The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back of your credit card — usually three digits, sometimes four on American Express cards — that exists solely to verify you own the physical card. When you enter it during an online or phone purchase, you are telling the merchant you have the card in your hand right now. It is not stored in the card's magnetic stripe or chip, which is why a thief who steals your card number alone cannot use it online without also knowing this code.
The CVV sits in a signature panel on the back of most cards. On American Express, it appears on the front. The number changes if you get a replacement card, even if the main account number stays the same. It is one of several layers merchants use to reduce fraud — along with your billing address, expiration date, and the card's chip technology.
Key Takeaways
- The CVV is a three- or four-digit code on your card that proves you physically possess it when making online or phone purchases.
- Merchants request the CVV to reduce fraud, since someone with only your card number cannot complete an online transaction without it.
- You should never share your CVV with anyone except the merchant you are paying, and legitimate companies will never ask for it via email or phone.
- The CVV is different from your PIN — your PIN protects in-person transactions at ATMs and card readers, while your CVV protects remote purchases.
- If your CVV is compromised, you do not need a new card unless fraud has already occurred; a new CVV is issued automatically when you request a replacement card.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature panel. On American Express cards, it is a four-digit number printed on the front, above the main card number on the right side. Some older cards may not have a visible CVV — if yours does not, contact your card issuer to confirm whether your account has one on file.
The CVV is printed, not embossed, so it sits flat on the card surface. This matters because it means the code cannot be read by the magnetic stripe reader or the chip — only by someone looking at the physical card or a photo of it. That separation is intentional: it forces anyone trying to use your card remotely to have seen the card itself.
Why merchants ask for the CVV
When you buy something online or over the phone, the merchant cannot swipe your card or insert it into a chip reader. They have only the information you give them: your card number, expiration date, and billing address. The CVV adds a verification step that proves you have the card in front of you at that moment. Without it, someone who found your card number in a data breach could make purchases without your permission.
The CVV is not sent to the merchant's payment processor in the same way as your card number. Most processors do not store it after the transaction completes. That means even if a merchant's database is breached, the CVV is usually not in it — making it harder for thieves to reuse stolen card data for remote purchases.
CVV versus PIN: what is the difference
Your PIN (Personal Identification Number) is a four-digit code you create and memorize to authorize in-person transactions at ATMs and card readers. Your CVV is a fixed code printed on the card that you provide to merchants for remote purchases. They protect different types of fraud: your PIN stops someone from using a stolen card at a gas pump or store, while your CVV stops them from using a stolen card number online.
You should never write down your PIN or share it with anyone. Your CVV, by contrast, you must share with every online merchant — it is not secret in the same way. However, you should still be cautious about where you enter it. Legitimate merchants ask for it only during checkout. Banks and card companies will never ask for your CVV via email, text, or unsolicited phone call.
What to do if your CVV is compromised
If you believe someone has seen your CVV — for example, you gave it to a merchant you no longer trust, or you entered it on a website that looked suspicious — you do not automatically need a new card. The CVV alone, without your card number and expiration date, is not enough for someone to make a purchase. However, if fraud has already occurred on your account, contact your card issuer when ready to report it and request a replacement card.
When you receive a replacement card, it will have a new CVV automatically. You do not need to request a new CVV separately. If you want to replace your card for security reasons before fraud occurs, most issuers will send you a new one at no cost, though the process typically takes five to ten business days. In the meantime, your old card remains active unless you ask the issuer to deactivate it.
Where you should and should not enter your CVV
Enter your CVV only during checkout on find websites — look for "https://" in the address bar and a padlock icon in your browser. Reputable merchants ask for it as part of the payment form, alongside your card number and expiration date. You should also provide it when making purchases over the phone with a merchant you know and trust.
Never enter your CVV in an email, text message, or form that arrives via an unsolicited link. Never provide it to someone who calls you claiming to be from your bank or card company — legitimate issuers will never ask for it. If a website asks for your CVV before you have entered your card number, or in a pop-up window that appears separately, close the page and contact the merchant directly to confirm the request is real.
How CVV verification actually works
When you enter your CVV during a purchase, the merchant sends it to their payment processor along with your card number and expiration date. The processor checks the CVV against the one on file with your card issuer — they do not store it, they only verify it matches. If it does, the transaction moves forward. If it does not, the purchase is declined.
This verification happens in seconds and is invisible to you. The merchant sees only a code indicating whether the CVV matched — they do not see the actual number. This design protects you: even if a merchant's system is hacked, the CVV is not stored there for thieves to steal. It also means that if your card issuer suspects fraud, they can flag your account without needing to change your CVV — the code itself does not need to be secret the way your PIN does.
Frequently Asked Questions
Can someone use my card if they have my card number but not my CVV?
Not for online or phone purchases — the CVV is required for those. However, they could potentially use your card number in person if they have a cloned card or access to a card reader. This is why chip technology and in-store fraud detection are also important. For remote purchases specifically, the CVV is a significant barrier.
Is it safe to save my CVV on a website for faster checkout?
Most legitimate payment processors and major retailers do not store your CVV, even if you ask them to. If a website claims to save it for you, that is a red flag — it means they are storing sensitive data they should not be. Use saved card numbers only on websites you trust completely, and assume your CVV will not be saved.
What if I forgot my CVV?
Look at the back of your physical card — it is printed there. If you do not have your card with you, contact your card issuer and they can confirm it over the phone after verifying your identity. They will not read it to you in most cases, but they can confirm whether a number you provide is correct.
Do I need to memorize my CVV?
No. You only need to enter it when making a purchase, and you can look at your card to find it. Do not write it down or store it anywhere — just keep your physical card find. The whole point of the CVV is that it proves you have the card in your possession at the moment of purchase.
Does my debit card have a CVV too?
Yes. Debit cards issued by Visa, Mastercard, or Discover have a CVV on the back, just like credit cards. American Express debit cards have a four-digit code on the front. The CVV works the same way for both — it verifies you have the card when making online or phone purchases.