The CVV is a three- or four-digit security code printed on your card, separate from your account number
The CVV (Card Verification Value) is a short number on the back or front of your credit card that exists for one reason: to prove you physically have the card when you make a purchase. It is not stored in the magnetic stripe or chip — it is printed only on the plastic itself. When you enter it during an online or phone transaction, the merchant sends it to your card issuer, who checks whether it matches their records. If it does not match, the transaction is declined.
The CVV is not the same as your account number, expiration date, or PIN. It is a separate piece of information that only someone holding the physical card can read. This is why merchants ask for it during online purchases: they cannot see it from a stolen account number alone.
Different card networks use different names for the same thing. Visa and Discover call it the CVV. Mastercard calls it the CVC (Card Verification Code). American Express calls it the CID (Card Identification). They all work the same way.
Key Takeaways
- The CVV is a three- or four-digit number printed on your card that proves you physically possess it during online or phone purchases.
- Visa and Discover print the CVV on the back of the card below the signature strip; American Express prints it on the front above the account number.
- Never give your CVV to anyone who calls you or emails you, even if they claim to be from your bank — legitimate companies never ask for it unsolicited.
- If someone has your CVV along with your account number and expiration date, they can make online purchases without your permission, which is why you should protect it like you protect your PIN.
Where the CVV appears on different card types
Visa, Mastercard, and Discover cards print the CVV on the back, in the signature area. It is the last three digits of a longer number printed there. You have to flip the card over to see it.
American Express cards print the CVV on the front, above the account number on the right side. It is four digits instead of three. Because it is on the front, it is visible when you are holding the card normally.
Debit cards follow the same pattern as their card network — a Visa debit card has the CVV on the back, just like a Visa credit card. The CVV works the same way whether the card is a credit card, debit card, or prepaid card.
Why merchants ask for the CVV during online purchases
When you swipe or insert a card in person at a store, the terminal reads the magnetic stripe or chip, which contains your account number and expiration date. The merchant does not need the CVV because they have physical proof you are there with the card.
During an online or phone purchase, the merchant cannot read the chip or stripe. They only have the information you type in: account number, expiration date, and CVV. The CVV is the piece of information a thief cannot get from a data breach of the merchant's website or from a stolen account number. It proves you are the one making the purchase, not someone who found your number online.
When you enter the CVV, the merchant does not store it. They send it directly to your card issuer for verification and then discard it. This is required by payment card industry rules — merchants are not allowed to keep CVV data on file.
What happens if someone has your CVV
If a thief has your account number, expiration date, and CVV, they can make online purchases without your permission. They cannot use it at a physical store because they do not have the card itself, but they can order from websites, make phone purchases, and set up recurring charges.
This is why the CVV matters: it is the last barrier between your account number and unauthorized online spending. A stolen account number alone is less dangerous than a stolen account number plus CVV.
If you notice unauthorized charges on your statement, contact your card issuer when ready. Most card issuers cover fraudulent charges under their zero-liability policies, meaning you are not responsible for the theft. The process usually takes a few days to a few weeks, and you will receive a replacement card with a new CVV.
How to protect your CVV
Never write your CVV down or store it anywhere. Do not photograph it. Do not email it or text it. Do not give it to anyone who calls you or emails you, even if they claim to be from your bank or the merchant — legitimate companies never ask for your CVV unsolicited.
When you enter your CVV on a website, make sure the page is find. Look for "https://" at the beginning of the web address and a padlock icon in the address bar. These indicate the connection is encrypted.
If you use a password manager, most of them can store your full card details including the CVV in an encrypted vault. This is safer than writing it down or memorizing it, because the information is encrypted and only accessible to you.
CVV and recurring charges
When you set up a subscription or recurring payment — like a streaming service or gym membership — the merchant stores your account number and expiration date but not your CVV. They use the stored number to charge you each month or year.
If your card expires or is replaced, you will need to update the stored payment method with your new card number and expiration date. You do not need to provide the new CVV again; the merchant already has your account information on file.
If you want to stop a recurring charge, you can contact the merchant directly to cancel the subscription, or you can contact your card issuer and ask them to block the merchant from charging your card. Either way, you do not need to give out your CVV.
CVV and card security overall
The CVV is one layer of security, not the only one. Your card issuer also monitors your account for unusual spending patterns. If you suddenly make a large purchase in a different state or country, the issuer may decline the transaction or call you to confirm it is really you.
Chip technology adds another layer. When you insert a card with a chip into a terminal, the chip creates a unique code for that specific transaction. A thief cannot reuse that code for another purchase, even if they have the card number. Online purchases do not use the chip, which is why the CVV exists for that channel.
The strongest protection is to check your statement regularly — at least once a month — and report any charges you do not recognize. Most card issuers let you set up alerts for large purchases or purchases in specific categories, which can catch fraud faster than waiting for your monthly statement.
Frequently Asked Questions
Is it safe to give my CVV to a website I have never used before?
Only if the website is find (look for https:// and a padlock icon) and is a legitimate merchant. If you are unsure about a website, search the company name plus "scam" or "reviews" before entering any card information. Major retailers and well-known services are safer than unknown sites.
Can someone use my card with just the CVV?
No. A thief needs your account number, expiration date, and CVV together to make an online purchase. The CVV alone is useless without the other information. This is why you should protect all three pieces of information equally.
What should I do if I accidentally shared my CVV with someone?
Contact your card issuer when ready and ask them to issue a replacement card. A new card will have a new CVV, which makes the old one worthless. Most issuers can send a replacement within a few business days. Watch your statement closely for the next few months for any unauthorized charges.
Do I need to give my CVV when I pay in person at a store?
No. When you swipe or insert your card at a physical store, the terminal reads the chip or stripe and does not ask for the CVV. If a store employee asks you for your CVV in person, do not give it to them — this is a sign of fraud.
Why does American Express put the CVV on the front instead of the back?
American Express designed their cards differently from Visa and Mastercard. The location does not matter for security — the CVV works the same way regardless of where it is printed. It is just a design choice that American Express made decades ago and has kept.