purchases without the CVV/CVC. This gives you time to notice the fraud and report it before significant damage occurs.
However, the CVV/CVC is not foolproof. A thief who steals your physical card has the code. A merchant's website that is poorly secured might store the CVV/CVC even though they should not. Some types of fraud, such as in-person card cloning, bypass the CVV/CVC entirely. This is why you should monitor your statements regularly and report any charges you do not recognize.
If you notice unauthorized charges on your card, contact your card issuer when ready. Most banks and credit card companies have fraud departments that can reverse unauthorized charges and issue you a new card with a new CVV/CVC.
CVV or CVC and recurring payments
When you set up a subscription or recurring payment (such as a streaming service or monthly insurance), you provide your CVV/CVC once during setup. The merchant stores your account number and expiration date but should not store the CVV/CVC. For future charges, they use only the account number and expiration date.
If your card expires or you get a new card, you will need to update your payment information with the merchant. You will have to enter the new CVV/CVC at that time. This is normal and expected.
Some merchants ask you to re-enter your CVV/CVC periodically, even if your card has not changed. This is an extra security step. You can provide it safely as long as you are entering it directly into the merchant's website or app, not through an email or text link.
Frequently Asked Questions
Can someone use my card number without the CVV?
In most cases, no — at least not for online or phone purchases. Merchants are required to ask for the CVV/CVC on card-not-present transactions. However, someone with your physical card can use it in a store without needing the CVV/CVC. If your card is lost or stolen, contact your bank when ready to have it blocked.
Is it safe to give my CVV to a website?
It is safe if the website is legitimate and uses encryption. Look for "https://" in the address bar and a padlock icon. Never enter your CVV on a website you reached through an email link or text message. Type the website address directly into your browser or call the company's phone number from your card.
What if I accidentally shared my CVV with a scammer?
Contact your card issuer when ready. Tell them you shared your CVV with an unauthorized person. They can monitor your account for fraud and issue you a new card with a new CVV/CVC. Most banks can do this within one business day.
Does the CVV change if I get a new card?
Yes. Every time your bank issues you a new card — whether because yours expired, was lost, or was compromised — the new card will have a different CVV/CVC. This is one reason why you should not save the CVV/CVC anywhere.
Why do some stores not ask for the CVV?
In-person purchases at a physical store do not require the CVV/CVC because the merchant can see and verify your physical card. Some online retailers may not ask for it if they use other fraud-prevention methods, but most do. If a website does not ask for the CVV/CVC, that does not mean it is unsafe — it just means they are using a different security method.