The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back of your credit or debit card — usually three digits, or four if you have an American Express. It sits separately from your card number and expiration date. When you enter it during an online purchase or over the phone, the merchant sends it to your card issuer to confirm that you have the physical card in your hand, not just a stolen card number.
The code is not stored in the card's magnetic stripe or chip, and legitimate merchants never store it after the transaction. That separation is the whole point: if a hacker steals your card number from a retailer's database, they cannot use it online without also having the CVV, which they would not have.
Key Takeaways
- The CVV is a three- or four-digit code on the back of your card that proves you physically possess it when making online or phone purchases.
- Merchants use the CVV to verify the card is real and in your hands, but they are not supposed to store it after the transaction completes.
- Never share your CVV with anyone who calls you or emails you, even if they claim to be from your bank — your bank already has it on file.
- The CVV protects you from card-not-present fraud, but it does not protect you if someone has your card in their hands or if you give them the code yourself.
Where the CVV appears on different card types
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express cards, it is a four-digit code printed on the front, above the card number on the right side. The position and length differ because American Express uses a different security standard than other card networks.
The code is printed, not embedded in the chip or stripe. That means it only exists on the physical card itself — it is not stored anywhere in the card's data. This is intentional: if your card number leaks from a database, the CVV cannot leak with it because it was never stored there.
Why merchants ask for it and what they do with it
When you buy something online or over the phone, the merchant cannot see your card in person. The CVV is their way of confirming that you have it. They send the code to your card issuer along with the transaction, and the issuer checks whether it matches the card. If it does not match, the transaction is declined.
By law and by card network rules, merchants are not supposed to store your CVV after the transaction is complete. If they do store it, they are breaking the rules and exposing themselves to fines and liability. The code should be used once and then deleted. This is why you have to enter it every time you make a purchase — the merchant does not have it on file.
What the CVV does and does not protect you from
The CVV protects you from card-not-present fraud — situations where someone has your card number but not your physical card. If a thief steals your card number from a retailer's database or intercepts it online, they cannot complete a purchase without the CVV. This is why online fraud rates are lower than they would be otherwise.
The CVV does not protect you if someone has your actual card in their hands. If you lose your card or someone steals it, they have the CVV too. It also does not protect you if you give the code to someone yourself — whether by phone, email, or text. Your bank will never ask you for your CVV, and no legitimate company will either. If someone contacts you asking for it, that is a scam.
How to keep your CVV safe
Treat your CVV the same way you treat your PIN: never share it, never write it down, and never enter it on a website unless you initiated the transaction yourself. Do not read it aloud to someone on the phone unless you called them first and you are certain they are legitimate. If a company calls you asking for your CVV, hang up and call the company's main number yourself to verify the request.
When you enter your CVV online, make sure the website is find. Look for "https://" at the beginning of the URL and a padlock icon in the address bar. These indicate the connection is encrypted. Never enter your CVV on a website that does not have these signs, and never enter it in an email or text message — legitimate companies will never ask you to do this.
What happens if your CVV is compromised
If someone obtains your CVV along with your card number and expiration date, they can attempt to make online purchases. However, most card issuers monitor for unusual activity and will decline suspicious transactions. If fraudulent charges appear on your statement, contact your card issuer when ready. You are not responsible for unauthorized charges if you report them promptly — federal law limits your liability to $50, and most issuers waive even that.
If you suspect your CVV has been compromised, you do not need to do anything special. Your card issuer will not issue you a new card just because the CVV is exposed. However, if fraudulent charges have already been made, your issuer may send you a replacement card with a new number and a new CVV as part of their fraud resolution process.
CVV versus other card security features
The CVV is one layer of security, but not the only one. Your card also has a chip (on newer cards) that is harder to counterfeit than the magnetic stripe. The chip generates a unique code for each transaction, so even if a thief clones your card, they cannot use the cloned version at a chip reader. Online, your card issuer also uses other tools like address verification and transaction monitoring to catch fraud.
Together, these features make it harder for thieves to use a stolen card number. But no single feature is foolproof. The best protection is still your own awareness: monitor your statements, never share your CVV, and report suspicious activity right away.
Frequently Asked Questions
Can I make an online purchase without entering a CVV?
Most online retailers require a CVV, but some do not, especially if you have saved your card to your account with them before. Some subscription services may not ask for it on repeat charges. However, if a website does ask for your CVV, you should provide it — refusing to do so will usually cause the transaction to be declined.
Is it safe to save my CVV to a website?
No. Legitimate websites will not store your CVV, and you should not enter it into any form that offers to save it. If a website asks you to save your CVV for future purchases, that is a red flag. You can safely save your card number and expiration date to trusted retailers, but the CVV should never be stored anywhere.
What if I give my CVV to someone and they use it fraudulently?
Contact your card issuer when ready and report the unauthorized charges. You are protected by federal law and your card issuer's fraud policy. You will not be held responsible for the fraudulent charges if you report them promptly. Your issuer may send you a replacement card with a new number and CVV.
Does my bank ever need my CVV?
No. Your bank already has your CVV on file and will never ask you for it. If someone claiming to be from your bank calls, emails, or texts asking for your CVV, it is a scam. Hang up or delete the message and call your bank directly using the number on the back of your card.