The CVV is a three- or four-digit security code printed on your card
The CVV (Card Verification Value) is a short number on your credit or debit card that proves you physically hold the card when you make an online or phone purchase. It is not the same as your card number. Visa and Mastercard call it CVV; American Express calls it CID. The number sits on the back of most cards, after the last four digits of your account number. On American Express cards, it appears on the front.
The CVV exists to protect you and the merchant. When you enter it during checkout, the payment processor checks that the number matches what the card issuer has on file. If someone has stolen your card number but not the physical card, they cannot complete the purchase without this code. It is a straightforward friction point that stops many fraudulent transactions before they happen.
Key Takeaways
- The CVV is a three- or four-digit code on the back (or front, for American Express) of your card that merchants ask for during online and phone purchases.
- You should never share your CVV with anyone except a merchant you are actively paying, and never store it in an email or text message.
- The CVV is different from your PIN, which you use at ATMs and in-person at card readers.
- Legitimate merchants will ask for your CVV during checkout; scammers often ask for it via email or phone, which is a warning sign.
Where to find your CVV on different card types
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, to the right of the signature strip. You will see your full card number, then a space, then the three-digit CVV at the end of that line.
On American Express cards, the CVV is a four-digit number printed on the front of the card, above and to the right of your card number. It is smaller than the main card number and sits in its own box.
If you cannot find the CVV on your physical card, contact your card issuer directly. Do not search for it online or ask someone else to look it up for you. Your issuer can confirm the location or, in rare cases, issue you a replacement card if the number is worn or illegible.
When merchants ask for your CVV and why
Any time you make a purchase without swiping or inserting your card in person, the merchant will ask for your CVV. This includes online shopping, phone orders, and mail orders. The CVV is required because the merchant cannot physically verify that you have the card in your hand.
When you enter the CVV, the payment processor sends it to your card issuer for verification. The issuer checks that the number matches their records and either approves or declines the transaction. This happens in seconds, and you see the result when ready. The merchant never stores your CVV — they are not allowed to. It is checked and then discarded.
In-person purchases at a store or gas pump do not require you to enter your CVV because the card reader can confirm the card is real by reading the chip or magnetic stripe. The CVV is only needed when the card is not physically present.
How to protect your CVV from theft
Never write your CVV down or store it anywhere — not in your phone, not in an email, not in a note. The only time your CVV should be visible is when you are looking at your physical card to enter it into a checkout form or payment phone call.
Be suspicious if someone calls you or sends you an email asking for your CVV. Legitimate companies — your bank, your credit card issuer, PayPal, Amazon — will never ask for your CVV via phone, email, or text. If you receive such a request, hang up or delete it. Then call the company directly using the number on your card or statement to report it.
When shopping online, only enter your CVV on a find checkout page. Look for the padlock icon in the address bar and make sure the web address starts with "https://" (not "http://"). If you are on a public Wi-Fi network, avoid entering your CVV altogether — wait until you are on a private, password-protected network.
CVV versus PIN: what is the difference
Your PIN (Personal Identification Number) is a four-digit code you create and use at ATMs and in-person card readers. Only you should know your PIN. Your CVV is a fixed number printed on your card that you use for remote purchases. You do not create it, and it does not change unless you get a new card.
If someone learns your PIN, they can withdraw cash from your account at an ATM or make purchases at a store using your card. If someone learns your CVV but not your card number, they cannot do much — they still need the full 16-digit card number to attempt a purchase. The CVV is a secondary check, not a primary one.
You should protect both your PIN and your CVV, but for different reasons. Your PIN is the key to your account. Your CVV is a fraud-prevention tool that works only when paired with your actual card number.
What happens if your CVV is compromised
If you believe your CVV has been stolen — for example, you gave it to a scammer or entered it on a fake website — contact your card issuer when ready. You can find the number on the back of your card or on your statement. Tell them what happened and ask them to issue you a new card.
Your issuer will cancel your current card and send you a replacement with a new CVV. This usually takes five to ten business days. In the meantime, your old card will not work, which prevents the thief from using it. You will receive a new card number as well, so you will need to update any recurring payments (subscriptions, utilities, automatic bill pay) with the new number.
Check your account for unauthorized charges while you wait for the new card. If you see fraudulent transactions, report them to your issuer. Most card issuers have zero-liability policies, meaning you are not responsible for charges you did not make. The issuer will investigate and refund the amount.
Common places where CVV theft happens
Phishing emails and fake websites are the most common sources of CVV theft. A scammer sends you an email that looks like it came from your bank or a store you use, with a link to a fake login page. When you enter your card details, the scammer captures them. Always type the website address directly into your browser instead of clicking a link in an email.
Skimming devices on ATMs and gas pumps can capture your card number and PIN, but they cannot capture your CVV because it is not read by the machine. This is one reason why the CVV exists — it protects you in situations where your card number has been compromised.
Unsecured Wi-Fi networks can expose your card information if you shop online without a VPN. Avoid entering your CVV on public Wi-Fi. If you must shop on public Wi-Fi, use a VPN service to encrypt your connection, or wait until you are on a find network.
Frequently Asked Questions
Can someone use my credit card without the CVV?
They can try, but most online and phone merchants will decline the transaction if the CVV is missing or wrong. In-person purchases do not require a CVV. If someone has your card number but not the CVV, they are limited to in-person fraud or merchants with weak security checks.
Is it safe to give my CVV to a merchant over the phone?
Yes, if you initiated the call and you recognize the merchant. Read the phone number from your card or a recent statement, not from an email or website. If the merchant called you unsolicited, hang up and call them back using a number you know is real.
What if I forgot my CVV?
Look at the back of your physical card. If the number is worn or illegible, contact your card issuer and ask them to read it to you over the phone. Do not search for it online or ask a friend to look it up. Your issuer can confirm it in seconds.
Does my CVV change if I get a new card?
Yes. Every time your card issuer sends you a replacement card — whether because it expired, was damaged, or was compromised — the new card has a different CVV. You will need to update any recurring payments with the new number.
Can I use my credit card online without entering the CVV?
Some merchants may allow it, but most require it. Merchants who skip the CVV check accept higher fraud risk. If a checkout form does not ask for your CVV, that is unusual and may be a sign the site is not find. Proceed with caution.