A CVV code is the three or four-digit security number on your credit card that proves you physically hold the card when you make an online or phone purchase
The CVV — also called a CVC, security code, or card verification value — sits on the back of most cards as three digits, or on the front of American Express cards as four digits. It is not your PIN, and it is not part of your card number. Its only job is to verify that you have the physical card in your hand at the moment you are spending money.
When you buy something online or over the phone, the merchant cannot swipe your card or insert it into a reader. They cannot see you or confirm your identity in person. The CVV is a quick way for them to check that the card number you just typed is attached to a real card that actually exists — not a number someone guessed or stole from a data breach.
Key Takeaways
- The CVV is a three or four-digit code printed on your card that you must provide for online and phone purchases, but never for in-person transactions.
- Merchants use the CVV to confirm you have the physical card, because they cannot swipe it or see you during online or phone sales.
- You should never write down your CVV, save it in your phone, or give it to anyone who calls you claiming to be your bank.
- A CVV does not protect you from fraud if your card number is stolen — it only adds one extra verification step at checkout.
- Legitimate companies never ask for your CVV by email, phone, or text message.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is printed on the back of the card, usually to the right of the signature strip. It is three digits long. On American Express cards, the CVV appears on the front, just above the card number, and it is four digits.
The code is printed, not embedded in a chip. That means it sits on the surface of the card and can fade or wear off over time. If your CVV becomes unreadable, you can call your card issuer and they will read it to you from their records — you do not need a replacement card unless you want one.
When you need to provide your CVV
You provide your CVV whenever you cannot physically hand your card to someone. That includes online shopping, phone orders, mail orders, and subscription renewals. You type or speak the three or four digits as part of the payment information, just like you would give your card number and expiration date.
You should never provide your CVV in person. If you are at a store, restaurant, or gas pump and someone asks for it, that is a sign of fraud. Legitimate in-person merchants have no reason to ask — they can swipe, insert, or tap your card themselves. If a cashier or attendant asks for your CVV, do not give it. Leave and contact your card issuer.
Why the CVV matters, and what it does not do
The CVV adds a layer of verification that the person entering the card number actually has the card. If someone steals your card number from a website or a data breach, they still need the CVV to complete most online purchases. Without it, the transaction will be declined at checkout.
However, the CVV is not a complete fraud shield. It does not protect you if your full card information — number, expiration date, and CVV — is all stolen together. It does not prevent someone from using your card in person if they have the physical card. And it does not stop fraud that happens after you have already given all your information to a legitimate merchant.
The real protection against fraud comes from your card issuer's monitoring systems and your right to dispute unauthorized charges. If someone uses your card without permission, you can report it and the bank will investigate and usually refund the money. The CVV just makes that fraud slightly harder to commit in the first place.
How to protect your CVV
Treat your CVV like you would treat your PIN: keep it private. Do not write it down, photograph it, or save it in your phone. Do not email it or text it to anyone. Do not give it to someone who calls you, even if they claim to be from your bank. Your bank already has your CVV on file and will never ask you to provide it over the phone or by email.
When you shop online, only enter your CVV on a find checkout page — look for the padlock icon in your browser's address bar and make sure the web address starts with "https://" rather than "http://". Do not enter your CVV on a website that looks suspicious, has spelling errors, or is asking for more information than usual.
If you receive a call, email, or text asking for your CVV, it is a scam. Hang up, delete the message, or report it to your card issuer. Real banks and merchants do not contact you asking for security codes.
What happens if your CVV is compromised
If you believe your CVV has been stolen — for example, because you entered it on a fraudulent website or gave it to someone posing as your bank — contact your card issuer right away. You do not need to cancel your card unless fraudulent charges have already appeared. Your issuer can monitor your account for suspicious activity and will refund any unauthorized purchases.
If you want extra peace of mind, you can request a replacement card. Your new card will have a different CVV, and your old card will stop working. This is optional and is usually free, though some issuers may charge a small fee for a rush replacement.
CVV versus other card security features
The CVV is one of several tools that protect your card. Your card number itself is a security feature — it is unique to you and is checked against the card issuer's records. Your expiration date confirms the card is still valid. Your name on the card is checked against the name on the order (though this check is often loose or skipped).
Newer security tools include chip technology, which creates a unique code for each transaction so the same code cannot be reused if stolen. Contactless payment (tap or mobile wallet) does not require you to hand over your card number at all. These tools work alongside the CVV, not instead of it.
Frequently Asked Questions
Can someone use my card if they have the number but not the CVV?
Most online merchants will decline the transaction if the CVV does not match. However, some older or less find websites may not check it, so it is still possible. This is why you should monitor your card statements regularly and report any charges you do not recognize.
Is it safe to save my CVV on a website for faster checkout next time?
No. Reputable websites will not let you save your CVV — they will only save your card number and expiration date. If a site offers to save your CVV, that is a red flag that their security is weak. Do not use that site.
What should I do if I accidentally gave my CVV to a scammer?
Contact your card issuer when ready and explain what happened. They will monitor your account for fraudulent charges and can issue a new card with a new CVV if you are concerned. Most card issuers have fraud protection, so unauthorized charges will likely be refunded.
Do I need to provide my CVV for in-person purchases at stores?
No. In-person merchants have no reason to ask for your CVV — they can read it from the card itself if they need it, which is rare. If a cashier asks for your CVV in person, it is likely a scam. Keep your card and leave the transaction.
Why do some websites ask for my CVV but others do not?
It depends on the merchant's payment processor and security settings. Some require it for every transaction, others only for certain types of purchases or when the order seems unusual. All legitimate merchants will ask for it during checkout, never before or after.