Your CVV is a three- or four-digit security code printed on your card, separate from your account number

The CVV (Card Verification Value) is a short number on the back of your credit card designed to verify that you physically hold the card when you make a purchase. On most cards, it is a three-digit code printed in the signature strip on the back. American Express prints a four-digit code on the front, above the account number.

The CVV exists because online and phone transactions cannot read the magnetic stripe or chip on your card the way an in-person payment can. When you enter your card number, expiration date, and CVV into a website or give them to a customer service representative, that CVV proves you have the physical card in your hand — or at least that you have seen it.

The card issuer (your bank or credit card company) does not store your CVV in their system after the transaction clears. This design means that even if a merchant's database is breached and your card number is stolen, the CVV cannot be used without the physical card or a photo of it.

Key Takeaways

  • The CVV is a three- or four-digit code printed on your card that proves you physically hold it during online or phone purchases.
  • Visa, Mastercard, and Discover use a three-digit CVV on the back; American Express uses a four-digit code on the front.
  • Never share your CVV with anyone except the merchant you are paying, and never enter it on a website unless you initiated the transaction yourself.
  • If someone asks for your CVV by email, text, or unsolicited phone call, it is a scam — legitimate companies never request it that way.
  • Your card issuer does not store the CVV after a transaction, so a stolen card number alone cannot be used without the code.

Where the CVV appears on different card types

The location and length of the CVV depends on the card network. Visa, Mastercard, and Discover all print a three-digit code on the back of the card, usually in or near the signature strip. The code appears after the last four digits of your account number.

American Express is the exception. It prints a four-digit code called the CID (Card Identification Number) on the front of the card, above and to the right of the account number. If you hold an American Express card, you will see this four-digit number in a separate location from the back-of-card codes on other cards.

Some digital wallets and payment apps store your card information but do not display the CVV. If you use Apple Pay, Google Pay, or your bank's mobile app, you typically enter the CVV once when you add the card, and the app handles the code from there. You do not need to re-enter it for each transaction.

Why merchants ask for it and what they do with it

A merchant requests your CVV to verify that you have the card in your possession at the moment of purchase. When you enter it, the merchant sends it to your card issuer, who checks whether the code matches their records. If it does, the transaction is approved. If it does not, the purchase is declined.

This verification step reduces fraud because a thief who has only your card number and expiration date — information that might be visible on a receipt or captured in a data breach — cannot complete an online or phone purchase without the CVV. They would need a photo of the card or access to the physical card itself.

By law and by payment network rules, merchants are not supposed to store your CVV after the transaction is complete. If a merchant saves it, they are violating the Payment Card Industry Data Security Standard (PCI DSS), which is the security rule that all businesses handling card data must follow. This rule exists specifically to protect you: even if that merchant's database is hacked, the CVV cannot be stolen because it should not be there.

When you should and should not share your CVV

Share your CVV only with the merchant you are paying, and only when you initiated the transaction yourself. This means entering it on a website checkout page you navigated to, or reading it over the phone to a customer service representative at a company you called.

Never share your CVV if someone contacts you first — whether by email, text message, or phone call. Legitimate companies never ask for your CVV unsolicited. If your bank suspects fraud on your account, they will ask you to verify information you set up (like a security question), not to recite your CVV. If a merchant needs to contact you about a payment problem, they will ask for the last four digits of your card, not the full number or the CVV.

Do not enter your CVV on a website unless you are certain the site is legitimate and you initiated the purchase. Phishing websites designed to look like real retailers will ask for your CVV to steal it. If you are unsure whether a website is real, type the company name and the word "scam" into a search engine, or call the company's customer service number from their official website (not from a link in an email) and ask whether they are running a promotion or sale.

How CVV fraud happens and how to protect yourself

CVV fraud typically occurs in one of three ways. First, a thief photographs or screenshots your card while it is in your hand or on a table. Second, a scammer tricks you into reading your CVV aloud or typing it into a fake website. Third, a data breach at a merchant exposes your card information along with your CVV — though this is less common because merchants are supposed to delete the CVV after each transaction.

To protect yourself, treat your CVV the same way you treat your PIN at an ATM: shield it from view when you enter it, do not write it down, and do not photograph it. If you take a photo of your card for your records, crop the image so the CVV is not visible. Do not store photos of your full card (front and back) on your phone or computer.

If you receive an email or text claiming to be from your bank or a retailer and asking for your CVV, do not respond. Report it as phishing to your card issuer. Most banks have a fraud reporting number on the back of your card. If your CVV has been compromised — for example, you shared it with a scammer — contact your card issuer when ready. They can cancel your card and issue a replacement with a new CVV.

What happens if your CVV is stolen

If someone obtains your CVV along with your card number and expiration date, they can attempt online and phone purchases in your name. However, they cannot use it at a physical store, because in-person transactions do not require a CVV — the card reader accesses the chip or magnetic stripe instead.

If you notice unauthorized charges on your statement, contact your card issuer right away. Federal law (the Fair Credit Billing Act) limits your liability for unauthorized charges to $50, and most card issuers waive even that if you report fraud promptly. The issuer will investigate the charges, and if they confirm fraud, they will remove them from your account and send you a replacement card with a new CVV.

You do not have to pay for fraudulent charges while the investigation is underway. Keep records of when you reported the fraud and to whom, and follow up in writing if the issuer asks you to do so. Most disputes are resolved within 30 to 60 days.

CVV versus other card security features

Your CVV is one layer of security, but not the only one. Your card also has a chip (if it was issued after 2015) that generates a unique code for each transaction, making it harder to clone. Older cards have only a magnetic stripe, which is easier to copy but still requires the CVV for online purchases.

Your card issuer also monitors your account for unusual activity. If you make a purchase in New York and then another in Los Angeles two hours later, the system may flag it as fraud and decline the second transaction. You can also set up purchase alerts through your bank's app or website so you receive a notification every time your card is used.

Some cards offer additional protections like purchase protection (coverage if an item you bought is damaged or not delivered) or fraud monitoring services. Check your card's terms to see what protections come with it. These are separate from the CVV but work together to reduce your risk.

Frequently Asked Questions

Is my CVV the same as my PIN?

No. Your PIN is a number you create and use at ATMs and in-store card readers. Your CVV is printed on the card by the issuer and is used only for online and phone purchases. They serve different purposes and are not interchangeable.

Can I use my card online without entering a CVV?

Most websites require a CVV for security reasons, but some do not — particularly if you have saved your card information with that merchant before. However, entering a CVV is standard practice and reduces fraud risk, so merchants that skip it are taking on more liability.

What if I forgot my CVV?

Look at the back of your physical card. If you do not have the card with you, you can log into your bank's app or website and view a digital image of your card, which usually displays the CVV. If you still cannot find it, call your card issuer's customer service number on the back of your card.

Does my CVV change if I get a replacement card?

Yes. Each time your card issuer sends you a new card — whether because yours expired, was lost, or was compromised — the new card will have a different CVV. This is why replacing a card after fraud is effective: the old CVV becomes useless.

Can a merchant legally store my CVV?

No. The Payment Card Industry Data Security Standard (PCI DSS) forbids merchants from storing your CVV after a transaction. If a merchant saves it, they are violating the rule and putting your security at risk. You can report this to your card issuer or to the PCI Security Standards Council.