The CVC is a three-digit security code printed on the back of your card that proves you physically have it
The CVC (Card Verification Code) is the three-digit number on the back of your credit card, usually printed to the right of your signature line. Visa and Mastercard call it the CVV (Card Verification Value), and American Express calls it the CID (Card Identification), but they all work the same way: the number proves to a merchant that you actually hold the physical card in your hand.
When you buy something online or over the phone, you cannot hand over your card for the merchant to swipe. The CVC bridges that gap. It is printed on the card itself but not stored in the magnetic stripe or chip, so a scammer who steals your card number alone cannot use it without also having the physical card or knowing this extra code.
The CVC is not the same as your PIN (the code you enter at an ATM or checkout terminal). It is not stored in your card's chip or stripe. It exists only as a printed number, which is why merchants ask for it during phone or online transactions but never need it when you swipe or insert your card in person.
Key Takeaways
- The CVC is a three-digit code on the back of your card (four digits for American Express) that merchants request during online and phone purchases.
- This code proves you have the physical card, since it is printed on the card itself and not stored in the magnetic stripe or chip.
- Never share your CVC with anyone except the merchant you are paying, and never enter it on a website unless you initiated the transaction.
- A stolen card number without the CVC is much harder for a scammer to use, which is why merchants require it for remote purchases.
Where to find your CVC and what it looks like
On Visa and Mastercard, the CVC is a three-digit number printed on the back of the card, usually to the right of the signature panel. On American Express, it is a four-digit code printed on the front of the card, above the card number on the right side. The number is always printed in a different color or style than the rest of the card to make it stand out.
The code is intentionally difficult to read in photographs or from a distance. If someone takes a photo of your card, the CVC is often blurry or obscured by the angle. This design choice is deliberate: it makes the code harder for a thief to capture without physically holding the card.
Why merchants ask for it during online and phone purchases
When you swipe or insert your card at a store, the merchant's terminal reads the data from your card's chip or stripe and processes the payment directly. You do not need to say your CVC out loud because the terminal already has it. But when you shop online or call a company to order, the merchant has no way to read your card. They only have the number you tell them or type in.
By asking for the CVC, the merchant confirms that you have the physical card in front of you. If a scammer has only stolen your card number (from a data breach, a skimmed ATM, or a compromised website), they cannot complete the purchase without also knowing this three-digit code. This extra step stops many fraudulent transactions before they happen.
The merchant never stores your CVC after the transaction is complete. Payment processors are required by law to delete it when ready. This means even if a merchant's database is hacked, the thief cannot recover your CVC because it was never saved in the first place.
The difference between CVC and other card security features
Your card has several layers of security, and the CVC is just one. Your card number itself is a 16-digit code (15 for American Express) that identifies your account. Your expiration date tells the merchant when the card stops working. Your name is printed on the front. But only the CVC proves you have the card right now.
Your PIN is different. You create your PIN yourself, and you enter it at ATMs or in-person at checkout terminals. The PIN is stored in your card's chip and is encrypted, so even the merchant cannot see it. The CVC is printed in plain sight on the card and is never encrypted. A merchant can see it, but they are not allowed to store it.
Your card's chip and magnetic stripe contain encrypted data that a terminal can read electronically. The CVC cannot be read this way — it exists only as a printed number. This is why a card with a damaged chip can still be used online (as long as you know the CVC), but a card with a faded or missing CVC cannot be used for remote purchases.
How to protect your CVC from theft
Treat your CVC like you treat your card number: keep it private. Never type it into a website unless you started the transaction yourself. Never give it to someone who calls you claiming to be from your bank or card company — legitimate companies will never ask for it over the phone. Never photograph your card or send a picture of it to anyone, because the CVC may be visible in the image.
When you shop online, only enter your CVC on the merchant's checkout page, not in an email or text message. Legitimate checkout pages use encryption to protect the information you type. If a website asks you to email your card details, that is a sign of a scam — real merchants never ask for this.
If your card is lost or stolen, call your card issuer when ready. They will cancel the card and issue a new one with a new CVC. Until then, your old card number and CVC are both at risk, so the card issuer will monitor your account for fraud.
What happens if someone has your CVC
If a scammer has your card number and CVC, they can make online and phone purchases in your name. They cannot use the card in a store (because they do not have the physical card), but they can order items for delivery or buy digital goods. This is why the CVC exists: to stop exactly this kind of fraud.
If you notice unauthorized charges on your statement, contact your card issuer right away. Most card companies have zero-liability policies, meaning you are not responsible for fraudulent charges if you report them promptly. The card issuer will investigate, reverse the charges, and send you a new card with a new CVC.
The longer you wait to report fraud, the harder it becomes to prove you did not make the purchase. Report it as soon as you see it. Your card issuer has a process for this and handles it regularly.
Frequently Asked Questions
Can I use my card online without entering the CVC?
Some merchants allow it, especially if you have an account with them and have used the card before. But most online retailers require the CVC for every purchase as a security measure. If a site does not ask for it, that does not mean it is unsafe — it just means the merchant has decided the risk is acceptable or you have already verified your identity with them.
Is it safe to save my CVC when I shop online?
No. Websites are not allowed to store your CVC, and you should not ask them to. If a site offers to save your CVC for future purchases, that is a red flag. Legitimate payment systems (like Apple Pay or PayPal) store your card number but never store the CVC. They ask you to enter it again each time, or they use other security methods instead.
What if I cannot read my CVC because it is faded or worn off?
Contact your card issuer and ask for a replacement card. They will send you a new one with a clear, readable CVC. In the meantime, you can still use the card in stores (because the terminal reads the chip), but you cannot use it for online or phone purchases without the CVC.
Do I need to memorize my CVC?
No. You should never memorize it or write it down. Keep it private and only look at it when you need to enter it during a purchase. Memorizing it increases the risk that you will accidentally say it out loud or type it in the wrong place.
Can a scammer use my card number without the CVC?
They can try, but most online and phone merchants will decline the transaction if the CVC does not match. In-person merchants do not ask for the CVC at all because they can read your card directly. So a stolen card number alone is much less useful to a scammer than a card number plus the CVC.