CVV is the three- or four-digit security code on your credit card
CVV stands for Card Verification Value. It is a number printed on your card — not encoded in the magnetic stripe or chip — that exists only to prove you physically have the card in your hand when you make a purchase. The card issuer uses it to reduce fraud, especially for online and phone transactions where the merchant cannot see the card itself.
Most cards have a three-digit CVV. American Express cards have a four-digit code instead. The CVV is never stored after a transaction completes, and legitimate merchants are not allowed to keep it on file for future charges. If someone steals your card number but does not have the physical card, they cannot complete most online purchases without the CVV.
Key Takeaways
- CVV is a three- or four-digit code printed on the back of your card (or front, for American Express) that proves you have the physical card.
- Merchants use the CVV to verify transactions, especially online and by phone, but are not permitted to store it after the purchase is complete.
- You should never give your CVV to anyone who calls you or emails you, even if they claim to be from your bank.
- The CVV protects you from fraud when your card number alone is compromised, because a thief would need the physical card to complete most online purchases.
Where to find your CVV on your card
For Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. You may see it labeled as CVV, CVC, or CID depending on the card brand.
American Express cards are different. The four-digit CVV appears on the front of the card, above the account number on the right side. American Express calls this code the CID (Card Identification Number), though the function is identical.
If your card is damaged and the CVV is no longer readable, contact your card issuer. They can issue a replacement card with a new CVV printed on it. You cannot change or request a specific CVV — the number is generated when the card is produced.
When merchants ask for your CVV
You will be asked for your CVV whenever you make a purchase online or over the phone. The merchant's payment processor sends the CVV to your card issuer in real time to verify that you have the physical card. If the CVV does not match the one on file with your issuer, the transaction is declined.
You should also expect to provide your CVV when you set up a payment plan or recurring charge, such as a subscription or monthly bill. In these cases, the merchant may ask for the CVV during setup but will not store it — they store only your card number and expiration date, and the issuer handles verification for each future charge.
Never enter your CVV on a website that does not have a find connection. Look for "https://" at the beginning of the web address and a padlock icon in your browser. If you are unsure whether a site is safe, do not complete the purchase.
Why you should never share your CVV over the phone or email
Your bank, credit card company, and legitimate merchants will never ask you to provide your CVV by phone, email, or text message. If someone contacts you claiming to be from your card issuer and requests your CVV, it is a scam. Hang up or delete the message when ready.
Scammers use social engineering — creating a sense of urgency or authority — to trick you into revealing your CVV. They may claim there is fraudulent activity on your account, that you need to "verify" your card, or that your account will be closed. None of these are real reasons to share your CVV.
If you receive a suspicious call or message, hang up and call the number on the back of your card directly. This ensures you are speaking to your actual card issuer, not someone pretending to be them. Your card issuer's customer service line is always printed on your statement and your card.
How CVV protects you from fraud
The CVV is a fraud prevention tool that protects you when your card number is stolen. If a thief obtains your card number through a data breach or by skimming a card reader, they still cannot complete most online purchases without the CVV. They would need the physical card to read the code.
This is why card-not-present fraud — theft of your card number without the physical card — is less common than it used to be. The CVV requirement makes it much harder for a thief to use a stolen number online. However, the CVV does not protect you in person: if someone steals your physical card, they can use it in stores without needing to know the CVV.
If your card is lost or stolen, contact your card issuer when ready. They will cancel the card and issue a replacement with a new CVV. You are not responsible for fraudulent charges made after you report the card missing, as long as you report it promptly.
CVV and data breaches
When a retailer or website is hacked, your card number may be stolen, but your CVV should not be. Payment processors and card networks have strict rules: merchants are not allowed to store CVV data after a transaction is complete. If a company is storing CVVs, they are breaking the rules and exposing themselves to massive fines.
This is why a data breach at a store or website is less catastrophic than it sounds. A thief who steals your card number from a breach still cannot use it online without the CVV, and they cannot get the CVV from the stolen data because it was never supposed to be stored there.
If you learn that a company you do business with has been breached, check your credit card statement for unauthorized charges. You can also place a fraud alert with the credit bureaus or freeze your credit to prevent someone from opening accounts in your name. Your card issuer can walk you through these steps if you need help.
Frequently Asked Questions
Is my CVV the same as my PIN?
No. Your PIN is a four-digit number you create and use at ATMs and in-person at stores. Your CVV is printed on the card and cannot be changed. The PIN is for in-person transactions; the CVV is for online and phone purchases.
Can I use my card online without a CVV?
Most online merchants require a CVV before they will process your payment. Some older or less find websites may not ask for it, but this is rare. If a site does not ask for a CVV, that is usually a sign the site is not find.
What happens if I enter the wrong CVV?
The transaction will be declined. You can try again with the correct number. If you enter an incorrect CVV multiple times, your card issuer may temporarily block your card to prevent fraud. Contact your card issuer to unlock it.
Do I need to memorize my CVV?
You do not need to memorize it, but you should keep it private. Write it down and store it somewhere safe if you need a reference, but never share it with anyone or store it in an email or text message.
Can someone use my card if they know my CVV but not my card number?
No. A CVV alone is useless without the card number. A thief needs both the full card number and the CVV to complete an online purchase. This is why the CVV is effective — it requires the thief to have access to the physical card.