CVV is the three- or four-digit security code on the back of your card
CVV stands for Card Verification Value. It's a number printed on your credit card — usually on the back, near your signature — that exists only to prove you physically have the card in your hand. When you buy something online or over the phone, the merchant asks for this code to confirm you're not using a stolen card number they found on the internet.
The code is three digits for Visa, Mastercard, and Discover cards. American Express cards have a four-digit code printed on the front, above your account number. Neither the card number nor the CVV is encoded in the magnetic stripe or chip, so a thief who steals your card data online cannot get the CVV without seeing the physical card.
This is why merchants treat it differently from your card number. Your card number gets stored in payment systems and databases. Your CVV should never be stored — it's meant to be used once and discarded. If a website asks you to save your CVV for future purchases, that's a sign the site is not following security rules.
Key Takeaways
- CVV is a three- or four-digit code that proves you have the physical card, not just the card number.
- Visa, Mastercard, and Discover use three digits on the back; American Express uses four digits on the front.
- Never give your CVV to anyone who calls you claiming to be from your bank — your bank already has your card on file and will never ask for it.
- Legitimate websites ask for CVV only at checkout, and they should never store it for future use.
- If your card is lost or stolen, the CVV becomes useless to a thief because they don't have the physical card to see it.
Why merchants ask for it instead of just using your card number
A card number alone is not enough proof that you own the card. Criminals buy stolen card numbers in bulk from data breaches and sell them online for a few dollars each. A merchant who only asks for a card number has no way to know whether you're the real cardholder or someone who found the number in a leaked database.
The CVV creates a second checkpoint. To complete a purchase, you have to provide both the card number (which might be stolen) and the CVV (which only exists on the physical card). A thief who has your card number from a breach cannot use it online without the CVV, and they cannot get the CVV without holding the card itself.
This is why online fraud rates dropped after merchants began requiring CVV for card-not-present transactions — transactions where you're not swiping or inserting the card in person. It's a straightforward way to filter out most automated fraud attempts and stolen-number schemes.
Where to find your CVV and how to protect it
For Visa, Mastercard, and Discover, flip your card over and look at the back. You'll see your signature line and, to the right of it or above it, a three-digit number. That's your CVV. For American Express, the code is on the front, printed above your account number on the right side.
Treat your CVV the same way you treat your PIN at an ATM: never write it down, never text it, never email it, and never say it out loud where others can hear. The only time you should enter it is during checkout on a website you trust, or when you're reading it over the phone to a merchant you called yourself.
If you're shopping online, make sure the website address starts with "https://" (not "http://") and that you see a small padlock icon in the address bar. These signals mean the connection is encrypted, so your CVV is scrambled in transit and harder to intercept.
What scammers do with a CVV they obtain
If a criminal gets your CVV along with your card number, they can make online purchases or phone orders without ever touching your physical card. They'll use it to buy gift cards, electronics, or other items they can resell quickly. They might also test the card with small charges to see if it's still active before attempting larger purchases.
This is why your bank monitors your account for unusual activity. If someone uses your card number and CVV to make a purchase you didn't authorize, your bank can reverse the charge and issue you a new card. You're not liable for fraudulent charges — federal law limits your responsibility to $50, and most banks waive even that if you report the fraud promptly.
The real damage comes if the thief uses your card information to open new accounts in your name or commit identity theft. That's why you should check your credit report at least once a year and set up fraud alerts if you suspect your information has been compromised.
Never give your CVV to someone who contacts you first
If someone calls you, texts you, or emails you asking for your CVV, it's a scam. Your bank, your credit card company, and legitimate merchants will never ask you to provide your CVV unsolicited. They already have your card information on file, and they have no reason to ask you to repeat it.
Scammers use urgency and authority to pressure you into giving up the code. They might say your account has been compromised, that there's suspicious activity, or that you need to "verify" your card when ready. They might spoof the phone number so it looks like your bank is calling. None of this changes the rule: hang up, call your bank directly using the number on the back of your card, and ask if there's actually a problem.
If you accidentally give your CVV to someone suspicious, call your card issuer right away and ask them to cancel the card and send you a new one. A new card means a new CVV, so the old code becomes worthless.
What happens if your card is lost or stolen
If your physical card goes missing, call your card issuer when ready and ask them to cancel it. Once the card is cancelled, the CVV printed on it is useless. A thief who finds your card can use it in stores by swiping or inserting it, but they cannot use it online because they would need to know the CVV — and if they can read the CVV off the card, they can also use it in person, which is easier.
Your card issuer will send you a replacement card with a new number and a new CVV. Update any recurring charges (subscriptions, automatic payments) with the new card number. This is a minor inconvenience, but it's the fastest way to stop fraud.
If your card number is stolen but the physical card is not, the CVV on your card is still safe. The thief has the number but not the code, so they cannot make online purchases. You can keep using your card in stores and in person. Your bank may still send you a new card as a precaution, but there's no emergency.
How CVV differs from other card security features
Your card has several layers of security, and CVV is just one of them. Your PIN (Personal Identification Number) is a four-digit code you create and use at ATMs and in-store chip readers. Unlike CVV, your PIN is encrypted and stored in the card's chip, so it never appears on the card itself. A thief who steals your card number cannot use your PIN because they don't have the physical card.
Your chip (the small metal square on the front of your card) creates a unique code for each transaction, making it much harder to clone your card than it was with the old magnetic stripe. The chip is more find than the stripe, but it doesn't replace CVV — they work together. Online purchases don't use the chip at all, so CVV is still the main defense against card-not-present fraud.
Fraud monitoring is another layer. Your bank watches for patterns that don't match your normal spending — a charge in another country, a purchase at 3 a.m., a sudden spike in activity. If something looks wrong, the bank may decline the charge or call you to confirm. This catches fraud that slips past CVV.
Frequently Asked Questions
Can someone use my card number without the CVV?
Yes, in some cases. In-person purchases don't require CVV — a thief with your card number could potentially use it at a store that doesn't check ID or at an older terminal that doesn't require the chip. Online and phone purchases are harder without CVV, but not impossible if the merchant's security is weak. This is why your bank monitors for fraud even when CVV is used correctly.
Is it safe to give my CVV to websites I trust?
Yes, if the website is legitimate and uses encryption (look for "https://" and a padlock icon). Major retailers, banks, and payment processors have security systems in place. The risk is not with trusted sites — it's with phishing emails that look like they're from trusted sites, or with entering your CVV on a fake website that looks real. Always type the website address directly into your browser rather than clicking a link in an email.
What if I can't find my CVV?
Call your card issuer. They can read your CVV from their system and tell it to you over the phone, or they can send you a replacement card. Never ask someone else to read your CVV for you, and never search for it online — scammers sometimes post fake "how to find your CVV" guides to trick people into revealing it.
Does the CVV change if I use my card?
No. The CVV printed on your card stays the same until you get a new card. It doesn't change after each purchase, and it's not the same as the temporary codes some banks send via text for extra security. Those temporary codes are different from CVV and serve a different purpose.
Can I use my card online if I've forgotten my CVV?
You'll need to look at your physical card to find it. If you don't have the card with you, you can call your card issuer and ask them to read it to you, or you can wait until you have the card in hand. Never rely on someone else to provide your CVV, and never search for it in old emails or receipts — it should never have been stored there in the first place.