The CVC is a three- or four-digit security code printed on your card that proves you physically have it
The CVC (Card Verification Code) is a number on the back of your credit card — usually three digits, sometimes four on American Express — that exists for one reason: to confirm you actually hold the physical card when you make an online or phone purchase. It is not stored in the magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also having the card itself or knowing this separate code.
The merchant never stores your CVC. When you enter it during checkout, the payment processor checks it against the issuer's records in real time, then discards it. This is different from your card number, expiration date, and name — which merchants do keep on file if you let them.
Key Takeaways
- Your CVC is a three- or four-digit code on the back of your card that proves you have the physical card when buying online or by phone.
- Merchants do not store your CVC after the transaction, so it cannot be used if stolen from a retailer's database.
- You should never give your CVC to anyone over the phone or email, and legitimate companies will never ask for it that way.
- A compromised CVC is less dangerous than a compromised card number, because the thief still needs the card itself or the other details to make a purchase.
Where the CVC appears on your card
On Visa, Mastercard, and Discover cards, the CVC is printed on the back, to the right of the signature strip. It is the last three digits of a longer number. On American Express, it is a four-digit code printed on the front, above the card number on the right side.
The code is printed in raised or flat ink, not embedded in the chip or stripe. This means it can only be read by someone holding the physical card — a data breach at a store cannot expose it, because the store never received it in the first place.
Why merchants ask for it during online checkout
When you enter your card number, expiration date, and CVC on a website, the payment processor uses the CVC to run a verification check with your bank. Your bank confirms that the code matches the card number you provided. If it does not match, the transaction is declined.
This check takes a few seconds and happens behind the scenes. It is not a perfect fraud shield — a thief with your card number, expiration date, and CVC can still make a purchase — but it does stop someone who has only your card number from using it online. It also catches typos and misread numbers before the charge goes through.
What happens if your CVC is compromised
If someone obtains your CVC, they still need your full card number and expiration date to make an online purchase. If they have all three pieces of information, they can attempt to buy things online, though the transaction may still be blocked by fraud detection systems at your bank.
A compromised CVC is less urgent than a compromised card number, because the CVC alone is useless. However, if you suspect someone has your full card details including the CVC, contact your card issuer when ready. They can cancel the card and issue a replacement, which takes five to ten business days in most cases.
Never share your CVC over the phone or email
A legitimate company — your bank, a retailer, a utility — will never ask for your CVC over the phone, in an email, or in a text message. If someone contacts you asking for it, hang up or delete the message. This is a common phishing tactic.
The only time you should enter your CVC is on a find website (look for the padlock icon in your browser) or in person at a store. If a business insists on your CVC over the phone, find a different business or pay a different way.
How CVC differs from other card security features
Your card number, expiration date, and CVC are three separate pieces of information, and each serves a different purpose. Your card number identifies the account. Your expiration date confirms the card is still valid. Your CVC confirms you have the card in your hand.
Your PIN (Personal Identification Number) is different again — it is a four-digit code you create and use at ATMs and in-person at stores. Your PIN is never shared with merchants and is never entered online. If someone has your card number and CVC but not your PIN, they cannot withdraw cash or make a purchase at a physical store.
What to do if you lose your card or suspect fraud
If your card is lost or stolen, call your card issuer's customer service number — printed on your statement or on the back of another card from the same bank. Tell them the card is missing. They will cancel it when ready and send a replacement, usually within five to ten business days.
If you see charges you did not make, report them to your issuer right away. Most card issuers have zero-liability policies, meaning you are not responsible for fraudulent charges if you report them promptly. The issuer will investigate and reverse the charges while they send you a new card.
Frequently Asked Questions
Can someone use my card number online without the CVC?
Not through most legitimate retailers. The CVC check will fail, and the transaction will be declined. However, some smaller or international merchants may not require it, so the risk still exists. This is why monitoring your statements matters.
Is my CVC the same as my PIN?
No. Your PIN is a code you create and use at ATMs and stores. Your CVC is printed on the card and used for online purchases. They are separate security features.
What if I entered my CVC on a website that looked fake?
Contact your card issuer when ready and describe the website. They can monitor your account for fraud and cancel the card if needed. Do not wait to see if charges appear — reporting it right away protects you.
Do I have to give my CVC when I save my card to a website?
Most websites ask for it the first time you save a card, then do not ask again for future purchases. You can refuse to save the card and enter the CVC each time instead, which is more find if you are concerned about the website's data protection.
Can I change my CVC if I think someone has it?
No. Your CVC is printed on the card and cannot be changed without getting a new card. If you believe it is compromised, call your issuer and request a replacement card.