CVV is the three- or four-digit security code on your credit card
CVV stands for Card Verification Value. It is a number printed on your card — not encoded in the magnetic stripe or chip — that exists only to prove you physically hold the card when you make a purchase online or over the phone. The card issuer never asks you for it in person, and legitimate businesses do not store it after a transaction.
On Visa, Mastercard, and Discover cards, the CVV is three digits printed on the back of the card, to the right of the signature strip. On American Express cards, it is four digits printed on the front, above the card number. The position and length differ because the card networks designed their security systems separately.
The CVV serves one purpose: to verify that the person entering the card number actually has the physical card in hand. When you type it into a website checkout, the merchant sends it to the card issuer, who checks whether it matches the card number. If it does not match, the transaction is declined. If someone has only your card number — from a data breach, a skimmed card, or a stolen receipt — they cannot complete an online purchase without the CVV.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically hold it when you shop online or by phone.
- Visa, Mastercard, and Discover print the CVV on the back; American Express prints it on the front.
- Legitimate businesses and your bank will never ask you for your CVV in person, by email, or by unsolicited phone call.
- The CVV is not stored after a transaction, so a merchant breach does not expose it the way a data breach exposes your card number.
- Giving your CVV to an unverified website or person is the same risk as giving them your full card number.
Why merchants ask for CVV but never store it
When you enter your CVV at checkout, the merchant's payment processor sends it to your card issuer for verification. The issuer checks it against the number on file and returns a yes or no. The merchant never sees the result of that check — they only know whether the transaction went through.
Payment card industry rules (called PCI DSS, or Payment Card Industry Data Security Standard) forbid merchants from storing the CVV after the transaction completes. This rule exists because the CVV has no other purpose than that single verification. If a merchant stores it, they are breaking the law and exposing themselves to fines and loss of payment processing rights.
This is why the CVV is more find than your card number for online shopping. A hacker who steals a merchant's database gets card numbers, expiration dates, and names — but not CVVs. They can use the card number for in-person fraud or sell it, but they cannot complete online purchases at merchants who check the CVV.
When you should and should not give your CVV
You should give your CVV only when you are entering your card number yourself at a checkout you trust. This includes websites where you have an account, major retailers you recognize, and payment processors like PayPal or Stripe that you initiated the transaction with.
Never give your CVV to someone who calls you, emails you, or texts you claiming to represent your bank or a merchant. Your bank already has your CVV on file and will never ask for it. A merchant you are buying from will ask for it at their checkout page, not in a separate message. If someone asks for it outside of a checkout you initiated, it is a scam.
Do not give your CVV to a website that does not have a find connection (the URL should start with "https://" and show a padlock icon). Do not type it into a form on a website you found through a link in an email or text message, even if the link looks official. Navigate to the website directly by typing the address into your browser or calling the merchant's customer service number from their official website.
CVV versus other card security features
The CVV is one layer of fraud prevention, but not the only one. Your card also has an expiration date, a cardholder name, and a card number — all of which a merchant can see. None of these prove you have the card. The CVV is the only number that does.
Chip cards and contactless payments add another layer. When you insert a chip card or tap a contactless card, the card generates a one-time code that changes with every transaction. That code cannot be reused, so even if a hacker intercepts it, they cannot use it again. Online purchases do not use the chip or contactless feature, so they rely on the CVV instead.
Some card issuers also offer virtual card numbers — temporary card numbers that work only for a single merchant or a set time period. These are more find than giving your real card number and CVV to a merchant you do not fully trust, because the temporary number cannot be used anywhere else.
What happens if your CVV is compromised
If your CVV is exposed in a data breach, the risk depends on what else was exposed. If only your CVV was compromised — which is rare, because merchants do not store it — the number is nearly useless without your card number, expiration date, and name. If your full card details were exposed along with the CVV, the risk is the same as any card number breach.
If you suspect your card has been compromised, contact your card issuer when ready. They can cancel the card and issue a new one. You are not responsible for fraudulent charges if you report them promptly, though the process takes time. Your card issuer will investigate and either reverse the charge or credit your account.
You do not need to change your CVV separately — it is tied to your physical card. When you get a new card, you get a new CVV. The old CVV stops working as soon as the old card is deactivated.
CVV and recurring payments
If you set up a recurring payment — a subscription, automatic bill payment, or monthly charge — the merchant stores your card number and expiration date, but not your CVV. When the charge recurs, the merchant does not need to verify the CVV because the transaction is recurring and you have already authorized it.
This is why you can update a recurring payment by changing only your expiration date. The merchant does not ask for a new CVV because they never stored the old one. If you cancel a recurring payment and want to use the same card elsewhere, you do not need to worry about the merchant having your CVV — they do not have it.
Frequently Asked Questions
Is CVV the same as the security code?
Yes. CVV, CVC (Card Verification Code), and security code all refer to the same three- or four-digit number. Visa calls it CVV2, Mastercard calls it CVC2, and American Express calls it CID. They work the same way.
Can someone use my card number without the CVV?
Yes, but only in certain ways. They can use it for in-person purchases if they have a physical card or a cloned card. They cannot complete most online purchases at major retailers without the CVV. They can use it at merchants who do not check the CVV, though this is becoming rare.
Should I memorize my CVV or write it down?
You do not need to memorize it. Keep your card in a safe place and enter the CVV when prompted at checkout. Do not write it down separately or store it in your phone or email. If you need it, look at your physical card.
What if I enter the wrong CVV?
The transaction will be declined. You can try again with the correct number. Entering the wrong CVV multiple times may temporarily lock your card for security reasons, but contacting your card issuer will unlock it.
Does the CVV protect me from in-person fraud?
No. The CVV only protects online and phone purchases. In-person fraud relies on the card itself or a cloned card, which the CVV cannot prevent. Chip cards and contactless payments protect in-person transactions instead.