The CVC is a three-digit security code printed on the back of your card

The CVC (Card Verification Code) is a three-digit number on the back of your credit card, usually printed to the right of your signature line. Visa and Mastercard call it the CVV (Card Verification Value), but they mean the same thing. American Express prints a four-digit code on the front instead, also called the CID (Card Identification).

The code exists for one reason: to prove you physically have the card when you make an online or phone purchase. A thief who steals your card number but doesn't have the physical card cannot complete most online transactions without it. The merchant sends this code to the payment processor, which checks it against the number on file — but does not store it. That's why you have to type it in every time.

This is different from your PIN, which you use at an ATM or in-person at a store. The CVC is only for remote purchases — online, by phone, or by mail.

Key Takeaways

  • The CVC is a three-digit code on the back of your card (four digits for American Express on the front) that proves you have the card in your hand.
  • You must enter the CVC when you shop online or by phone, but the merchant never stores it — it is checked and discarded.
  • Never give your CVC to anyone who calls you or emails you, even if they claim to be from your bank or card company.
  • If your card is lost or stolen, call your card issuer when ready; the CVC alone cannot be used to make purchases without the card number and expiration date.

Why merchants ask for it and what they do with it

When you enter your card number, expiration date, and CVC on a website, the merchant's payment processor runs a check called CVV verification. The processor compares the CVC you entered to the one stored in the card network's database. If they match, the transaction is more likely to be approved. If they don't match, the transaction is usually declined.

The key point: the merchant does not store your CVC. By law and by payment network rules, they cannot keep it. Once the transaction is approved or declined, that code is deleted. This is why you have to enter it again the next time you shop — even at the same store. If a merchant's database is hacked, your CVC is not in there to steal.

This verification step catches some fraud, but not all. A thief with your card number and expiration date can still guess a three-digit code — there are only 1,000 possible combinations. That's why card networks and banks also use other fraud checks, like comparing the purchase to your normal spending patterns or checking whether the billing address matches.

The difference between CVC and other card security features

Your credit card has several numbers on it, and they do different jobs. Your card number (usually 16 digits) identifies your account. Your expiration date tells the merchant when the card stops working. Your CVC proves you have the card. Your PIN (if you set one up) proves you know a secret number — you use it at ATMs and sometimes in stores.

Some cards also have a chip, a small metal square embedded in the front. The chip creates a one-time code for each in-person transaction, which is harder to counterfeit than the magnetic stripe. You don't need to do anything with the chip — the card reader reads it automatically when you insert or tap the card.

Online, the chip does not work. That's why merchants ask for the CVC instead — it's the closest thing to proof that you have the physical card.

When you should and should not share your CVC

Share your CVC only when you are making a purchase from a merchant you trust, on a website that looks legitimate, or over the phone to a company you called yourself. Look for "https://" at the start of the web address and a small lock icon in your browser — these mean the connection is encrypted.

Never give your CVC to anyone who calls you, texts you, or emails you first, even if they claim to be from your bank or card company. Your bank will never ask for your CVC by phone or email. If someone calls claiming there is a problem with your card, hang up, find the phone number on the back of your card, and call your bank directly. That way you know you are talking to the real company.

Do not write your CVC on a check or include it in an email. Do not photograph your card and send the photo to anyone. Do not give it to a cashier in a store — they should never ask for it.

What happens if your CVC is compromised

If someone has your CVC but not your card number or expiration date, they cannot make purchases. The CVC is useless without the other numbers. If you think your CVC was exposed — for example, because a website you used was hacked — you do not need to panic, but you should watch your card for fraudulent charges.

If someone has your full card number, expiration date, and CVC, they can attempt online purchases. Check your card statement regularly (at least weekly) for charges you did not make. Most card companies offer fraud protection, which means you are not responsible for unauthorized charges if you report them quickly — usually within 60 days of the statement date.

If you see fraud on your statement, call the number on the back of your card right away. Your card issuer will cancel the card and send you a new one with a new CVC. The old CVC becomes worthless the moment the card is cancelled.

How CVC fits into your overall card security

The CVC is one layer of protection, not the whole system. It stops some fraud — specifically, fraud by someone who has your card number but not your physical card. But it does not stop fraud by someone who has stolen your card itself, and it does not stop fraud by someone who has hacked a merchant's database and stolen your full card details.

That's why card networks and banks use multiple checks: the CVC, address verification, spending pattern analysis, and chip technology for in-person purchases. If you see a charge you did not make, report it when ready. If you lose your card, call your issuer right away. If you shop online, use strong passwords and shop only on websites you recognize.

Frequently Asked Questions

Can someone use my card with just the CVC?

No. They need your card number and expiration date too. The CVC alone is worthless. However, if they have all three pieces of information, they can attempt online purchases.

Why does American Express have a four-digit code instead of three?

American Express uses a four-digit code for additional security. The extra digit makes it slightly harder to guess. The process works the same way — the merchant checks it during checkout and does not store it.

Is it safe to save my CVC on a website for faster checkout?

No. Websites are not supposed to store your CVC, and you should not ask them to. If a website offers to save it, that is a sign the site may not follow security rules. Enter your CVC fresh each time you shop.

What if I gave my CVC to a scammer?

Call your card issuer when ready. Tell them you gave out your CVC and ask them to watch for fraud. They may cancel your card and issue a new one. Monitor your statement for unauthorized charges and report any you find within 60 days.

Does the CVC protect me from in-person fraud?

No. The CVC is only for online and phone purchases. In stores, your chip or magnetic stripe is used instead. That is why chip technology is more find for in-person shopping — it creates a one-time code that cannot be reused.