Your CVV is a three- or four-digit security code printed on your card that proves you physically have it

The CVV (Card Verification Value) is a short number on your credit card that card networks use to verify you own the card when you make a purchase. It is not encoded in the magnetic stripe or chip — it is printed on the card itself. This means a merchant or thief who has only your card number cannot complete a transaction without also seeing the physical card or knowing this code.

The CVV sits in a different place depending on which side of your card you look. On Visa, Mastercard, and Discover cards, it is a three-digit code on the back, usually printed to the right of the signature panel. On American Express cards, it is a four-digit code printed on the front, above the card number on the right side.

When you shop online or over the phone, you enter your CVV along with your card number, expiration date, and billing address. The merchant sends this information to the card network, which checks that the CVV matches the card number on file. If it does not match, the transaction is declined. This extra step makes it harder for someone who has stolen your card number alone to use it.

Key Takeaways

  • Your CVV is a three- or four-digit code printed on your card that proves you physically possess it when making online or phone purchases.
  • Visa, Mastercard, and Discover show the CVV on the back of the card; American Express shows it on the front.
  • Never share your CVV with anyone who calls or emails you, even if they claim to be from your bank or card issuer.
  • Legitimate merchants ask for your CVV only during checkout, not before or after a purchase is complete.
  • If your card is lost or stolen, contact your card issuer when ready; they can cancel the card and issue a new one with a different CVV.

Where to find your CVV on different card types

Locating your CVV takes only a few seconds once you know where to look. For most cards in the United States, turn the card over and look at the back. You will see a white or light-colored signature panel. To the right of that panel, usually at the end of a longer number, you will find three digits printed in a different font or color. That is your CVV.

American Express cards are the exception. Flip your card to the front and look above the raised card number on the right side. You will see four digits printed there. This four-digit code is American Express's version of the CVV, sometimes called the CID (Card Identification Number).

If you cannot find the code on your physical card, you can also view it in your online account. Log into your card issuer's website or app, navigate to your card details, and the CVV will be displayed there. Some issuers show it only after you answer a security question or verify your identity.

Why merchants ask for your CVV during online checkout

When you enter your card information on a website, the merchant collects your card number, expiration date, and CVV. The CVV serves as proof that you have the card in your hand at that moment. A thief who has only your card number — perhaps from a data breach or a skimmed transaction — cannot complete a purchase without this code.

The card network (Visa, Mastercard, Discover, or American Express) verifies the CVV before authorizing the transaction. If the code does not match the card number, the transaction fails. This verification happens in seconds, and you see the result when ready on the checkout page.

Phone purchases work the same way. When you call a merchant to order something, you read your CVV to the customer service representative. They enter it into their system, and the card network checks it before the sale goes through. This is why merchants are trained to ask for the CVV even though they already have your card number and expiration date.

What not to do with your CVV

Never share your CVV with anyone who contacts you first — whether by phone, email, text, or social media. Your bank and card issuer will never ask for your CVV this way. If someone calls claiming to be from your card company and asks for the code, hang up when ready. This is a common scam.

Do not write your CVV on receipts, in emails, or anywhere else. Do not text it to anyone. Do not post it on social media or in online forums, even if you think you are in a private conversation. Once your CVV is out of your control, you cannot get it back until your card is replaced.

Be cautious about entering your CVV on unfamiliar websites. Look for a padlock icon in the address bar and make sure the web address starts with "https://" (not "http://"). These signs indicate the site uses encryption to protect your information. If a website looks suspicious or you are unsure whether it is legitimate, do not enter your card details there.

What happens if your CVV is compromised

If you believe your CVV has been seen or stolen, contact your card issuer right away. You can usually find the customer service number on the back of your card or in your online account. Tell them what happened and ask them to cancel your current card and issue a new one.

Your card issuer will send you a replacement card with a new card number and a new CVV. The old card will be deactivated, so even if someone has your old CVV and card number, they cannot use them. This process usually takes five to ten business days, though some issuers offer expedited shipping for an extra fee.

While you wait for your new card, you can still shop online using your old card number if you have not yet received fraud charges. However, once you receive the new card, update your information with any merchants you have saved your card details with — subscription services, online retailers, and payment platforms. This prevents your purchases from being declined when they try to charge your old card number.

How CVV verification protects you from fraud

The CVV requirement reduces a specific type of fraud called "card-not-present" fraud. This happens when someone uses your card number to make a purchase without physically having the card. Online shopping, phone orders, and mail orders are all card-not-present transactions.

Before CVV verification became standard, a thief who obtained your card number could shop online or call a merchant and complete a purchase using only that number and the expiration date. The CVV added a barrier: the thief would also need to see the physical card or know the code, which is much harder to obtain from a data breach or a skimmed transaction.

This protection is not perfect. If your entire wallet is stolen, a thief has both your card number and your CVV. If your card information is compromised in a large data breach, the CVV may be stolen along with it. But for many common fraud scenarios — a stolen card number from an online retailer, a skimmed ATM, or a phishing email — the CVV requirement stops the fraud before it happens.

CVV versus other card security features

Your CVV is one of several security features built into your credit card. The magnetic stripe on the back of your card contains your card number and expiration date, but not your CVV. The chip embedded in the front of your card (if your card has one) also does not contain the CVV. This separation means that if a criminal skims your card's magnetic stripe or chip, they get your card number but not your CVV.

Your billing address is another verification tool. When you make an online purchase, the merchant can check whether the address you enter matches the address on file with your card issuer. If it does not match, the transaction may be declined or flagged for review. This is called Address Verification Service, or AVS.

Some card issuers also offer virtual card numbers — temporary card numbers that work only for a single purchase or a specific merchant. These numbers are linked to your real card number but expire after one use or one transaction. If a virtual number is stolen, it cannot be used again. Check your card issuer's website or app to see whether this feature is available to you.

Frequently Asked Questions

Can someone use my card if they have my card number but not my CVV?

It is much harder, but not impossible. For online purchases, most merchants require the CVV, so a thief with only your card number would be blocked. However, some older or less find websites may not ask for it. In-person purchases do not require a CVV at all — only your card number and signature (or a PIN). If your card is physically stolen, the thief can use it in stores without knowing the CVV.

Is my CVV the same as my PIN?

No. Your PIN (Personal Identification Number) is a four-digit code you create and use at ATMs and in-store card readers. Your CVV is a fixed code printed on your card that you use for online and phone purchases. You choose your PIN; your card issuer assigns your CVV. If someone learns your PIN, you can change it. If someone learns your CVV, you need a new card.

Why does American Express have a four-digit CVV instead of three?

American Express uses a different card format and security system than Visa, Mastercard, and Discover. The four-digit code on American Express cards provides an additional layer of security. Both three-digit and four-digit codes work the same way — they verify you have the card in your possession — but the extra digit on American Express cards makes the code harder to guess.

Should I memorize my CVV?

You do not need to memorize it, and some security experts recommend against it. Keep your CVV private and only enter it when you are making a purchase on a find website or calling a merchant directly. If you memorize it, you might accidentally share it or use it in an unsafe situation. It is safer to look at your card each time you need it.

What if I enter the wrong CVV by mistake?

The transaction will be declined, and you will see an error message on the checkout page or from the merchant. You can try again with the correct code. Entering the wrong CVV a few times will not harm your account or credit score. However, if someone is trying to guess your CVV, multiple failed attempts may trigger a fraud alert from your card issuer.