The CVV and CVC are the three or four digits on your card that prove you physically have it

The CVV (Card Verification Value) or CVC (Card Verification Code) is a short security number printed on your credit card. It is not encoded in the magnetic stripe or chip — it only exists on the physical card itself. When you enter this number during an online purchase or over the phone, the merchant is checking that you actually hold the card in your hand, not just that you know the card number.

CVV and CVC are the same thing. Visa and Discover call it CVV. American Express and Mastercard call it CVC. The purpose is identical: to add a layer of fraud protection by requiring information that cannot be stolen from a receipt, a data breach, or a skimmed card reader.

This number is one of the few pieces of card information that legitimate merchants are not supposed to store after a transaction completes. If a merchant saves your CVV, they are breaking payment industry rules, and that stored number becomes a liability if their system is breached.

Key Takeaways

  • CVV and CVC are three-digit security codes (four digits on American Express) printed on the back or front of your card that prove you physically possess it.
  • The number is not encoded in your card's chip or magnetic stripe, so it cannot be read by a card reader or stolen from a receipt.
  • Merchants should never ask for your CVV in person or store it after your transaction is complete — if they do, report it to your card issuer.
  • Never share your CVV over email, text, or phone unless you initiated the call to a number on your card statement.

Where to find your CVV or CVC on your card

For Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. Look for a small group of numbers at the end of a longer string — the CVV is the last three digits of that string.

For American Express cards, the CVC is a four-digit number printed on the front of the card, above the account number on the right side. It is much shorter than the CVV on other cards and sits in a different location.

If your card is damaged and you cannot read the number, call the phone number on the back of your card and ask your issuer to read it to you. Do not search for it online or ask a merchant to help you locate it.

Why merchants ask for it online and over the phone

When you shop online, the CVV is one of the required fields in the payment form. The merchant's payment processor sends this number to your card issuer in real time to verify that you have the physical card. If the number does not match what the issuer has on file, the transaction is declined.

Over the phone, a merchant or customer service representative may ask for your CVV for the same reason — to confirm you are the cardholder. However, you should be cautious. If you called the merchant using a number from your card statement or their official website, it is safe to provide. If they called you unsolicited, or if you found their number through a search result or email link, do not give it to them. Scammers often pose as merchants or card issuers and ask for the CVV to steal your card information.

What you should never do with your CVV

Never write down your CVV or store it anywhere — not in your phone, not in a password manager, not in an email draft. The entire point of the CVV is that it is temporary information you use once and forget. If someone has your CVV, they have proof that they have held your physical card at some point.

Never share your CVV in an email, text message, or social media message. Legitimate merchants and your card issuer will never ask for it this way. If someone contacts you claiming to be from your bank or a store and asks for your CVV via text or email, it is a scam. Do not respond.

Never give your CVV to someone who is not processing a payment you initiated. If a store employee asks for it while you are standing at the register, that is unusual — most in-person transactions do not require it. Ask why they need it, and if the answer does not make sense, decline and use a different payment method.

What happens if your CVV is compromised

If you believe someone has your CVV, contact your card issuer when ready using the number on the back of your card. You do not need to wait for fraudulent charges to appear. Your issuer can issue you a new card with a new CVV, and the old number will no longer work.

Fraudulent charges made with your card number and CVV are usually covered by your card issuer's fraud protection. Most cards offer zero liability for unauthorized purchases, meaning you will not be charged for transactions you did not make. However, you must report the fraud within a specific window — usually 60 days from when you first see the charge on your statement. Report it as soon as you notice it.

If you gave your CVV to a scammer, also monitor your credit report for new accounts opened in your name. You can view your credit report for free once per year at annualcreditreport.com, which is the official site run by the three major credit bureaus.

CVV versus other card security features

Your CVV is one layer of fraud protection, but not the only one. Your card also has a chip (on most newer cards) that encrypts transaction data and makes the card harder to counterfeit. The chip is used in person at a terminal; the CVV is used online or over the phone.

Your card issuer also monitors your account for unusual activity — large purchases in a different state, multiple transactions in a short time, or purchases from high-risk merchants. If the issuer suspects fraud, they may decline the transaction or contact you to confirm it was you.

Some online merchants also use additional verification, such as asking you to enter a code sent to your phone or email, or requiring you to log into your card issuer's app to confirm the purchase. These are called 3D find or two-factor authentication, and they add another barrier between a scammer and your card.

Frequently Asked Questions

Can someone use my card if they only have the card number and CVV?

They can attempt an online purchase, but most merchants and card issuers now require additional information — your billing address, zip code, or a one-time code sent to your phone. Having the CVV alone is not enough to may provide a successful fraudulent transaction. Report any unauthorized charges to your issuer when ready.

Is it safe to enter my CVV on a website?

It is safe if the website is legitimate and uses encryption. Look for "https://" at the start of the web address and a padlock icon in your browser. Never enter your CVV on a website you do not recognize or that was linked from an email or text message you did not expect.

Why does my card have a CVV if I have a chip?

The chip protects you in person, but the CVV protects you online and over the phone. Chips cannot be read by a regular card reader or a scammer looking at your card — they require a special terminal. The CVV serves a different purpose and is still necessary for transactions where the chip cannot be used.

What if I accidentally shared my CVV with a scammer?

Call your card issuer when ready using the number on the back of your card. Request a new card with a new CVV. Most issuers can issue a replacement within one to two business days. Monitor your account for unauthorized charges and report any you find within 60 days.

Do I need to memorize my CVV?

No. You should only enter it when you are making a purchase. Memorizing it increases the risk that you will accidentally share it or that someone will see you write it down. Treat it like a password you use once and then discard.