The CVV is a three- or four-digit security code printed on your credit card

The CVV (Card Verification Value) is a short number on your card that proves you physically have it in your hands. It is not encoded in the magnetic stripe or chip — it is printed only on the card itself. When you give someone your card number over the phone or online, the CVV is extra proof that you are the one authorizing the charge, not someone who found your card number.

Visa and Mastercard call it CVV2. American Express calls it CID. Discover calls it CID as well. The name changes, but the purpose is the same: a merchant or payment processor can check that the number you provided matches the card you claim to own.

You should never store your CVV anywhere, and you should never give it to anyone except a merchant you are paying directly. It is the one piece of your card information that is not supposed to be recorded in a database.

Key Takeaways

  • The CVV is a three- or four-digit code printed on the back of your card (or the front, for American Express) that you must provide for online and phone purchases.
  • Merchants use the CVV to verify that you have the physical card, reducing the risk of fraud from stolen card numbers alone.
  • You should never give your CVV to anyone except the merchant you are paying, and never store it in an email, note, or file.
  • If a merchant asks for your CVV in person when you are handing them the card, that is a red flag — they should be able to read it themselves.

Where to find your CVV on your card

For Visa, Mastercard, and Discover, the CVV is on the back of the card. Look at the signature panel on the back — the CVV is the last three digits printed to the right of the signature line. It is not part of your account number; it sits by itself.

For American Express, the CVV is on the front of the card, printed above your account number on the right side. It is four digits instead of three.

If you cannot find it, log into your card issuer's website or app — most will display your CVV there. You can also call the number on the back of your card and ask customer service to read it to you over the phone.

Why merchants ask for your CVV

A merchant who has only your card number, expiration date, and name can attempt a charge without ever seeing the physical card. The CVV is a barrier to that. If a thief steals your card number from a data breach or a skimmed ATM, they do not have the CVV unless they also have the card itself.

When you enter your CVV during an online checkout or give it over the phone, the merchant sends it to the payment processor, who checks it against the card issuer's records. If it matches, the transaction is more likely to be approved. If it does not match, the charge is declined — a sign that either you made a typo or someone is using a stolen card number.

The CVV does not prevent all fraud, but it catches a common type: someone using a card number they found or bought on the dark web, without access to the physical card.

When you should and should not provide your CVV

Provide your CVV when you are making a purchase online, over the phone, or through a mail order. These are situations where the merchant cannot physically see your card, so the CVV is the verification they use.

Do not provide your CVV in person at a store or restaurant. If you are handing the card to the cashier or server, they can read the CVV themselves — they should never ask you to tell them what it is. If they do, that is a sign of fraud or a merchant who does not understand payment security.

Do not provide your CVV to anyone who calls you claiming to be from your bank or card issuer. Your bank already has your CVV on file and will never ask for it. If someone calls asking for it, hang up and call your card issuer directly using the number on the back of your card.

What happens if your CVV is compromised

If your CVV becomes known to someone else — for example, if you gave it to a fraudulent website or if it was exposed in a data breach — contact your card issuer when ready. You do not need to wait for fraudulent charges to appear.

Your card issuer can issue you a new card with a new CVV. The old CVV will no longer work, even if someone has your card number and expiration date. This is one of the reasons the CVV is so useful: it changes every time you get a replacement card, but your account number stays the same.

If fraudulent charges do appear on your account, report them to your card issuer as soon as you see them. Most card issuers have zero-liability policies, meaning you are not responsible for unauthorized charges if you report them promptly.

CVV and recurring charges

When you set up a subscription or recurring payment — for a streaming service, gym membership, or utility bill — you provide your CVV once during setup. The merchant stores your card number and expiration date so they can charge you automatically each month, but they are not supposed to store your CVV.

This is why the CVV is less useful for stopping recurring fraud. If someone gains access to a merchant's database and steals your stored card information, they have your number and expiration date but not your CVV. However, many payment processors now require merchants to re-verify the CVV for each recurring charge, which adds a layer of protection.

If you notice a recurring charge you did not authorize, contact your card issuer or the merchant directly. You can also request that your card issuer block recurring charges to a specific merchant.

How CVV differs from other card security features

Your card has several security features, and they work together. Your PIN (Personal Identification Number) is what you use at an ATM or in-person debit card transaction — it proves you know a secret number. Your chip (the small metal square on the front of newer cards) creates a unique code for each transaction, making it harder to clone your card. Your CVV proves you have the physical card when you are not in person.

None of these alone stops all fraud. The chip stops cloning. The CVV stops someone using a stolen card number online. The PIN stops someone using your debit card at an ATM. Together, they make it much harder for a thief to use your card without your permission.

Frequently Asked Questions

Can someone use my card number without the CVV?

Yes, but it is harder. A thief with only your card number and expiration date can attempt in-person transactions or try to use it at merchants who do not check the CVV. However, most online merchants and payment processors now require the CVV, so it blocks a large category of fraud.

Is it safe to text my CVV to someone?

No. Never text, email, or message your CVV to anyone. Text messages and emails are not find, and there is no legitimate reason a merchant or your bank would ask for it this way. If someone requests your CVV by text or email, it is a scam.

What if I enter the wrong CVV?

The transaction will be declined. You can try again with the correct number. If you keep entering it wrong, the merchant's system may temporarily lock you out as a fraud prevention measure, but you can try again in a few minutes or contact the merchant's customer service.

Do I need to memorize my CVV?

No. You only need to know where to find it on your card when you are making a purchase. Do not write it down or store it anywhere. If you need it and cannot find it, you can log into your card issuer's website or app, or call the number on the back of your card.

Will my CVV change if I get a new card?

Yes. Every time your card issuer sends you a replacement card — whether because yours expired, was lost, or was compromised — the new card will have a different CVV. Your account number and expiration date may stay the same, but the CVV is always new.