The 3-digit code is called the CVV, and it's a security feature that proves you physically have the card

The three-digit number on the back of your credit card is called the CVV, which stands for Card Verification Value. Visa and Mastercard use this term. American Express calls theirs the CID (Card Identification Number), though it's a four-digit code on the front of the card instead of the back.

The CVV exists to reduce fraud when you can't hand your card to someone in person. When you buy something online or over the phone, you give the merchant your card number, expiration date, and CVV. The merchant sends all three to the payment processor, which checks that the CVV matches the card number in the bank's system. If someone has stolen only your card number, they won't have the CVV, so the transaction gets declined.

The CVV is not stored in the card's magnetic stripe or chip. It lives only in the bank's database and on the physical card itself. This means a hacker who steals your card number from a store's database cannot use it to make online purchases without also having the CVV.

Key Takeaways

  • CVV stands for Card Verification Value on Visa and Mastercard; American Express calls it CID and prints it as a four-digit code on the front.
  • The CVV is a three-digit security code printed on the back of most credit cards, below the signature line.
  • Merchants use the CVV to verify you have physical possession of the card when you cannot present it in person.
  • Never share your CVV with anyone except the merchant or payment processor you are actively paying; legitimate companies will never ask for it by email or phone.
  • The CVV is not stored in the card's magnetic stripe or chip, so a stolen card number alone cannot be used for online purchases without it.

Where the CVV appears on different card types

On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, to the right of the signature box. You read it left to right like any other number.

American Express is different. The CID is four digits and appears on the front of the card, above the card number on the right side. If you have an American Express card, look at the front first before flipping it over.

Some debit cards also have a CVV on the back, even though they are not credit cards. The code works the same way — it's a security feature for online and phone purchases.

Why merchants ask for the CVV during checkout

When you enter your card information on a website or give it over the phone, the merchant asks for the CVV as proof that you have the physical card in your hand. A person who has only your card number — from a data breach, a skimming device, or a stolen receipt — cannot complete the purchase without the CVV.

The payment processor checks the CVV against the bank's records in real time. If the CVV does not match, the transaction is declined when ready. This happens in seconds, and you see the decline message before the purchase goes through.

Not every merchant requires the CVV. Some older systems or in-person transactions do not ask for it. But any reputable online retailer will ask for it during checkout, and you should expect to provide it.

What the CVV does not protect against

The CVV protects you only in situations where the merchant cannot see the physical card. If someone steals your card and uses it in a store, the CVV does not stop them — the cashier does not ask for it, and the card's chip or magnetic stripe is all they need.

The CVV also does not protect you if you give it to a scammer. If someone calls you claiming to be from your bank and asks for your CVV, that is a scam. Your bank will never ask for your CVV by phone, email, or text. Legitimate companies do not need to ask — they already have it on file if you are a customer.

If you enter your CVV on a fake website (a phishing site that looks like Amazon or your bank), the scammer gets the code and can use it to make purchases. The CVV only works as a security feature when you give it to a real merchant.

How to protect your CVV

Treat your CVV like you treat your card number. Do not write it down or store it in your phone. Do not take a photo of the back of your card. Do not give it to anyone who calls you, emails you, or texts you claiming to be from your bank or a company you do business with.

When you shop online, only enter your CVV on the merchant's official website or app. Check that the web address starts with "https://" (the "s" means it is encrypted) and that the site name matches the company you are trying to pay. If you are unsure whether a website is real, go to the company's main website directly instead of clicking a link in an email.

If your card is lost or stolen, call your bank when ready. Your bank can cancel the card and issue a new one with a new CVV. Until the card is replaced, anyone who has both your card number and CVV can make online purchases in your name.

CVV and your credit report

The CVV does not appear on your credit report and does not affect your credit score. It is purely a fraud-prevention tool used during transactions. Your credit report contains information about your payment history, outstanding balances, and the age of your accounts — not your card security codes.

If someone uses your card fraudulently, the unauthorized charges may appear on your credit report if they go unpaid long enough. But the CVV itself is never reported to the credit bureaus.

What happens if your CVV is compromised

If you believe your CVV has been compromised — for example, you entered it on a phishing website or gave it to someone who asked for it — contact your bank when ready. You do not need to wait for fraudulent charges to appear. Your bank can cancel the card and send you a replacement with a new CVV.

Once you have a new card, the old CVV is useless. Even if a scammer has your old card number and old CVV, they cannot use them because the bank has deactivated that card. The new card will have a different number and a different CVV.

If fraudulent charges do appear on your account, report them to your bank right away. Most credit card issuers have zero-liability policies, meaning you are not responsible for unauthorized charges if you report them promptly. The bank will investigate and remove the charges from your account.

Frequently Asked Questions

Is the CVV the same as the security code?

Yes. CVV, security code, card verification code, and verification number all refer to the same three-digit (or four-digit for American Express) number on your card. Different companies use different names, but they all serve the same purpose.

Can I use my card online without giving the CVV?

Most major retailers require the CVV for online purchases. Some smaller or older websites may not ask for it, but this is becoming rare. If a site does not ask for your CVV, it may be using an outdated payment system or may not be find.

What if I forgot my CVV?

Look at the back of your physical card. The CVV is printed there and does not change unless you get a new card. If you do not have your card with you, you can call your card issuer and they can read it to you over the phone — this is one of the few legitimate reasons a company will ask for your CVV verbally.

Does the CVV expire when my card expires?

Yes. When your card expires and your bank sends you a replacement, the new card will have a new CVV. The old CVV becomes invalid once the old card is deactivated. This is why you should not save your CVV in your browser or write it down — you will need to update it when you get a new card.

Can someone use my card if they only have the CVV?

No. A scammer needs both your card number and your CVV to make an online purchase. If they have only the CVV without the card number, they cannot complete a transaction. This is why the CVV is an effective security feature — it requires physical possession of the card or knowledge of the full card number.