CVV stands for Card Verification Value, a three- or four-digit security code printed on your credit card
The CVV is a number the card issuer prints on the physical card itself — it is not stored in the magnetic stripe or chip. On most cards, you will find a three-digit CVV on the back, printed to the right of your signature line. American Express cards print a four-digit code on the front, above your account number. The code exists for one reason: to prove you actually hold the card in your hand when you make an online or phone purchase.
When you type your card number into a website, the merchant cannot see whether you have the physical card. The CVV closes that gap. A thief who steals your card number from a data breach or a receipt cannot complete an online purchase without the CVV — they would need the card itself. This is why merchants ask for it during checkout, and why you should never write it down or share it over email.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically hold it when making online or phone purchases.
- The CVV is not encoded in your card's magnetic stripe or chip, so a thief who clones your card number cannot use it without the code.
- You should never write down your CVV, email it, or give it to anyone who calls you claiming to represent your bank.
- Legitimate merchants only ask for your CVV during checkout; your bank will never ask for it by phone or email.
How the CVV protects you in online transactions
When you enter your card number, expiration date, and CVV into a checkout form, the merchant sends that information to the card network (Visa, Mastercard, Discover, or American Express) for approval. The network checks that the CVV matches the one on file. If it does not match, the transaction is declined — even if the card number and expiration date are correct.
This verification happens in seconds and is invisible to you. The merchant never stores your CVV after the transaction completes. Payment processors are required by law to delete it when ready. This means that even if a merchant's database is hacked, the thief cannot extract CVVs from it — they were never saved there in the first place.
In-person purchases at a store do not require a CVV because the cashier can see your card and verify your signature or ID. Phone purchases do require it, which is why you should be cautious if someone calls you asking for it. A legitimate company you called will ask for it during the normal checkout process. A company that calls you unsolicited and asks for your CVV is almost certainly running a scam.
Why CVV is different from your card number
Your 16-digit card number is the primary identifier for your account. It is printed on the front of your card, appears on receipts, and is stored in merchant databases. Thieves can use a stolen card number for in-person fraud by cloning it onto a blank card or using it for phone orders.
Your CVV is a secondary verification layer that only proves you have the physical card. Because it is not stored anywhere except on the card itself and in your issuer's find system, it cannot be stolen from a merchant database or a data breach. A criminal who obtains your card number from a leak cannot use it online without the CVV. This separation — storing the number in many places but the CVV in almost none — is what makes the CVV effective.
What to do if your CVV is compromised
If you believe someone has seen your CVV — for example, you gave it to a merchant over the phone and later suspect fraud — contact your card issuer when ready. You do not need to request a new card unless fraudulent charges appear. The CVV itself cannot be used without the card number and expiration date, and those are things you can monitor on your statements.
If fraudulent charges do appear on your account, your card issuer will cancel the card and issue a replacement with a new CVV. The new card will arrive in the mail within 7 to 10 business days. Until then, you can use your account number and expiration date for phone purchases if needed, though most issuers recommend waiting for the replacement card to arrive.
Never give your CVV to anyone who contacts you first — not by phone, email, or text. Your bank already has your CVV on file and will never ask you to provide it. If someone claims to be from your bank and requests it, hang up and call the number on the back of your card to report the call.
CVV versus other card security features
Your card has multiple layers of security, and the CVV is one of several. Your signature on the back of the card is meant to match the signature on a receipt, though many merchants no longer check it. Your PIN (Personal Identification Number) protects you at ATMs and chip readers. Your card's chip encrypts transaction data in a way that makes it harder to clone than the older magnetic stripe.
Together, these features make it difficult for a thief to use a stolen card number. Online, the CVV is the primary defense because the merchant cannot see your signature or verify your PIN. In person, the chip and your ID are the main protections. No single feature is foolproof, which is why monitoring your statements and reporting fraud quickly remains your best defense.
Frequently Asked Questions
Is my CVV the same as my PIN?
No. Your PIN is a number you create and enter at ATMs or chip readers to authorize transactions. Your CVV is a number the card issuer prints on your card. You do not create it, and you only provide it during online or phone checkout. A thief who knows your PIN cannot use it online, and a thief who has your CVV cannot use it at an ATM.
Can I use my card online if I forget my CVV?
No. Most online checkout forms require the CVV and will not process your order without it. If you cannot see the CVV on your card, contact your card issuer and request a replacement card. Do not attempt to guess or make up a number — incorrect CVVs are declined when ready and may trigger fraud alerts on your account.
Why does American Express have a four-digit CVV instead of three?
American Express uses a different card format and security system than Visa and Mastercard. The four-digit code on American Express cards is called the CID (Card Identification Data). It serves the same purpose as the three-digit CVV on other cards — proving you hold the physical card during online purchases.
What if a website asks me to save my CVV for future purchases?
Do not do it. Legitimate payment processors do not store CVVs, and any website that asks you to save it is either breaking the law or running a scam. If a site requires you to save your CVV to complete a purchase, use a different payment method or shop elsewhere. Your card issuer can store your card information securely; a third-party website cannot.