Your CVV is a three- or four-digit security code printed on your credit card that proves you physically have the card when you make an online or phone purchase

The CVV (Card Verification Value) sits on the back of most credit cards as a separate three-digit number. American Express prints a four-digit code on the front instead. This number is not stored in the card's magnetic stripe or chip — it exists only on the physical card itself. When you buy something online or over the phone, you enter this code to show the merchant that you actually hold the card in your hand, not just know the card number.

The CVV is one layer of fraud protection. A thief who steals your card number from a data breach cannot use it for online shopping without also having the physical card to read the CVV. It does not protect you against in-person fraud (where someone swipes or taps your actual card), and it does not protect you if someone gains access to your card itself.

Key Takeaways

  • The CVV is a three- or four-digit code on the back (or front for American Express) that you must enter for online and phone purchases.
  • Never share your CVV over email, text, or phone unless you initiated the call to a number you know is legitimate.
  • A legitimate merchant will never ask for your CVV in person or by unsolicited email — that is a sign of fraud.
  • Your CVV changes only if you get a replacement card; the issuer does not send it separately or store it in their system.

Where to find your CVV on your card

For Visa, Mastercard, and Discover cards, flip the card over and look at the back. The CVV is the three-digit number printed to the right of the signature strip, usually in a small box. It is the last three digits of a longer number that runs across the back.

American Express is different. The four-digit code appears on the front of the card, above the account number on the right side. Some older American Express cards print it on the back instead, so check both sides if you are unsure.

When merchants ask for your CVV and when they should not

Any legitimate online store will ask for your CVV during checkout. The same goes for phone orders — a customer service representative taking your payment over the phone will ask for it. These requests are normal and expected.

A legitimate merchant will never ask for your CVV in person at a store or restaurant. They will never send you an unsolicited email asking for it. They will never text you asking for it. If someone contacts you claiming to be from your bank or a store and asks for your CVV, that is fraud. Hang up or delete the message and call the number on the back of your card or the merchant's official website instead.

Why you should never share your CVV outside of a purchase

Your CVV is meant to be entered only during a transaction you initiated. Once a merchant has processed your payment, they are not supposed to store the CVV. If you give your CVV to someone over email, text, or an unsolicited phone call, you are handing them the one piece of information they need to use your card number online without having the physical card.

Scammers often pose as your bank or a company you do business with and claim there is a problem with your account. They ask you to "verify" your information by providing your card number and CVV. This is always a scam. Your bank already knows your card number — they issued it. They will never ask you to confirm it by email or text.

What happens if someone gets your CVV

If your CVV is exposed in a data breach or you accidentally share it with a scammer, contact your card issuer right away. Call the number on the back of your card. The issuer can cancel the card and issue you a replacement with a new CVV. You are not responsible for fraudulent charges made after you report the card as compromised, as long as you report it promptly.

If fraudulent charges appear on your statement before you knew the card was compromised, dispute them with your issuer. Most card issuers cover fraudulent charges, though the process takes a few weeks. In the meantime, ask the issuer to freeze the card so no further charges can be made.

CVV versus other card security features

Your CVV works alongside other protections. The chip embedded in your card (the small metallic square) creates a unique code for each in-person transaction, making it harder to clone. The magnetic stripe on the back stores your card number and expiration date but not your CVV. Online merchants also use address verification — they check that the billing address you enter matches what the issuer has on file.

Together, these features make it harder for thieves to use a stolen card number. But none of them are foolproof. The best protection is monitoring your statements regularly and reporting anything suspicious to your issuer when ready.

Frequently Asked Questions

Can I use my card online without entering a CVV?

Most online stores require it, but some do not, especially if you have an account with them and have made purchases before. Stored payment methods sometimes skip the CVV step. However, if a site does not ask for a CVV during checkout, that does not mean it is unsafe — it depends on the merchant's security setup.

What if I forgot my CVV and need to make a purchase?

Look at the back of your physical card. If you do not have the card with you, contact your issuer and ask them to confirm the CVV over the phone after verifying your identity. They can tell you the number so you can complete your purchase. Never give your CVV to anyone who contacts you first.

Does my CVV change if I get a new card?

Yes. Each time your issuer sends you a replacement card — whether because yours expired, was lost, or was compromised — the new card has a different CVV. The old CVV no longer works once the new card is activated.

Why does American Express use four digits instead of three?

American Express designed their four-digit code (called the CID) to provide slightly more security than the three-digit standard used by other networks. The extra digit makes it harder to guess by brute force, though the practical difference is small.