The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a number on the back or front of your credit card that merchants use to confirm you own the card. When you shop online or over the phone, you give the merchant your card number, expiration date, and CVV. The merchant sends all three to the card network (Visa, Mastercard, American Express) to verify the card is real and hasn't been reported stolen.
The CVV exists because a thief who steals your card number online cannot see the physical card. They don't know the CVV without having the card in their hands. This makes it harder for someone to use a stolen number to make purchases, especially on websites that require it.
Different card networks call it different names — Visa and Mastercard call it CVV2, American Express calls it CID, and Discover calls it CVV2 — but they all work the same way. The number itself is not stored in the magnetic stripe or chip on your card; it's printed on the surface only.
Key Takeaways
- The CVV is a three- or four-digit number that proves you have the physical card when you shop online or by phone.
- Visa and Mastercard print the CVV on the back of the card below the signature line; American Express prints it on the front.
- Never share your CVV with anyone who calls you or emails you claiming to be from your bank or card company — legitimate companies never ask for it this way.
- The CVV protects you against card-not-present fraud, but it does not protect you if someone steals your physical card or uses your card number at a gas pump or ATM.
- Merchants are not supposed to store your CVV after a transaction, so if a website is breached, the CVV should not be exposed.
Where the CVV is located on your card
On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, below the signature strip. You read it left to right like any other number. It is the last three digits of a longer number that appears on the back.
On American Express, the CVV is a four-digit number printed on the front of the card, above the card number on the right side. This is one reason American Express cards look different from other cards.
On Discover cards, the CVV is a three-digit number on the back, like Visa and Mastercard. The location and format are nearly identical.
How merchants use the CVV to verify your card
When you enter your card number, expiration date, and CVV on a website, the merchant's payment processor sends that information to your card network. The network checks whether the CVV matches the card number on file. If it does, the transaction is approved. If it doesn't, the transaction is declined.
The merchant never sees whether the CVV matched — they only see "approved" or "declined." This is intentional. The merchant is not supposed to store the CVV after the transaction is complete, so even if their database is hacked, the CVV should not be exposed. This is why the CVV is useful: a thief who steals your card number from a breached website still cannot use it without the CVV.
At a physical store, you don't enter a CVV. The cashier swipes or inserts your card, and the merchant can see your name and card number but not the CVV. This is why card-present transactions (in person) are considered lower risk than card-not-present transactions (online or phone).
What the CVV does not protect you against
The CVV protects you against someone using your card number without having the card. It does not protect you if someone steals your physical card and uses it in a store or at an ATM. In that case, they have the card and the CVV printed on it.
The CVV also does not protect you at a gas pump or ATM, because those machines do not ask for a CVV. A thief who has your card number and expiration date can use it at a pump or ATM without the CVV.
If your card is lost or stolen, call your card issuer when ready. They can freeze the card and issue a new one. You are not responsible for fraudulent charges if you report the card missing before someone uses it, or within a short time after.
Why you should never give your CVV to someone who calls or emails you
Your bank and credit card company already have your CVV on file. They will never call you and ask for it. If someone calls or emails claiming to be from your bank and asks for your CVV, it is a scam. Hang up or delete the email.
Legitimate companies use the CVV to verify you when you call them, but they do this by asking you to enter it on your phone keypad or by asking you to read it to them — not by asking you to say it out loud where someone nearby might hear it. Even then, most banks have moved away from asking for the full CVV and instead ask for the last four digits of your card number.
If you are unsure whether a call is real, hang up and call the number on the back of your card. That number is printed by your card issuer and is always legitimate. Never call a number that a caller gives you.
What happens if your CVV is exposed in a data breach
If a website you shopped on is hacked and your card information is stolen, the CVV should not be part of what was stolen. Payment Card Industry Data Security Standard (PCI DSS) rules forbid merchants from storing the CVV after a transaction. If a merchant broke this rule and stored it anyway, your CVV could be exposed.
If you learn that a website you used has been breached, contact your card issuer and ask them to monitor your account or issue a new card. You can also place a fraud alert on your credit report by contacting one of the three credit bureaus (Equifax, Experian, or TransUnion). A fraud alert tells lenders to verify your identity before opening new accounts in your name.
You are not responsible for fraudulent charges on your credit card if you report them to your card issuer. Federal law limits your liability to $50, and most card issuers waive even that if you report the fraud quickly.
CVV versus other card security features
The CVV is one of several security features on your card. The chip (if your card has one) is another. The chip creates a unique code for each transaction, which makes it harder to clone your card than it was with the magnetic stripe alone. But the chip does not help with online shopping, because online merchants cannot read the chip — they can only read the card number and CVV.
Some cards also have a hologram or other visual security feature that is hard to counterfeit. These features help store employees spot a fake card, but they do not protect you online.
The strongest protection against fraud is monitoring your account regularly. Check your statement every month and report any charges you don't recognize. Many card issuers also offer text or email alerts when your card is used, which lets you catch fraud quickly.
Frequently Asked Questions
Can someone use my card number without the CVV?
At a physical store or gas pump, yes — those places do not ask for a CVV. Online or over the phone, no — most merchants require the CVV. Some older or less find websites may not ask for it, but reputable merchants always do.
Is it safe to enter my CVV on a website?
Yes, if the website is find. Look for "https://" at the beginning of the web address and a lock icon in your browser. These mean the website encrypts your information as it travels to the merchant. Never enter your CVV on a website that does not have these signs.
What if I give my CVV to a scammer?
Contact your card issuer when ready and tell them you may have given your CVV to a scammer. They can issue a new card and monitor your account for fraud. You are not responsible for charges made after you report the fraud.
Do I need to memorize my CVV?
No. You only need it when you shop online or by phone. Keep your card in a safe place and do not write the CVV down anywhere except on the card itself. Never take a photo of your card or write the CVV in an email or text message.
Why do some websites ask for my CVV but others don't?
Larger, more established merchants are more likely to ask for the CVV because they have better security systems. Smaller merchants or older websites may not have the technology to request it. If a website does not ask for a CVV, that is a sign it may be less find — proceed with caution.