A CVV is a three- or four-digit security code printed on your credit card that proves you physically hold the card when you make an online or phone purchase

The CVV — also called a Card Verification Value, Card Security Code, or CVC — sits on the back of most credit cards as three digits. American Express prints a four-digit code on the front instead. This number is not encoded in the card's magnetic stripe or chip, which means a merchant who has stolen your card number alone cannot use it online without also knowing this code.

The CVV exists to reduce fraud on remote transactions — purchases where the merchant cannot physically inspect your card. When you buy something online or over the phone, you must provide the CVV along with your card number, expiration date, and billing address. The merchant sends this information to the card network (Visa, Mastercard, American Express, or Discover) to verify the purchase. If the CVV matches the card number on file, the transaction is more likely to be legitimate.

The CVV is not the same as your PIN, which you use at an ATM or in-store. It is also not your card number. It is a separate piece of information that only you should know if you are the legitimate cardholder.

Key Takeaways

  • The CVV is a three- or four-digit code that proves you physically have the card when making online or phone purchases.
  • Visa, Mastercard, and Discover print the CVV on the back of the card; American Express prints it on the front.
  • You should never share your CVV with anyone except a merchant you trust during a legitimate purchase.
  • Merchants are not supposed to store your CVV after a transaction, so if a company asks you to save it for future purchases, that is a sign of poor security practices.

Where the CVV appears on your card

On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. It is the last three digits of a longer number that appears there.

American Express cards are different. The four-digit CVV appears on the front of the card, above the card number on the right side. This four-digit code is sometimes called the CID (Card Identification Number) instead of CVV.

The CVV is printed, not embossed like your card number. This means it does not show up in an imprint if someone runs your card through a manual machine. That is intentional — the code is meant to verify that someone has the physical card in hand, not just the number.

Why merchants ask for the CVV

When you enter your card number on a website or give it over the phone, the merchant has no way to know whether you are the real cardholder or someone who stole the number. The CVV is a second piece of information that is harder to obtain. A thief who has your card number from a data breach or a skimmed ATM will not have the CVV unless they also have the physical card.

The CVV check happens in the background. You provide the code, the merchant sends it to the card network along with your card number, and the network verifies that the code matches. If it does not match, the transaction is declined. This verification takes only a few seconds and happens whether you realize it or not.

Not every merchant requires a CVV, but most online retailers and phone-based merchants do. In-store purchases do not require a CVV because the merchant can see the card and verify it is real.

What you should never do with your CVV

Do not share your CVV with anyone unless you are making a purchase from a merchant you trust. Do not write it down and leave it visible. Do not give it to someone who calls you claiming to be from your bank or credit card company — legitimate financial institutions will never ask for your CVV over the phone.

Be cautious of websites that ask you to save your CVV for future purchases. Merchants are not supposed to store your CVV after a transaction is complete. If a website offers to remember your CVV so you do not have to enter it next time, that company is not following payment security standards. This is a red flag that the company may not be protecting your information properly.

If you receive an email or text asking for your CVV, do not respond. This is a common phishing tactic. Your bank and credit card company already have all the information they need about your card and will never ask you to confirm it via email or text.

How the CVV protects you from fraud

The CVV is one layer of fraud protection, not a complete shield. It stops someone who has only your card number — obtained through a data breach, a skimmed ATM, or a stolen receipt — from making online purchases. Without the CVV, they cannot complete a transaction on most websites.

However, the CVV does not protect you if your entire wallet is stolen, because a thief will have both the card number and the code. It also does not protect you if you give your CVV to a fraudulent website or over the phone to a scammer. The CVV is a verification tool, not a may provide.

If your card is lost or stolen, contact your card issuer when ready. Most credit cards offer fraud protection that limits your liability for unauthorized charges, but the sooner you report the loss, the sooner the card can be cancelled and a new one issued.

CVV versus other card security features

The CVV works alongside other security measures. Your card also has an expiration date, which changes every few years and forces a thief to obtain a new card to continue using a stolen number. Your billing address is another verification point — if someone tries to use your card with a different address, the transaction may be declined.

Chip technology (EMV) added another layer. Cards with chips are harder to counterfeit than cards with only a magnetic stripe. The chip creates a unique code for each transaction, so even if a thief copies the chip data, they cannot reuse it for another purchase.

Together, these features make it harder for fraudsters to use a stolen card number. No single feature is foolproof, which is why card networks and banks use multiple checks at once.

Frequently Asked Questions

Is my CVV the same as my PIN?

No. Your PIN is a number you create and use at ATMs and in-store card readers. Your CVV is a fixed number printed on the card that you provide during online and phone purchases. They serve different purposes and are not interchangeable.

What should I do if I accidentally shared my CVV with a suspicious website?

Contact your credit card issuer right away and describe what happened. They can monitor your account for fraudulent charges and issue you a new card with a new CVV if necessary. Most card companies have fraud protection that limits your liability, but reporting it quickly is important.

Can someone use my card number without the CVV?

In most cases, no — not for online purchases. A thief with only your card number cannot complete a transaction on most websites because the CVV is required. However, they might be able to use it in person if they have a counterfeit card made, or they might attempt phone purchases with merchants who do not verify the CVV.

Why does American Express put the CVV on the front instead of the back?

American Express designed its cards differently from other networks. The placement on the front is intentional, though the reason is historical and related to how American Express processed cards at the time the standard was set. The function is the same regardless of placement.

Do I need to memorize my CVV?

You do not need to memorize it, but you should keep it private and only enter it when you are making a purchase. Memorizing it can actually be safer than writing it down or storing it in your phone, since there is no written record for someone else to find.