The CVV and CVC are the same thing — a three or four-digit security code on your card
The CVV (Card Verification Value) and CVC (Card Verification Code) are two names for the same number. Visa and Mastercard call it CVV. American Express calls it CVC. It is a short code printed on your card that proves you physically have the card when you make an online or phone purchase — the merchant cannot see it in their system, so they ask you to type it in.
The code sits in a different place depending on your card type. On Visa, Mastercard, and Discover cards, it is a three-digit number on the back of the card, usually to the right of the signature strip. On American Express cards, it is a four-digit number on the front, above the card number on the right side.
This number is not the same as your PIN (the code you enter at an ATM or card reader in a store). It is also not the same as the card number itself. It exists only to verify online and phone transactions.
Key Takeaways
- The CVV or CVC is a three or four-digit code that proves you have the physical card when you shop online or by phone.
- Visa, Mastercard, and Discover print the three-digit code on the back of the card; American Express prints a four-digit code on the front.
- Never share your CVV with anyone except the merchant you are paying, and never type it into a link someone sends you in an email or text.
- If your card is lost or stolen, contact your bank when ready — the CVV alone cannot be used to make purchases without the card number and expiration date.
Why merchants ask for the CVV during online checkout
When you buy something online, the merchant's website collects your card number and expiration date. But they cannot see the CVV — it is not stored in their payment system. By asking you to type it in, they confirm that you have the physical card in your hand right now. This is a basic fraud check that stops someone who has only your card number (from a data breach or a stolen receipt) from making a purchase.
The CVV is not a perfect security measure. It is one layer among several. Your bank also watches for unusual spending patterns, and many merchants now use additional checks like address verification or 3D find (a system that sends you a code to confirm the purchase). But the CVV is the first line of defense for online shopping.
Where to find your CVV or CVC on different card types
The location matters because you need to know where to look when a checkout page asks for it. Here is where each card brand prints the code:
| Card Brand | Code Name | Number of Digits | Location |
|---|---|---|---|
| Visa | CVV | 3 | Back of card, right side of signature strip |
| Mastercard | CVV | 3 | Back of card, right side of signature strip |
| Discover | CVV | 3 | Back of card, right side of signature strip |
| American Express | CVC | 4 | Front of card, above the card number on the right |
If you cannot find the code on your card, log into your bank's website or app — most banks display the CVV in your account settings. Never call a number from the back of your card and give the CVV to someone who calls you. Banks do not ask for this information over the phone.
How to protect your CVV from fraud
The CVV is designed to protect you, but only if you keep it private. Never type it into a link someone sends you in an email or text message, even if the message looks like it came from your bank. Scammers create fake checkout pages that look identical to real ones, and they use urgent language ("Confirm your card now") to rush you into entering the code.
Real banks and merchants never ask for your CVV in an email, text, or phone call. If someone contacts you asking for it, hang up or delete the message. If you are unsure whether a message is real, go directly to your bank's website or app instead of clicking any link in the message.
When you shop online, make sure the website address starts with "https://" (the "s" means it is encrypted) and look for a padlock icon in the address bar. These signs mean your information is being sent securely. Avoid shopping on public WiFi networks, where hackers can intercept your data more easily.
What happens if someone gets your CVV
A thief who has only your CVV cannot make a purchase — they also need your card number and expiration date. If someone has all three pieces of information, they can attempt an online purchase, but your bank watches for fraud and may block the transaction or call you to confirm it.
If you notice a charge you did not make, contact your bank when ready. Most banks have a fraud department that can reverse unauthorized charges within a few days. You are not responsible for fraudulent charges if you report them quickly. Your bank will issue you a new card with a new CVV.
If your card is physically lost or stolen, call your bank right away to cancel it. Do not wait to see if charges appear. The faster you report it, the faster your bank can stop any fraudulent use.
CVV and online shopping safety
The CVV is one reason why online shopping is generally safer than handing your card to a cashier in a store. In a store, someone can write down your full card number and expiration date from the front of the card. Online, the CVV requirement means you have to be present (or at least have the card) to complete the purchase.
That said, the CVV is not foolproof. Criminals sometimes steal card information through data breaches at large retailers, and they may try to use that information at smaller merchants who do not have strong fraud detection. This is why many banks now offer virtual card numbers — temporary card numbers that work for one purchase or one merchant and expire after that. If your bank offers this feature, use it for shopping at unfamiliar websites.
Frequently Asked Questions
Can someone use my card if they only have the CVV?
No. They also need your card number and expiration date. If they have all three, they can attempt an online purchase, but your bank's fraud detection may block it. Report any unauthorized charge to your bank when ready.
Is it safe to type my CVV into a website?
Yes, if the website is legitimate and uses encryption (look for "https://" in the address bar and a padlock icon). Never type your CVV into a link someone sent you in an email or text, even if it looks official. Go directly to the merchant's website instead.
What should I do if I accidentally shared my CVV with someone?
Contact your bank right away. They can monitor your account for fraud and issue you a new card with a new CVV if needed. If the person also has your card number and expiration date, ask your bank to cancel the card when ready.
Why does American Express use four digits instead of three?
American Express uses a four-digit code for additional security. The extra digit makes it slightly harder for fraudsters to guess the code, though the real protection comes from your bank's fraud detection systems, not the code length itself.
Do I need to memorize my CVV?
No. You only need to enter it during checkout. Never write it down or save it in your phone. If you forget it, you can look at your physical card or log into your bank's app to find it.