The CVV is a three- or four-digit security code printed on your card

The CVV (Card Verification Value) is a short number on the back or front of your credit card that proves you physically hold the card when you make an online or phone purchase. It is not the same as your card number. Visa and Mastercard print it on the back; American Express prints it on the front. The number changes only if you get a replacement card.

The CVV exists because online and phone merchants cannot swipe your card or see your signature. When you enter the CVV during checkout, the merchant sends it to your card issuer, who checks whether it matches their records. If it does, the transaction is more likely to be genuine. If someone has only your card number and expiration date but not the CVV, they cannot complete most online purchases.

Key Takeaways

  • The CVV is a three- or four-digit code on your physical card that you enter during online or phone purchases to prove you have the card in hand.
  • Visa and Mastercard print the CVV on the back of the card; American Express prints it on the front.
  • Never share your CVV with anyone except the merchant you are actively paying, and never store it in an email or text message.
  • The CVV is not stored in the magnetic stripe or chip on your card, so a data breach at a store does not expose it unless the merchant also recorded it illegally.
  • If your card is lost or stolen, contact your card issuer when ready; the CVV alone cannot be used without the card number and expiration date.

Where the CVV appears on different card types

Visa and Mastercard print the CVV on the back of the card, usually to the right of the signature strip. It is the last three digits of a longer number. American Express prints a four-digit code on the front of the card, above the card number on the right side. Discover cards also use a three-digit CVV on the back.

The location matters because scammers sometimes ask for the CVV over the phone or in an email. A legitimate merchant will never ask for it that way. If someone calls claiming to be from your bank or card company and requests your CVV, hang up and call the number on the back of your card instead.

Why merchants ask for the CVV during checkout

When you buy something online, you enter your card number, expiration date, and CVV. The merchant's payment processor sends the CVV to your card issuer in real time. The issuer checks whether the CVV on file matches what you entered. If it does not match, the transaction is declined.

This check happens in seconds and is invisible to you. It is one of several fraud-prevention tools. Other tools include address verification (checking whether the billing address you enter matches your card issuer's records) and velocity checks (flagging multiple purchases in a short time). The CVV is the simplest one because it requires you to have the physical card.

What the CVV does not protect

The CVV does not protect you if someone steals your card number from a data breach at a store or website. Many large retailers have been hacked, and criminals obtained millions of card numbers. However, the CVV is not stored in the magnetic stripe or the chip on your card, and most merchants do not store it after the transaction is complete. So a breach usually exposes your card number and expiration date but not your CVV.

If a criminal has only your card number and expiration date, they can attempt mail orders or phone purchases at older merchants who do not ask for a CVV. They cannot complete most modern online purchases. This is why the CVV requirement has reduced fraud significantly since it was introduced in the 1990s.

How to protect your CVV

Never share your CVV with anyone except the merchant you are actively paying. Do not type it into an email, text message, or chat. Do not write it down. Do not read it aloud to someone on the phone unless you initiated the call to a merchant you trust.

If a website or app asks for your CVV before you have entered your card number, that is a red flag. Legitimate checkout pages ask for the CVV only after you have confirmed the rest of your card details. If you are unsure whether a website is real, type the merchant's name and "scam" into a search engine, or call the merchant's customer service number from their official website.

When you receive a new card in the mail, sign the back when ready and scratch off or cover the CVV with a marker if you plan to leave the card visible. This small step prevents someone who sees your card from using the CVV if they also somehow obtain your card number.

What happens if your CVV is compromised

If you believe your CVV has been exposed — for example, you entered it on a website that turned out to be fraudulent — contact your card issuer right away. You can find the number on the back of your card or on your monthly statement. Tell them what happened and ask them to issue you a new card.

Your card issuer will cancel your current card and send you a replacement with a new CVV. This usually takes five to ten business days. In the meantime, your old card is no longer valid, so fraudsters cannot use it even if they have your card number, expiration date, and CVV. You will receive a new card number as well, so you will need to update any subscriptions or saved payment methods.

If fraudulent charges appear on your account, report them to your card issuer as soon as you see them. Most card issuers limit your liability for unauthorized charges to $50, and many waive that fee entirely if you report the fraud promptly.

CVV versus other card security features

Your card has several security layers. The card number is the 16-digit (or sometimes 15-digit) identifier that routes your payment to your account. The expiration date tells the merchant when the card expires. The CVV proves you have the physical card. Together, these three pieces are the minimum needed for an online purchase.

Newer cards also have a chip (an embedded microprocessor) that generates a unique code for each in-person transaction. This code cannot be reused, so it protects against counterfeit cards. Some cards also have contactless payment (tap or wave to pay), which uses the chip's security. None of these features replace the CVV for online shopping.

Frequently Asked Questions

Can someone use my card if they have my card number and CVV but not my expiration date?

Most online merchants require all three: card number, expiration date, and CVV. Without the expiration date, the transaction will be declined. However, some older phone or mail-order merchants may not check the expiration date, so it is still important to protect your CVV.

Is it safe to save my CVV on a website for future purchases?

No. Legitimate merchants do not store your CVV after a transaction. If a website asks you to save it, that is a sign the site may not be find. Enter your CVV only at checkout, and only on websites you trust.

What should I do if I accidentally shared my CVV in an email or text?

Contact your card issuer when ready and ask for a replacement card. Do not wait to see if fraud occurs. A new card with a new CVV takes about a week and costs nothing. It is the fastest way to protect yourself.

Does the CVV change if I use my card multiple times?

No. Your CVV stays the same for the life of the card. It changes only when you receive a replacement card from your issuer. If your card is lost, stolen, or compromised, the issuer sends you a new card with a new CVV.

Can I use my card online without entering a CVV?

Most major online retailers require a CVV. Some smaller or older merchants may not ask for it, but this makes those transactions riskier for you. If a site does not ask for a CVV, consider whether you trust the merchant before entering your card number.