A CVV code is the three- or four-digit security number on your credit card that proves you physically have the card in your hand

The CVV (Card Verification Value) sits on the back of most credit cards as a three-digit number, or on the front of American Express cards as a four-digit number. It is not your PIN, and it is not printed on your statement. Merchants ask for it during online or phone purchases because it is supposed to be something only you can see — proof that you are the person making the charge, not someone who stole your card number.

The CVV is a security layer, but not a complete one. It reduces fraud risk in card-not-present transactions (online, phone, mail order), but it does not protect you if someone has both your card number and your CVV. That is why you should never give your CVV to anyone who calls you, texts you, or emails you claiming to be from your bank or card issuer.

Key Takeaways

  • The CVV is a three- or four-digit code printed on your physical card that merchants request to verify you have the card in your possession during online or phone purchases.
  • Your CVV is never stored in the magnetic stripe or chip on your card, and legitimate merchants do not keep it on file after a transaction completes.
  • You should never share your CVV with anyone who contacts you unsolicited, including people claiming to represent your bank or card company.
  • If your CVV is compromised, contact your card issuer to report the breach and request a replacement card with a new CVV.

Where the CVV appears on your card

For Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. You will see it after the last four digits of your card number are repeated.

American Express cards display a four-digit CVV on the front, above the card number on the right side. This four-digit code is sometimes called the CID (Card Identification Number) instead of CVV, but it serves the same purpose.

The CVV is printed in a different color or font than the rest of the card design, making it slightly harder to read in photographs. This is intentional — it is meant to be harder to capture in a photo or screenshot than your card number alone.

Why merchants request your CVV during checkout

When you buy something online or over the phone, the merchant cannot see your physical card. They have your card number, expiration date, and billing address, but they do not have proof you are holding the actual card. The CVV closes that gap. If you can provide the CVV, you presumably have the card in front of you.

Merchants use CVV verification to reduce their fraud losses. When a transaction includes a valid CVV, the card network (Visa, Mastercard, or Discover) flags it as lower risk. If the CVV does not match or is missing, the transaction may be declined or flagged for manual review. This protects both the merchant and your card issuer.

Some recurring charges — like subscriptions or monthly bills — may ask for your CVV the first time you set up the payment, then store your card number for future charges. Legitimate merchants do not store the CVV itself after that first transaction. If a merchant asks you to provide your CVV every single time you make a purchase with a card already on file, that is a sign something is wrong.

What happens if your CVV is exposed

If your CVV becomes known to someone else — through a data breach, a phishing email, or because you shared it with a scammer — contact your card issuer when ready. You do not need to wait for fraudulent charges to appear. Report the exposure as soon as you know about it.

Your card issuer will typically cancel your current card and send you a replacement with a new CVV. The old CVV becomes useless once the card is closed. This process usually takes five to ten business days. In the meantime, ask your issuer whether they can issue a temporary card number for online purchases, or whether you can use a digital wallet (Apple Pay, Google Pay) that does not expose your CVV to merchants.

You are not liable for fraudulent charges made with your card, even if the CVV was used correctly. Federal law (the Fair Credit Billing Act) limits your liability to $50, and most card issuers waive that entirely. Report fraud promptly so your issuer can investigate and reverse the charges.

CVV versus other card security features

The CVV is one of several security layers built into credit cards. Your card also has a chip (EMV) that generates a unique code for each in-person transaction, making it nearly impossible to clone. Your card number itself is tokenized by payment networks, meaning merchants do not always see the full number. Your bank monitors your account for unusual activity and can freeze your card if something looks wrong.

None of these features is foolproof on its own. A data breach can expose your card number and CVV together. A scammer can use your card number, expiration date, and CVV to make an online purchase. But together, these layers make it harder and more expensive for criminals to commit fraud at scale. The CVV is the simplest one you control directly — by never sharing it with anyone who contacts you first.

When you should and should not provide your CVV

Provide your CVV when you are making a purchase on a website you trust, over the phone to a merchant you called yourself, or through a payment app you downloaded from an official source. These are card-not-present transactions where the merchant needs proof you have the card.

Do not provide your CVV to anyone who calls, texts, or emails you unsolicited. Your bank will never ask for your CVV by phone or email. Do not provide it to someone claiming to verify your account, update your information, or confirm a charge. Do not type it into a link sent to you in an email, even if the email looks like it came from your bank. Do not provide it to a stranger in person who is not processing a payment in front of you.

If you are unsure whether a request is legitimate, hang up or close the email and call your card issuer directly using the number on the back of your card. Do not use a phone number from an email or text message. This extra step takes two minutes and protects you from most CVV scams.

Frequently Asked Questions

Can someone use my card number without the CVV?

Yes, but it is riskier for them. Many online merchants will accept a card number and expiration date without a CVV, though the transaction may be flagged as higher risk or declined. In-person purchases do not require a CVV at all. The CVV is most useful for stopping card-not-present fraud, not all fraud.

Is my CVV the same as my PIN?

No. Your PIN is a four-digit code you create and use at ATMs and in-store card readers. Your CVV is printed on the card and you do not choose it. Your bank never asks for your CVV, but they do ask for your PIN when you use an ATM. Never confuse the two or share either one.

What if I give my CVV to a scammer?

Contact your card issuer right away and report the breach. Ask them to cancel your card and send a replacement. Monitor your account for unauthorized charges. You are not liable for fraud, but reporting it quickly helps your issuer investigate and prevents the scammer from making multiple charges before the card is closed.

Do I need to memorize my CVV?

No. You should know where to find it on your card when you need it, but you do not need to memorize it. Memorizing it actually increases the risk that you will accidentally share it or type it in the wrong place. Keep it as something you look up only when you are actively making a purchase.

Why do some websites ask for my CVV every time I pay?

Legitimate merchants should only ask for your CVV the first time you provide your card information. If a website asks for it repeatedly, that is unusual and worth questioning. Contact the merchant's customer service to ask why, or consider using a different payment method or merchant if they cannot explain it.