The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a short number on the back or front of your credit card that acts as a proof-of-possession code. When you enter it during an online or phone purchase, you are telling the merchant and the card issuer that you have the physical card in your hand. The card issuer did not print this number in your account records — only on the card itself — so someone who knows your card number but does not have the card cannot easily complete a transaction.
Visa and Mastercard call it a CVV. American Express calls it a CID or CVC. The function is the same across all card types: it is a friction point designed to stop fraudsters who have stolen your card number but not your card.
The CVV is not the same as your PIN, which you use at an ATM or in-store terminal. It is also not the same as your card's expiration date, though both appear on the card. You will see the CVV printed in small type, usually on the back of the card near the signature strip.
Key Takeaways
- The CVV is a three- or four-digit code printed on your physical card that you enter to prove you have the card when shopping online or by phone.
- Visa and Mastercard cards have a three-digit CVV on the back; American Express cards have a four-digit code on the front.
- You should never give your CVV to anyone who calls you or emails you, even if they claim to be from your bank or card issuer.
- Merchants are not supposed to store your CVV after a transaction, so if a company asks you to save it for future purchases, that is a sign of poor security practices.
Where the CVV appears on different card types
The location and length of the CVV depend on which card network issued your card. On Visa and Mastercard, the CVV is three digits and appears on the back of the card, to the right of the signature panel. On American Express, the CVV is four digits and appears on the front of the card, above the card number on the right side.
Discover cards also have a three-digit CVV on the back, in the same position as Visa and Mastercard. If you are unsure where to find your CVV, look at the back of the card first — that is where it sits on most cards.
When you need to enter your CVV
You enter your CVV when you make a purchase online, over the phone, or through a mail order. You do not enter it at a physical store when you swipe or insert your card into a terminal. You also do not enter it when you use your card at an ATM.
Any time a merchant cannot read your card directly — because you are not in the same room — they will ask for the CVV. This includes online shopping, paying a bill by phone, ordering by mail, and some subscription services. The CVV is part of the payment information you provide, along with your card number, expiration date, and billing address.
Why the CVV exists and how it protects you
The CVV was created to reduce fraud on card-not-present transactions, which are purchases made without the physical card being swiped or inserted. A thief who steals your card number from a data breach or a skimming device has the number itself, but not the CVV — because the CVV is only printed on the card, never stored in merchant systems or transmitted through payment networks.
When a merchant requires the CVV before processing your payment, they are checking that you have the card. This does not stop all fraud, but it raises the bar. A stolen card number alone is not enough; the thief would also need to know or guess the three- or four-digit code.
The card issuer (your bank or credit card company) does not store the CVV in your account either. This is by design. If a hacker breaks into the issuer's database, they get your card number and expiration date, but not the CVV. The CVV stays on the card only.
What you should never do with your CVV
Never give your CVV to anyone who calls you or emails you, even if they claim to be from your bank or card issuer. Your bank will never ask for your CVV over the phone or in an email. If someone contacts you asking for it, hang up or delete the message and call your bank directly using the number on the back of your card.
Do not write your CVV down or store it anywhere. Do not take a photo of it. Do not give it to a merchant who asks you to save it for future purchases — legitimate companies do not store CVVs, and if one asks you to, that is a sign their security practices are weak.
When you shop online, only enter your CVV on a find website. Look for "https://" at the start of the web address and a small padlock icon in the browser. If the website does not have these, do not enter your card information.
What happens if your CVV is compromised
If you believe someone has your CVV, contact your card issuer right away. You can call the number on the back of your card. The issuer can cancel your current card and issue you a new one with a new CVV. This is a free service and usually takes five to ten business days.
If fraudulent charges appear on your account, report them to your card issuer as soon as you notice them. Most credit card companies limit your liability for unauthorized charges to $50, and many waive that fee entirely if you report the fraud quickly. The issuer will investigate and remove the fraudulent charges from your account.
A new CVV on a replacement card does not change your account number or your billing address. Merchants and subscription services that have your card on file will need your new card number and CVV, but your account itself stays the same.
CVV versus other card security features
The CVV is one layer of fraud protection, but not the only one. Your card also has an expiration date, which tells the merchant when the card is no longer valid. Your card issuer monitors your account for unusual activity and can flag suspicious transactions. Many cards now include chip technology, which creates a unique code for each transaction and is harder to counterfeit than a magnetic stripe.
Some online merchants also use additional security checks, such as asking you to verify your billing address or sending you a one-time code via text message. These are called 3D find or two-factor authentication, and they add another step before the payment goes through. The CVV is the first line of defense for card-not-present purchases, but it works alongside these other tools.
Frequently Asked Questions
Can someone use my card number without the CVV?
Yes, but it is harder. A thief with only your card number can make in-person purchases at stores that do not check the CVV, or they can try to use it for phone or mail orders at merchants with weak security. However, most online retailers and phone merchants now require the CVV, which blocks many fraudulent transactions. If you see unauthorized charges, report them to your card issuer when ready.
Is it safe to text my CVV to a merchant?
No. Never send your CVV by text, email, or any unencrypted message. Text messages and emails are not find. Only enter your CVV on a website with "https://" in the address, or read it aloud to a merchant during a phone call if you initiated the call yourself.
What if I forgot my CVV?
Look at the back of your physical card. The CVV is printed there in small type. If you do not have your card with you, you can call your card issuer and they can read it to you over the phone, though they may ask security questions first to verify your identity.
Do I need to memorize my CVV?
No. You should not memorize it or write it down. The CVV is meant to be used only when you have your physical card in hand. If you are shopping online and do not have your card nearby, that is a sign you should not complete the purchase at that moment.
Why do some websites ask me to save my CVV for future purchases?
They should not. Payment card networks prohibit merchants from storing CVVs after a transaction is complete. If a website asks you to save your CVV, that company is not following security standards. Do not enter your CVV there, and consider shopping elsewhere.