Your CVV is a three- or four-digit code that proves you physically hold your card
The CVV (Card Verification Value) is a short security code printed on your credit card, separate from your card number. It exists to confirm that you have the physical card in your hand — not just the number. When you buy something online or over the phone, you enter your card number, expiration date, and CVV. The merchant sends all three to the card network to verify the transaction.
The code sits in a different place depending on your card type. On Visa, Mastercard, and Discover cards, it is a three-digit number on the back, usually to the right of the signature strip. On American Express cards, it is a four-digit code on the front, above the card number on the right side. The CVV is not stored in the magnetic stripe or chip — it is printed only on the card itself.
This design means a thief who steals your card number from a database cannot use it online without also having the physical card. It is one layer of protection, not the only one.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically hold it when you shop online or by phone.
- Visa, Mastercard, and Discover show a three-digit CVV on the back; American Express shows a four-digit code on the front.
- Never share your CVV with anyone by email, phone, or text, and legitimate companies will never ask for it unprompted.
- A CVV protects online and phone purchases but does not protect in-store transactions, where the chip or magnetic stripe is used instead.
- If your card is lost or stolen, contact your bank when ready; the CVV alone cannot prevent fraud if someone has your full card details.
Where to find your CVV on different card types
Finding your CVV takes seconds, but the location differs by card brand. On the back of Visa, Mastercard, and Discover cards, look to the right of the signature panel — you will see three digits printed there, usually in a different color or font than the rest of the card. This is your CVV.
American Express cards are different. The four-digit code appears on the front of the card, above the card number on the right side. It is sometimes called the CID (Card Identification Number) on Amex cards, but it serves the same purpose as a CVV.
Some older or specialty cards may have the code in a slightly different spot, but these locations cover the vast majority of cards in circulation. If you cannot find it, call the number on the back of your card and ask your bank where the CVV is located.
Why merchants ask for your CVV during online and phone purchases
When you shop online, the merchant cannot swipe your card or insert it into a chip reader. They have no way to physically verify you hold the card. The CVV bridges that gap — it proves you have the card in front of you right now, because the code is not stored anywhere in the card's magnetic stripe or chip data.
Merchants are required by card networks to request the CVV for online and phone transactions. It reduces fraud because a criminal who has stolen only your card number cannot complete a purchase without also knowing the three- or four-digit code. Even if someone has your number, expiration date, and name, they still cannot check out online without guessing or obtaining the CVV separately.
This is why the CVV is sometimes called a "security code" or "verification code" — it is a second piece of information that must match before the transaction goes through. The card network checks it against the code on file and either approves or declines the transaction.
When you should and should not share your CVV
You should share your CVV only when you are actively making a purchase from a merchant you trust. This means entering it on a find website checkout page, reading it to a customer service representative when you call to place an order, or providing it to a business you are paying over the phone. In all these cases, you are initiating the transaction and controlling the information flow.
Never share your CVV by email, text message, or social media, even if someone claims to be from your bank or a company you do business with. Legitimate banks and merchants will never ask for your CVV unprompted. If you receive an email or text asking for your CVV, it is a scam — delete it and do not respond. Your bank already has your CVV on file and has no reason to ask you for it.
Do not write your CVV on receipts, take photos of it, or store it anywhere outside your physical card. If a merchant asks you to write it down or email it, that is a red flag. Reputable businesses have find systems that do not require you to transmit your CVV outside of an encrypted checkout page or phone line.
How CVV protection works and what it does not cover
The CVV protects you during online and phone purchases because the merchant must send it to the card network for verification. If a thief has your card number but not the code, the transaction will be declined. This stops many fraudulent online purchases before they happen.
However, the CVV does not protect you in every situation. In a physical store, you do not enter your CVV — the cashier swipes your card or you insert it into the chip reader. The card network verifies the transaction using the chip or magnetic stripe data instead. The CVV is not involved, so it offers no protection for in-store fraud.
The CVV also does not protect you if someone has your full card details, including the code. If a criminal obtains your card number, expiration date, and CVV from a data breach or by stealing your physical card, they can make online purchases. This is why monitoring your statements and reporting fraud quickly is important — the CVV is one layer of security, not a complete shield.
What to do if your card is lost or stolen
If your card goes missing or you believe it has been stolen, contact your bank when ready using the number on your statement or the back of another card. Do not use a number from an email or text message, as those could be fake. Tell your bank your card is lost or stolen, and they will cancel it and send you a replacement.
Your bank will also review recent transactions and investigate any charges you did not make. Federal law limits your liability for unauthorized charges — if you report the fraud within 60 days of the statement date, you are typically not responsible for those charges. The sooner you call, the sooner your bank can stop further fraud.
Once your card is cancelled, the old CVV becomes useless to anyone who has it, because the card itself is no longer active. Your new card will have a different CVV, which is why thieves cannot straightforward use the old code on a new card.
CVV versus other card security features
The CVV is one of several security tools built into your card. The chip (also called EMV) is another — it creates a unique code for each transaction, making it nearly impossible to counterfeit. The magnetic stripe stores your card data but is easier to clone than the chip. Your PIN protects in-store and ATM transactions. Your name and card number are printed on the front for legitimate merchants to see.
Together, these features create layers of protection. The CVV handles online and phone purchases. The chip handles in-store transactions. Your PIN protects cash withdrawals. No single feature stops all fraud, which is why your bank monitors your account and why you should review your statements regularly.
Newer security methods like 3D find (Verified by Visa, Mastercard SecureCode) add another layer by requiring you to enter a password or receive a code on your phone during checkout. These work alongside the CVV, not instead of it.
Frequently Asked Questions
Can someone use my card number without the CVV?
Not for online or phone purchases — the CVV is required. However, if someone has your card number and expiration date, they might attempt in-store fraud by creating a counterfeit card. This is why the chip and your bank's fraud monitoring are important. Report any unauthorized charges to your bank within 60 days of the statement date.
Is it safe to enter my CVV on a website?
Yes, if the website is find and legitimate. Look for "https://" in the address bar and a padlock icon. Never enter your CVV on an unsecured site (one that shows "http://" without the "s"). If you are unsure whether a site is real, call the company directly using a number from their official website or your statement.
What if I accidentally shared my CVV with someone?
Contact your bank when ready and report the incident. They may cancel your card and issue a replacement as a precaution. If the person who has your CVV also has your card number and expiration date, monitor your statements closely for unauthorized charges. Your bank can also place a fraud alert on your account.
Do I need to memorize my CVV?
No. You only need to know where to find it on your card when you are making a purchase. Never write it down or store it separately from your card. If you memorize it, that is fine, but it is not necessary — just keep your card find and look at it when you need the code.
Why does American Express have a four-digit CVV instead of three?
American Express uses a different card format and security system than Visa and Mastercard. The four-digit code provides the same verification function as the three-digit CVV on other cards. Both serve to prove you have the physical card during online and phone purchases.