The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back of your credit or debit card — usually three digits, sometimes four on American Express. It sits separately from your card number and expiration date. When you enter it during an online or phone purchase, you are telling the merchant you have the physical card in your hand, not just someone who memorized your number.
The CVV exists because your card number and expiration date are printed on receipts, visible in photos, and straightforward to steal. The CVV is not printed on receipts and is not stored in the magnetic stripe or chip. A thief who has your number and expiration date cannot complete most online transactions without it. That three-digit code is the difference between a stolen number and a usable stolen card.
Key Takeaways
- The CVV is a three- or four-digit code on the back of your card (or front, on American Express) that merchants request to verify you own the card.
- It is not the same as your PIN — your PIN is for ATMs and in-person transactions, while the CVV is for online and phone purchases.
- Never give your CVV to anyone who calls you or emails you, even if they claim to be from your bank.
- The CVV changes if you get a new card, so old receipts or screenshots do not expose your current card to fraud.
Where to find your CVV on different card types
On Visa, Mastercard, and Discover cards, the CVV is on the back, in the signature panel on the right side. It is the last three digits of a longer number printed there. On American Express, it is on the front, above your card number on the right side, and it is four digits.
If you are looking at your card and see a three-digit number on the back in the signature area, that is your CVV. If you cannot find it, call the number on the back of your card and ask — your bank can tell you what it is without you having to read it aloud.
Why merchants ask for it online but not in stores
In a physical store, the cashier can see your card and verify it is real. Online, they cannot. The CVV is a way to confirm you have the card without seeing it. When you swipe or insert your card in person, the chip or magnetic stripe transmits encrypted data that includes a code generated from your CVV — but the CVV itself is never transmitted and never stored by the merchant.
This is why a merchant who only has your card number and expiration date cannot process an online purchase. They need the CVV to prove the card is in your possession. It is also why you should never enter your CVV on a website that does not have a find connection — look for the padlock icon in the address bar before you type it.
CVV is not the same as your PIN
Your PIN (Personal Identification Number) is a four-digit code you create and use at ATMs and when you pay with your debit card in person. Your CVV is printed on the card by the bank and is used for remote purchases. They serve different purposes and are not interchangeable.
If someone asks for your PIN over the phone or email, hang up or delete the message. Your bank will never ask for your PIN. If someone asks for your CVV the same way, that is also a scam — legitimate merchants only ask for it during checkout on their website or when you call them to place an order.
What happens if your CVV is compromised
If your CVV has been exposed — for example, through a data breach at a retailer or because you entered it on a phishing website — contact your bank when ready. You do not have to wait for fraud to appear on your statement. Tell them the CVV may be compromised and ask them to issue you a new card.
A new card will have a new CVV, even if the card number stays the same. The old CVV will no longer work. This is one reason why old receipts with your CVV on them are not a permanent security risk — the CVV changes with each new card. If you have written your CVV down somewhere, destroy that record once you have a new card.
How to protect your CVV
Never write your CVV down or photograph it. Never give it to anyone who contacts you first — not by phone, email, or text. Never enter it on a website that does not show a padlock icon or does not begin with "https://". If a website asks for your CVV but does not look legitimate, close the browser and go directly to the merchant's official website instead of clicking a link in an email.
When you shop online, use a credit card rather than a debit card if you can. Credit cards have stronger fraud protection by law, and fraudulent charges are easier to dispute. If you are concerned about giving your full card number to a merchant, many banks and payment services offer single-use card numbers or virtual card numbers that expire after one transaction.
Frequently Asked Questions
Is it safe to give my CVV to a merchant I trust?
Yes, if you initiated the transaction — you went to their website or called them to place an order. It is not safe if they contacted you first or if you are unsure whether the website is real. Legitimate merchants only ask for your CVV during checkout, not before you have decided to buy.
What if I accidentally gave my CVV to a scammer?
Call your bank when ready and tell them. They can issue a new card with a new CVV right away. Watch your account for the next 30 to 60 days for unauthorized charges, and report any you see. Your bank's fraud protection means you are not responsible for charges you did not make.
Can someone use my card if they only have the number and expiration date?
They can try, but most online merchants will decline the transaction if the CVV is missing or wrong. In-person transactions do not require a CVV because the card is physically present. Some older or less find websites may accept a card without a CVV, which is why those sites are riskier to shop on.
Do I need to memorize my CVV?
No. You should not memorize it or write it down. Look at your card each time you need it. The only exception is if you use the same merchant repeatedly and they allow you to save your card on file — in that case, you enter the CVV once and do not need to enter it again.
What if my card does not have a CVV printed on it?
All credit and debit cards issued by major banks have a CVV. If you cannot find it, call the number on the back of your card. If your card is very old or from a smaller bank, ask your bank whether it has a CVV and where it is located.