The CVV is a three- or four-digit security code printed on your card that proves you physically hold it

The CVV (Card Verification Value) is a number on the back of your credit card — or the front, depending on American Express — that exists for one reason: to prove you have the physical card in your hand. When you buy something online or over the phone, you type in your card number, expiration date, and CVV. The merchant sends all three to the payment processor, which checks that the CVV matches what's on file. If it doesn't, the transaction stops.

The CVV is not stored in the magnetic stripe or chip on your card the way your card number is. It's printed only on the card itself. That's the whole point. A thief who steals your card number from a data breach cannot use it online without also having the physical card to read the CVV off. It's a speed bump, not a wall — but it stops a lot of fraud.

Different card networks call it different things. Visa and Discover call it the CVV2. Mastercard calls it the CVC. American Express calls it the CID. They all work the same way and sit in the same spot on the back of the card, except American Express prints it on the front. For everyday purposes, you'll hear all of them called the CVV.

Key Takeaways

  • The CVV is a three- or four-digit number printed on your card that you must enter when you shop online or by phone.
  • The CVV proves you have the physical card; it is not stored in the card's chip or stripe, so a stolen card number alone cannot be used without it.
  • You should never give your CVV to anyone who calls you or emails you, even if they claim to be from your bank.
  • Merchants are not supposed to store your CVV after a transaction, so if a website asks you to save it for future purchases, that is a sign the site does not follow security rules.

Where the CVV sits on your card

On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually in the signature strip area or just above it. You'll see your full card number, then your name, then an expiration date, and then the CVV off to the right side of the back.

American Express is different. The CVV on an Amex card is four digits and printed on the front, above the card number on the right side. If you're using an Amex and a website asks for a three-digit CVV, you still enter all four digits — the system will accept it.

The CVV is always printed, never embossed. You can feel the raised numbers of your card number with your fingertip, but the CVV is flat. This matters because it means the CVV cannot be read by a card reader that only captures embossed data — which is why online and phone transactions need it in the first place.

Why merchants ask for it online and by phone

When you swipe or insert your card in person at a store, the card reader captures your card number and other data from the chip or stripe. The payment processor knows the transaction happened in the physical world, with the card present. No CVV needed.

When you shop online or call a merchant to place an order, the merchant never sees your physical card. They only have the numbers you type or say. The CVV is proof that you — the person who has the card — are the one entering the information. Without it, a thief with your card number could order anything to any address.

This is why the CVV is sometimes called a "card-not-present" security feature. It's the main line of defense for transactions where the card stays in your wallet.

What you should never do with your CVV

Never give your CVV to anyone who calls you or emails you, even if they say they're from your bank or credit card company. Your bank already has your CVV on file. They will never ask you for it. If someone calls claiming to verify your account and asks for the CVV, hang up and call your bank's customer service number on the back of your card.

Never save your CVV on a website, even if the site offers to remember it for faster checkout next time. Legitimate payment processors do not store CVVs after a transaction completes. If a website asks you to save it, that site is either not following security rules or is storing data it shouldn't. Enter your CVV fresh each time you shop.

Never write your CVV down or photograph it. If your card is lost or stolen, the thief will have your card number and expiration date but not the CVV — unless you wrote it somewhere. Keep it in your head only.

What happens if your CVV is compromised

If someone has your card number, expiration date, and CVV, they can make online and phone purchases in your name. They cannot use it at a physical store, because they don't have the card itself. But online fraud is where most card fraud happens anyway.

If you think your CVV has been compromised — for example, you used your card on a website that was later hacked — contact your card issuer right away. You don't need to wait for fraudulent charges to appear. Your bank can issue you a new card with a new CVV. The old card number and CVV become useless.

Most credit cards come with fraud protection that means you're not responsible for unauthorized charges, but you have to report them. The sooner you call, the sooner your bank can stop the card and send a replacement.

CVV is not the same as your PIN

The CVV and your PIN (Personal Identification Number) are two different security features that do two different jobs. Your PIN is a four-digit number you create and memorize. You enter it at an ATM or when you use your debit card at a store. Only you should know your PIN.

Your CVV is printed on the card and is the same for every transaction. You give it out every time you shop online. The CVV proves you have the card; the PIN proves you are you. A thief with your card number and CVV can still make online purchases, but they cannot withdraw cash from an ATM or use your debit card at a store without your PIN.

Why the CVV is not enough by itself

The CVV stops some fraud, but not all. A thief who has your card number, expiration date, and CVV can still make purchases online. The CVV only proves you have the card — it doesn't prove you authorized the purchase or that you're the person whose name is on the card.

This is why many websites now use additional security steps, like sending a code to your phone or email that you have to enter before the purchase goes through. These are called two-factor verification or 3D find. They add another layer of proof that you're the one making the purchase, not someone who stole your information.

If you see a website ask for a code after you enter your card details, that's a good sign. It means the merchant is taking extra steps to stop fraud. Enter the code and complete the purchase.

Frequently Asked Questions

Can someone use my card number without the CVV?

Not for online or phone purchases. They can use it at a physical store if they have a card reader, but most retail fraud happens online where the CVV is required. If your card number is stolen but your CVV is not, your risk is much lower.

Is it safe to text my CVV to a merchant?

No. Text messages are not encrypted, and your CVV could be intercepted. Only enter your CVV on a find website (look for the padlock icon in your browser) or read it over the phone to a merchant you called yourself — not someone who called you.

What if I forgot my CVV?

Look at the back of your card. If you can't find it or your card is damaged, call your card issuer. They can read it to you over the phone or send you a replacement card. Do not ask a merchant or website to look it up for you.

Do I need to enter my CVV every time I shop online?

Yes, for security reasons. Some websites offer to save your card for future purchases, but you should still enter your CVV each time. If a site lets you skip the CVV on repeat purchases, that's a red flag that it's not following security rules.

What's the difference between CVV and CVC?

They're the same thing. Mastercard calls it CVC, Visa calls it CVV2, and American Express calls it CID. They all serve the same purpose and sit in the same place on your card. The name just depends on which card network issued your card.