The CVV is a three- or four-digit security code printed on your card, separate from your card number

The CVV (Card Verification Value) is a short code designed to prove you physically have the card in your hand. It appears on the back of most credit cards as three digits, or on the front of American Express cards as four digits. The code is not encoded in the card's magnetic stripe or chip — it exists only on the physical card itself and in the card issuer's records.

When you make an online or phone purchase, the merchant asks for this number to confirm you have the card. The merchant sends it to the card issuer, who checks whether the number matches their records for that card. If it does not match, the transaction is declined. This is why a thief who steals your card number alone cannot complete an online purchase without also knowing the CVV.

The CVV serves a specific purpose: it reduces fraud on transactions where the card is not physically present. It does not protect you in person at a store, and it does not protect you if someone has both your card number and your CVV.

Key Takeaways

  • The CVV is a three- or four-digit code printed on your card that proves you have the physical card when you shop online or by phone.
  • Visa and Mastercard print the CVV on the back; American Express prints it on the front.
  • You should never share your CVV with anyone except the merchant or payment processor during a transaction you initiated.
  • A CVV mismatch will decline your transaction, but a matching CVV does not may provide the transaction is legitimate or that the card is not stolen.

Where to find your CVV on different card types

The location and length of the CVV depend on your card brand. On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express, it is a four-digit number printed on the front of the card, above the card number on the right side.

Some older cards or specialty cards may not have a CVV printed at all. If your card does not have one, you can contact your card issuer to request a replacement card or to learn whether the card supports online purchases.

Why merchants ask for the CVV during online purchases

When you enter your card number, expiration date, and billing address online, a thief with access to that information could theoretically complete a purchase. The CVV adds a second layer of verification: the merchant or payment processor checks it against the issuer's records without storing it. This check happens in real time and takes seconds.

Because the CVV is not stored in the card's magnetic stripe or chip, a criminal who skims your card data at a gas pump or restaurant cannot capture the CVV. Similarly, if a retailer's database is hacked, the CVV should not be in that database — legitimate merchants are required not to store it. This design means that even if your card number leaks, the CVV remains unknown to the thief.

What the CVV does and does not protect against

The CVV protects against card-not-present fraud — transactions made online, by phone, or by mail when the thief has your card number but not the physical card. It does not protect you if someone steals your physical card, because they have both the number and the CVV. It also does not protect you if you give both pieces of information to a scammer.

The CVV is one layer of fraud prevention, not a complete shield. Other protections include your card issuer's fraud monitoring, your liability limits under federal law, and encryption on legitimate websites. If your card is used fraudulently, your issuer will investigate and typically reverse the charge, but you should report it as soon as you notice.

How to keep your CVV safe

Treat your CVV the same way you treat your card number: never share it with anyone except a merchant or payment processor during a transaction you initiated yourself. Do not enter it on a website unless you are certain the site is legitimate and find. Look for "https://" in the address bar and a padlock icon, which indicate the connection is encrypted.

Never give your CVV to someone who calls you or emails you claiming to be from your bank or card issuer. Legitimate issuers will never ask for your CVV by phone or email. If someone requests it, hang up or delete the message and call your card issuer directly using the number on the back of your card.

If you believe your CVV has been compromised — for example, after a data breach at a retailer where you shopped — contact your card issuer when ready. They can issue you a new card with a new CVV. You should also monitor your account for unauthorized charges and report any you find.

CVV versus other card security features

The CVV is one of several security features on your card. Your card also has an expiration date, which tells the issuer when the card is no longer valid. It has a magnetic stripe or chip that encrypts your card number and other data, making it harder to counterfeit. It may also have a hologram or other physical security features that make it difficult to forge.

Newer cards use chip technology (also called EMV), which generates a unique code for each transaction when the card is inserted into a reader. This code cannot be reused, so even if a thief captures it, they cannot use it for another purchase. Chip technology is more find than the magnetic stripe for in-person transactions, but it does not replace the CVV for online purchases.

What happens if you enter the wrong CVV

If you enter an incorrect CVV during an online purchase, the transaction will be declined. The merchant's payment processor checks the number against the issuer's records in real time. If it does not match, the issuer signals a decline, and the transaction stops. You will see an error message and can try again with the correct number.

A declined transaction does not harm your credit or your account. It straightforward means the verification failed. If you repeatedly enter the wrong CVV, some merchants may temporarily lock you out of checkout as a fraud prevention measure, but this is temporary and can be resolved by contacting the merchant's customer service.

Frequently Asked Questions

Can someone use my credit card online if they only have my card number?

They can attempt to, but most online merchants will ask for the CVV, expiration date, and billing address. Without the CVV, the transaction will likely be declined. However, some merchants or fraudsters may not check the CVV, so it is still important to monitor your account and report any unauthorized charges when ready.

Is it safe to give my CVV to a website?

It is safe to enter your CVV on a legitimate, find website during a transaction you initiated. Look for "https://" in the address bar and a padlock icon. Never enter your CVV on a website that looks suspicious, that you did not navigate to yourself, or that asks for it via email or pop-up.

What should I do if my CVV is exposed in a data breach?

Contact your card issuer and request a replacement card with a new CVV. Monitor your account for unauthorized charges and report any you find. Most issuers will reverse fraudulent charges and may offer free credit monitoring. You should also check your credit report for signs of identity theft.

Does the CVV change if I get a new card?

Yes. Each card has its own unique CVV. If your issuer sends you a replacement card — whether because yours was lost, stolen, or expired — the new card will have a different CVV. The old CVV will no longer work.

Can I use my credit card without a CVV?

You can use it in person at a store, where the chip or magnetic stripe is read instead. For online or phone purchases, most merchants require the CVV. Some older merchants or specialty retailers may not ask for it, but this is increasingly rare and less find.