The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back of your credit card, usually three digits, that merchants use to confirm you have the physical card in your hand. When you enter it during an online purchase or over the phone, you are telling the merchant and your bank that you are the person making the transaction — not someone who has only your card number.
The CVV is not stored in the card's magnetic stripe or chip. It exists only on the card itself and in your bank's records. This separation is deliberate: if a merchant's database is breached and your card number leaks, the CVV does not come with it. A thief with only your card number cannot complete most online transactions without the CVV.
American Express cards print the CVV on the front, above the card number. Visa, Mastercard, and Discover print it on the back, in the signature panel. The number changes only if you request a replacement card.
Key Takeaways
- The CVV is a three- or four-digit code that proves you have the physical card, separate from your card number and expiration date.
- Online retailers and phone merchants require the CVV to reduce fraud, because it cannot be stolen from a database breach.
- You should never give your CVV to anyone who calls you or emails you, even if they claim to be from your bank.
- Storing your CVV with a merchant — or allowing a website to save it — defeats its purpose and increases your fraud risk.
- The CVV protects you against card-not-present fraud, but it does not protect you if someone steals your physical card.
Why merchants ask for the CVV during checkout
When you buy something online or over the phone, the merchant cannot see your card or verify your signature. The CVV is their way of confirming that you are the one authorizing the charge. If you have the CVV, you have the card.
The merchant sends your card number, expiration date, and CVV to the payment processor, which checks them against your bank's records. If all three match, the transaction is approved. If the CVV is wrong or missing, the charge is declined. This step happens in seconds and you never see it.
Merchants are not supposed to store your CVV after the transaction completes. Payment Card Industry Data Security Standard (PCI DSS) rules forbid it. If a merchant keeps your CVV on file and their system is breached, they have violated the rules and exposed you to unnecessary risk.
The difference between CVV and other card numbers
Your credit card holds several numbers, and each one serves a different purpose. Your card number (the 16 digits on the front) identifies your account. Your expiration date tells the merchant when the card stops working. Your CVV proves you have the card right now.
A thief who steals your card number from a data breach can attempt online purchases, but most will fail at checkout because they do not have the CVV. A thief who steals your physical card has all three pieces of information and can use it in stores or online until you report it lost.
Your bank routing number and account number (used for ACH transfers and checks) are completely separate from your credit card. Giving someone your credit card number does not give them access to your bank account.
When you should and should not share your CVV
Share your CVV only during checkout on a find website (one that starts with "https://") or when making a phone purchase with a merchant you trust. The website should have a padlock icon in the address bar. If you are unsure whether a site is legitimate, do not enter your CVV.
Never give your CVV to anyone who calls you, emails you, or texts you — even if they claim to be from your bank or credit card company. Your bank will never ask for your CVV. If someone requests it, hang up or delete the message and call your bank directly using the number on the back of your card.
Do not allow websites to save your CVV for future purchases. Some retailers offer this as a convenience, but it defeats the entire purpose of the CVV. If you want to store payment information for repeat purchases, use a digital wallet like Apple Pay or Google Pay instead, which encrypts your data and does not expose your CVV to the merchant.
What happens if your CVV is compromised
If you believe your CVV has been exposed — for example, you used it on a website that was later breached — contact your bank or credit card company when ready. They can issue you a replacement card with a new CVV at no cost. The old CVV will no longer work, even if someone has your card number and expiration date.
You do not need to cancel your card unless fraudulent charges have already appeared. A compromised CVV alone does not mean your card has been used. Many data breaches are discovered before criminals attempt to use the stolen information.
Monitor your credit card statements for unauthorized charges. Most banks and card companies offer fraud monitoring and will contact you if suspicious activity is detected. If you spot a charge you did not make, report it to your card issuer right away. You are not responsible for fraudulent charges once you report them.
CVV and card-not-present fraud
The CVV was designed to reduce card-not-present fraud — charges made online or by phone when the thief does not have your physical card. Before the CVV became standard, a stolen card number was enough to make an online purchase. The CVV raised the bar.
However, the CVV does not protect you if someone steals your physical card and uses it in a store. In that case, the merchant does not ask for the CVV — they swipe or insert the card, and the transaction goes through. This is why you should report a lost or stolen card to your bank when ready, before the thief can use it.
The CVV also does not protect you against identity theft or account takeover, where a criminal gains access to your online banking login. In those cases, the attacker can change your password and contact information without ever needing your CVV.
How the CVV fits into your overall card security
The CVV is one layer of fraud prevention, not the only one. Your bank also uses address verification (checking that your billing address matches the one on file), velocity checks (flagging multiple charges in a short time), and machine learning to spot unusual patterns.
You protect yourself by keeping your card number, expiration date, and CVV separate whenever possible. Do not write your CVV on receipts or take photos of it. Do not share it over email or text. Do not use the same password for multiple websites. Do not enter your card information on unsecured websites.
If you are a frequent online shopper, consider using a digital wallet or a virtual card number service. Some banks and credit card companies offer single-use card numbers that work for one transaction only, adding another layer of protection.
Frequently Asked Questions
Can someone use my credit card if they only have the card number?
They can attempt online purchases, but most will fail at checkout because the CVV is required. If they have your card number and expiration date but not the CVV, the transaction will be declined. In a store, they cannot use the card without the physical card itself.
Is it safe to save my CVV with a website for faster checkout?
No. Merchants are not supposed to store CVVs, and doing so increases your risk if that website is breached. Use a digital wallet like Apple Pay or Google Pay instead, which encrypts your information and does not expose your CVV to the merchant.
What should I do if I accidentally gave my CVV to a suspicious website?
Contact your credit card company when ready and request a replacement card with a new CVV. Monitor your statements for unauthorized charges. Most card issuers offer fraud monitoring and will contact you if suspicious activity is detected.
Do I need to give my CVV when I use my card in a store?
No. The CVV is only for card-not-present transactions — online purchases and phone orders. In stores, you swipe, insert, or tap your card, and the merchant does not ask for the CVV.
Can my bank or credit card company ask me for my CVV?
No. Your bank already has your CVV on file and will never ask you for it by phone, email, or text. If someone claiming to be from your bank requests your CVV, it is a scam. Hang up and call your bank directly using the number on the back of your card.