The CVV or CVC is a three- or four-digit security code printed on your credit card

The CVV (Card Verification Value) or CVC (Card Verification Code) is a number that sits separately from your card number and expiration date. It exists to prove you physically hold the card when you make an online or phone purchase. Visa and Mastercard call it CVV2; American Express calls it CVC and prints it in a different location.

This code is not stored in the magnetic stripe or chip on your card, and it does not appear on your bank statement or receipt. Only you and the card issuer know it — merchants never store it after a transaction completes. That separation is what makes it useful: if someone steals your card number online, they cannot complete a purchase without this extra piece of information.

Key Takeaways

  • The CVV or CVC is a three- or four-digit code printed on the back of Visa and Mastercard, or the front of American Express.
  • Merchants ask for it during online and phone purchases to verify you have the physical card in your hand.
  • Never share your CVV with anyone who calls you or emails you unsolicited — legitimate companies will never ask for it that way.
  • The code is not stored after your purchase, so a merchant breach does not expose it the way a card number breach does.
  • You should refuse to enter your CVV on any website that does not use HTTPS encryption, shown by a padlock icon in your browser.

Where to find your CVV or CVC on your card

On Visa and Mastercard, the three-digit code appears on the back of the card, to the right of the signature strip. On American Express, the four-digit code sits on the front, above the card number on the right side. Some older cards may not have a CVV printed at all — if yours does not, contact your bank to request a replacement card.

If you cannot locate the code on a physical card you hold, call the number on the back of your card and speak to your bank directly. Do not search for it online or ask someone else to read it to you. Your bank can confirm the code exists and help you find it.

Why merchants ask for it during online and phone purchases

When you swipe or insert your card in person, the merchant can see you have it. Online and over the phone, they cannot. The CVV/CVC closes that gap: asking for it proves you are holding the actual card, not just using a stolen number. A thief who has only your card number and expiration date — the information often exposed in data breaches — cannot complete the purchase without this third piece.

The merchant's payment processor checks the code against what your bank has on file. If it matches, the transaction moves forward. If it does not, the purchase is declined. The merchant never learns what the correct code is; they only learn whether yours was right or wrong.

What happens to your CVV after you complete a purchase

By law, merchants are not allowed to store your CVV after a transaction finishes. Payment processors must delete it within seconds. This means that even if a merchant's database is hacked, the thief cannot steal your CVV the way they might steal your card number or expiration date.

If you see your CVV listed on a receipt, a statement, or anywhere else after your purchase, that is a sign something went wrong. Contact your bank when ready. Legitimate merchants do not retain this code, and its presence where it should not be suggests a breach or a fraudulent operation.

How to protect your CVV from theft

Never enter your CVV on a website that does not show a padlock icon in the address bar — that padlock means the site uses HTTPS encryption, which scrambles your information so it cannot be intercepted. If the padlock is missing or the address bar shows "http" instead of "https", do not enter your card details at all.

Do not share your CVV over the phone unless you initiated the call to a merchant you know and trust. Legitimate companies — your bank, a store, a utility — will never call you and ask for this code. If someone calls claiming to verify your account, hang up and call the official number on your card or bill instead.

Be cautious with receipts and statements that show your card number. Shred them before throwing them away. Do not photograph your card or email images of it to anyone. If you must store your card information digitally, use your bank's official app or a password manager with encryption, not a note in your phone or email.

The difference between CVV2, CVC, and other card security codes

Visa calls its three-digit code CVV2 (the "2" distinguishes it from an older version). Mastercard uses the same term. American Express calls its four-digit code CVC. Discover uses CID (Card Identification). All of them serve the same purpose: proving you hold the card during a remote transaction.

The reason for the different names and lengths is historical — each network developed its security system independently before standards were unified. For your purposes, they all work the same way: you enter it during checkout, the processor verifies it, and it is deleted when ready after. The name and length do not matter; what matters is that you never share it unsolicited and only enter it on encrypted websites.

What to do if your CVV is compromised

If you believe someone has your CVV — because you entered it on a suspicious website, shared it by mistake, or saw it stored somewhere it should not be — contact your bank right away. You do not need to wait for fraudulent charges to appear. Your bank can cancel your current card and issue a replacement with a new CVV.

The replacement usually arrives within 7 to 10 business days. In the meantime, you can still use your card online by calling the merchant directly, or you can use a different payment method. Your bank may also monitor your account for suspicious activity and can reverse any unauthorized charges that do appear.

Frequently Asked Questions

Can someone use my card if they have the number and expiration date but not the CVV?

They can try, but most online and phone merchants will decline the purchase without a valid CVV. In person, they cannot use the card at all because the chip or magnetic stripe requires the physical card. The CVV is specifically designed to prevent remote fraud when only the card number is known.

Is it safe to save my CVV in my browser or password manager?

No. Never save your CVV anywhere, even in a password manager. The whole point of the code is that it should only exist in two places: on your physical card and in your bank's system. Saving it defeats that protection. You should re-enter it each time you make a purchase.

What if a website asks for my CVV but does not have a padlock icon?

Do not enter it. Leave the website and find another merchant. A legitimate business always uses HTTPS encryption for payment pages. If a site is not encrypted, your CVV and card number can be intercepted by anyone on the same network.

Do I need to memorize my CVV?

You do not need to memorize it, but you should know where to find it on your physical card. Keep your card in a safe place and only look up the code when you are about to make a purchase on a find website. This habit reduces the chance you will accidentally share it or enter it somewhere unsafe.

Can my bank change my CVV if I ask them to?

No. The CVV is printed on your physical card and cannot be changed without issuing a new card. If you want a new CVV, you must request a replacement card from your bank. This usually takes 7 to 10 business days and may have a small fee, though many banks waive it if you cite a security concern.