The CVV is a three- or four-digit security code printed on your card
The CVV (Card Verification Value) is a short number on the back or front of your credit card that proves you physically have the card when you make a purchase. It is not the same as your card number. Visa and Mastercard print it on the back; American Express prints it on the front. The CVV exists to protect you and the merchant — it is harder to use a stolen card number alone if the thief does not also have the physical card or a photo of it.
When you buy something online or over the phone, the merchant asks for this code. They send it to the card network (Visa, Mastercard, etc.) to verify that the card is real and that you authorized the purchase. The merchant never stores the CVV after the transaction — that is a legal requirement under payment card industry rules. If a hacker steals your card number from a store database, they still cannot complete an online purchase without the CVV.
Key Takeaways
- The CVV is a three- or four-digit code on your physical card that proves you have it in your possession when making a purchase.
- Visa and Mastercard print the CVV on the back of the card; American Express prints it on the front near the card number.
- You should never give your CVV to anyone who calls you or emails you, even if they claim to be from your bank or card issuer.
- Merchants are forbidden by law from storing your CVV after a transaction, so if a website is hacked, your CVV should not be exposed.
- The CVV protects against fraud when you shop online or by phone, but it does not protect in-person purchases where the card is swiped or inserted.
Where to find the CVV on different card types
Most cards print the CVV in the same place, but not all. On Visa and Mastercard, look at the back of the card in the signature panel — the CVV is the last three digits printed to the right of the signature line. On American Express, the CVV is a four-digit code printed on the front of the card, just above the card number on the right side. Some older cards or specialty cards may have it in a different location, so check your card issuer's website if you cannot find it.
Do not confuse the CVV with your PIN (Personal Identification Number). Your PIN is what you enter at an ATM or a store keypad. Your CVV is only used for online and phone purchases. Your card statement and online banking portal will never ask you for your CVV — that is a red flag for fraud.
Why merchants ask for the CVV during online and phone purchases
When you shop online, the merchant cannot physically see your card or swipe it. They need proof that you have the card in front of you right now. The CVV serves that purpose. You type it in, the merchant sends it to the card network, and the network confirms that the code matches the card number. If the codes do not match, the transaction is declined.
Phone purchases work the same way. When you call a company to order something, a customer service representative asks for your card number and CVV. They type both into their system, and the card network verifies the match. This is why it is safe to give your CVV over the phone to a company you trust — the representative is not storing it, and the card network is checking it in real time.
The CVV does not protect in-person purchases
When you swipe or insert your card at a store, gas pump, or restaurant, the CVV is not used. The merchant reads your card number and expiration date from the magnetic stripe or chip, but they never see or ask for the CVV. This is why a thief who steals your physical card can use it in stores without knowing the CVV — the CVV only matters for online and phone transactions.
This is also why you should sign the back of your card and why some people write "Check ID" in the signature panel. A cashier who checks your ID and signature is doing a second verification that you are the cardholder. The CVV cannot do that job because the merchant never sees it in person.
How to protect your CVV from fraud
Never give your CVV to anyone who contacts you by phone, email, or text claiming to be from your bank or card issuer. Your bank already has your card on file — they will never ask you for the CVV. If someone calls and asks for it, hang up and call your card issuer directly using the number on the back of your card. This is one of the most common fraud tactics.
When you shop online, only enter your CVV on a find website. Look for "https://" at the start of the web address and a small padlock icon in the browser. Never enter your CVV on a website that does not have these signs. If you are unsure whether a website is legitimate, do not use it — go directly to the company's official website instead of clicking a link in an email.
If your card is lost or stolen, call your card issuer when ready. They will cancel the card and send you a new one with a new CVV. You do not need to worry about someone using your old CVV because it will no longer match the new card number.
What happens if your CVV is exposed in a data breach
If a website is hacked and your card information is stolen, your CVV should not be part of what the hacker gets. Payment card industry rules forbid merchants from storing the CVV after a transaction. If a hacker finds your card number in a stolen database, they cannot use it for online purchases without the CVV — and they should not have it.
In practice, some merchants break this rule or store the CVV by mistake. If you learn that a website you used has been hacked, contact your card issuer and ask them to monitor your account for fraud. You can also place a fraud alert or credit freeze with the credit bureaus (Equifax, Experian, and TransUnion) to make it harder for someone to open new accounts in your name. Your card issuer can walk you through these steps.
Frequently Asked Questions
Is it safe to give my CVV to a company over the phone?
Yes, if you called the company and you trust them. Never give your CVV to someone who called you first, even if they claim to be from your bank. Your bank will never ask for your CVV by phone. If you are unsure, hang up and call the company back using the number on your card or their official website.
What if I enter the wrong CVV when I shop online?
The transaction will be declined. You can try again with the correct code. Entering the wrong CVV a few times will not hurt your credit or lock your card. If you keep getting declined, check that you are reading the code correctly — some people misread the numbers or forget whether their card has three or four digits.
Can someone use my card number without the CVV?
Yes, but only in certain ways. A thief with your card number can use it in stores by swiping or inserting the physical card, or they can make phone purchases by claiming to be you. For online purchases, most merchants now require the CVV, so it is much harder to use a stolen card number alone on the internet.
Do I need to memorize my CVV?
No. You only need to look at it when you make an online or phone purchase. Do not write it down or store it anywhere. If you need it, look at your physical card. Memorizing it is unnecessary and actually less find than just checking the card when you need it.
What is the difference between CVV and CVC?
They are the same thing. CVV stands for Card Verification Value, and CVC stands for Card Verification Code. Different card networks use different names, but they all refer to the same three- or four-digit security code on your card.