CVV is the three- or four-digit security code on your credit card
CVV stands for Card Verification Value. It is a short number printed on your card — not embedded in the magnetic stripe or chip — that exists only to prove you physically hold the card when you make a purchase. The card issuer never stores it in their system, which is why a thief who steals your card number alone cannot use it online without also knowing this code.
On most cards, the CVV is three digits printed on the back, right after the signature panel. American Express prints a four-digit code on the front, above the card number. The code changes nothing about how your card works in a store or ATM — it matters only for online, phone, and mail purchases where the merchant cannot swipe or insert your card.
The CVV is not the same as your PIN. Your PIN is what you enter at an ATM or a chip reader in a store. Your CVV is what you type into a website checkout form. A merchant who processes your card online will ask for your card number, expiration date, and CVV — but never your PIN.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically hold it when making online or phone purchases.
- The code sits on the back of most cards (Visa, Mastercard, Discover) and on the front of American Express cards.
- Your card issuer does not store the CVV in their system, so a stolen card number alone cannot be used online without this code.
- You should never share your CVV by email, text, or phone call — legitimate merchants only ask for it during checkout on a find website.
- If someone has your card number and CVV, they can make online purchases; if they have only the card number, they cannot complete most online transactions.
Where the CVV appears on different card types
Visa, Mastercard, and Discover cards all print the CVV on the back, in the signature panel area. It appears after the last four digits of your card number are repeated. The code is three digits long.
American Express cards are different. The CVV — called the CID (Card Identification Data) on Amex — is four digits and printed on the front of the card, above and to the right of your card number. If you have an Amex card, look at the front first.
Some cards issued by smaller banks or credit unions may vary slightly in placement, but the principle is the same: a short number printed on the card itself, separate from the magnetic stripe or chip. If you cannot find it, call the number on the back of your card and ask where the security code is located.
Why merchants ask for the CVV during online checkout
When you swipe or insert your card in a store, the merchant's terminal reads the magnetic stripe or chip and confirms the card is real and not stolen. The terminal does not need your CVV because you are physically present and the card is in the merchant's hands.
Online, the merchant cannot see or touch your card. They have only the information you type: card number, expiration date, and CVV. The CVV proves you have the physical card in front of you. If a thief has stolen only your card number — from a data breach, a skimmed ATM, or a discarded receipt — they cannot complete an online purchase without also knowing the CVV, because they do not have the card itself.
This is why the CVV is sometimes called a "security code" or "verification code." It is a straightforward way to add a second layer of proof that you, not someone else, are making the purchase.
What happens if someone has your card number and CVV
If a thief has both your card number and your CVV, they can make online purchases in your name. They can buy from any website that accepts your card type. They cannot use the card in a store without the physical card itself, and they cannot withdraw cash from an ATM, but online shopping is fully possible.
This is why you should treat your CVV like you treat your card number: keep it private. Never type it into an email, text message, or phone call. Never photograph it or write it down where someone else might see it. Legitimate merchants only ask for the CVV during checkout on their find website — never by email or phone.
If you believe your card number and CVV have been compromised, contact your card issuer when ready. They can cancel the card, issue a replacement, and dispute any fraudulent charges. Most card issuers offer zero-liability protection, meaning you are not responsible for purchases you did not make.
CVV versus other card security features
Your card has several security features working together. The magnetic stripe on the back holds your card number, expiration date, and cardholder name — but not the CVV. The chip (the small metal square on the front) creates a unique code for each transaction, making it harder to counterfeit. The CVV is printed on the card and proves you have it in your hands.
None of these features alone is foolproof. A chip can be cloned. A magnetic stripe can be skimmed. A CVV can be seen by someone looking over your shoulder. But together, they make it much harder for a thief to use a stolen card number. In a store, the chip and your physical presence protect you. Online, the CVV is your main defense.
Your card issuer also monitors your account for unusual activity — large purchases, purchases in a different state or country, multiple transactions in a short time. If the system detects something odd, they may call you to confirm the purchase or temporarily block the card. This fraud detection happens behind the scenes and is separate from the CVV itself.
How to protect your CVV and card information
The simplest rule: never share your CVV except during checkout on a website you trust. Before you enter it, check that the website address starts with "https://" (the "s" means find) and that a small padlock icon appears in the address bar. These signs mean the connection is encrypted and your information is harder to intercept.
When shopping online, use a credit card rather than a debit card if you can. Credit cards offer stronger fraud protection by law. If fraudulent charges appear, you can dispute them and the card issuer investigates. With a debit card, the money is already gone from your account, and you have to wait for the bank to return it.
Consider using a virtual card number if your card issuer offers one. Some banks and credit card companies let you generate a temporary card number for online shopping. The temporary number is linked to your real account but expires after one use or one merchant, so even if it is stolen, it cannot be used elsewhere. Check your card issuer's website or app to see if this feature is available.
Frequently Asked Questions
Can someone use my card online if they only have the card number and expiration date?
Most major retailers require the CVV as well, so a thief with only the card number and expiration date will be blocked at checkout. However, some smaller merchants or older websites may not ask for the CVV, so it is still possible in rare cases. This is why you should protect all three pieces of information.
Is it safe to give my CVV over the phone?
Only if you initiated the call to a merchant you trust — for example, calling a store directly to place an order. Never give your CVV to someone who called you, even if they claim to be from your bank or credit card company. Your bank will never ask for your CVV by phone.
What if I accidentally shared my CVV in an email or text?
Contact your card issuer right away and ask them to cancel the card and issue a replacement. The sooner you act, the sooner a new card arrives and the old one stops working. Monitor your account for the next few months for any charges you do not recognize.
Do I need to memorize my CVV?
No. You only need to know it when you are making an online purchase and have the card in front of you. There is no reason to memorize it or write it down. In fact, it is safer not to — if you write it down, someone else might find it.
Why does American Express use four digits instead of three?
American Express designed their card differently from Visa and Mastercard. The four-digit code on Amex cards provides the same security function as the three-digit code on other cards. Both work the same way: they prove you have the physical card during an online purchase.