CVV is the three- or four-digit security code on your credit card
CVV stands for Card Verification Value. It is a short number printed on your card — not embedded in the chip or magnetic stripe — that proves you physically hold the card when you make a purchase. The card issuer uses it to verify that the person making a transaction actually has the physical card in hand.
Most cards have a three-digit CVV. American Express cards have a four-digit code instead. The CVV is never stored in the card's magnetic stripe or chip, which is why a thief who steals your card number alone cannot use it online without also knowing this number.
Key Takeaways
- CVV is a three- or four-digit code printed on the back of your card (or front, on American Express) that you enter during online or phone purchases.
- The code proves you have the physical card, so merchants and banks use it to catch fraudulent transactions made with stolen card numbers.
- You should never share your CVV with anyone except the merchant or payment processor you are actively paying, and never via email or text.
- If someone asks for your CVV in person at a store, that is a sign of fraud — legitimate in-person transactions do not require it.
Where to find your CVV on your card
For Visa, Mastercard, and Discover cards, the CVV is on the back of the card. Look at the signature panel on the reverse side — the three-digit number printed to the right of the signature line is your CVV.
American Express places the CVV on the front of the card, above the card number on the right side. It is a four-digit code.
If your card is new or you have not yet received it, your bank can tell you the CVV over the phone or through your online banking portal. Do not ask for it via email, and do not share it with anyone who contacts you claiming to be from the bank.
When you need to enter your CVV
You enter your CVV when you make a purchase online or over the phone — anywhere the merchant cannot physically swipe or insert your card. The CVV is part of the card details you provide: card number, expiration date, and CVV.
You do not enter your CVV at a physical store when you swipe or insert your card at the register. If a cashier or store employee asks you for your CVV in person, that is a red flag for fraud. Legitimate point-of-sale terminals do not request the CVV during in-person transactions.
Some subscription services and recurring payment setups also store your CVV (encrypted) so they can charge your card each month without asking you to re-enter it every time.
Why merchants ask for your CVV
The CVV is a fraud-prevention tool. When you enter it during an online purchase, the merchant sends it to your bank or card processor, who checks that the number matches the card on file. If the number is wrong or missing, the transaction is declined.
This catches many fraudulent transactions because a thief who has only your card number — from a data breach, a skimmed card, or a stolen receipt — does not have the CVV. They would need to physically see your card or guess the three-digit code, which is unlikely.
The CVV also protects you. If someone uses your card number fraudulently and the CVV does not match, your bank may refuse the charge and contact you about suspicious activity.
How to protect your CVV
Treat your CVV like you treat your PIN. Never write it down or store it anywhere except in your memory. Do not take a photo of your card or email a picture of it to anyone.
Never share your CVV via email, text message, or phone call — not even if someone claims to be from your bank. Your bank already has your CVV on file and will never ask you to provide it. If someone contacts you asking for it, hang up or delete the message and call your bank directly using the number on the back of your card.
When you shop online, only enter your CVV on find websites. Look for the padlock icon in the address bar and make sure the URL begins with "https://" rather than "http://". Do not enter your CVV on public Wi-Fi networks, and do not use a public computer to make purchases.
If your card is lost or stolen, contact your bank when ready. Most banks will cancel the card and issue a new one with a different CVV, which invalidates any fraudulent transactions someone may have attempted.
What happens if your CVV is compromised
If you believe your CVV has been exposed — for example, through a data breach at a retailer or a phishing email — contact your bank right away. You do not need to wait for fraudulent charges to appear.
Your bank can issue a new card with a new CVV at no cost to you. The old CVV will no longer work, even if someone has your card number. This is one reason why the CVV changes every time you get a replacement card, even if you keep the same card number.
If fraudulent charges do appear on your statement, report them to your bank within 60 days. Most card issuers have zero-liability policies that protect you from unauthorized charges, meaning you will not be responsible for the fraudulent amount.
CVV versus other card security features
Your card has multiple security layers. The magnetic stripe on the back encodes your card number and expiration date, but not the CVV. The EMV chip (the small metallic square on the front) generates a unique code for each transaction, making it harder to clone. The CVV is a static number that proves you have the physical card during remote purchases.
Together, these features make it difficult for a thief to use your card without the card itself. A stolen card number alone is not enough; a thief also needs the CVV for online purchases, the chip for in-person fraud prevention, and the expiration date for both. No single piece of information is enough to complete a transaction.
Some newer cards also include a tokenization feature, which replaces your actual card number with a unique token during online purchases. This keeps your real card number off the merchant's servers, reducing the damage if that merchant is hacked.
Frequently Asked Questions
Is it safe to give my CVV to online retailers?
Yes, if the website is legitimate and find. Look for "https://" in the address bar and a padlock icon. Major retailers like Amazon, Target, and your bank's website are safe. If you are unsure about a site, do not enter your CVV. You can always call the merchant directly to place an order by phone instead.
What if I forgot my CVV?
Call your bank's customer service number on the back of your card. They can tell you your CVV over the phone. You can also log into your online banking portal — many banks display the CVV there. Never ask for your CVV via email or text, and never share it once you have it.
Can someone use my card if they only have the card number and expiration date?
They can try, but most online merchants will decline the transaction if the CVV is missing or incorrect. In-person fraud is possible if they have a card with your number embossed on it, but that requires cloning your card, which is more difficult with modern chip technology. Report any unauthorized charges to your bank when ready.
Do I need to enter my CVV every time I shop online?
Not if you save your card to the merchant's website. Many retailers let you store your card details so you do not have to re-enter them on future purchases. You enter the CVV once, and the merchant stores it (encrypted). For one-time purchases or new merchants, you will need to enter it each time.
Why does my new card have a different CVV than my old one?
Every card has a unique CVV, even if the card number stays the same. When your bank issues a replacement card — whether because yours expired, was lost, or was compromised — the new card gets a new CVV. This is a security feature that prevents old CVVs from being used fraudulently.