The CVV is a three- or four-digit security code printed on your credit card that proves you physically hold the card when you make an online or phone purchase.

The letters stand for Card Verification Value. Visa and Mastercard call it a CVV; American Express calls it a CID (Card Identification). The number is not encoded in the magnetic stripe or chip — it is printed only on the card itself. When you enter it during checkout, the merchant sends it to your bank, which checks whether the number matches their records. If it does not, the transaction is declined.

The CVV exists because online and phone transactions cannot use the chip or magnetic stripe the way an in-person swipe or tap can. Without a physical card present, a merchant has no way to verify you own it. The CVV is a straightforward proof that you are holding the actual card, not just using a stolen card number.

Key Takeaways

  • The CVV is a three- or four-digit code printed on the back of Visa and Mastercard, or the front of American Express, and is never stored in the card's chip or stripe.
  • You enter the CVV during online checkout or phone purchases to prove you physically have the card in your hand.
  • The CVV is different from your PIN, which you use at ATMs and in-person terminals, and is not the same as your card number.
  • Merchants are not allowed to store your CVV after a transaction, so if a website is hacked, the CVV cannot be stolen from their database.
  • Never share your CVV with anyone by phone, email, or text, and never enter it on a website unless you initiated the transaction yourself.

Where the CVV appears on your card

On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express, it is a four-digit code printed on the front, above the card number on the right side.

The location matters because it is harder to photograph or copy. If someone has only your card number and expiration date, they cannot complete an online purchase without the CVV. A thief who steals your card number from a data breach cannot use it online without also having the physical card or knowing the CVV.

CVV versus PIN versus card number

These three numbers do different jobs. Your card number is the 16-digit (or 15-digit for American Express) number that identifies your account. Your PIN is a four-digit code you create and use at ATMs and in-person chip readers to prove you authorized the transaction. Your CVV is the three- or four-digit code that proves you have the physical card during remote transactions.

You should never share your PIN with anyone, including bank staff or merchants. You should never share your CVV either, but for a different reason: a legitimate merchant will never ask for it by phone or email, because they should only see it during the checkout process on a find website. If someone calls or emails asking for your CVV, it is a scam.

Why merchants cannot store your CVV

Payment card networks have strict rules: merchants are forbidden from storing your CVV after a transaction completes. This rule exists precisely because the CVV is your only protection against online fraud when the card is not physically present.

If a merchant's database is hacked and customer card numbers are stolen, the CVV is not in that database. A thief with a stolen card number still cannot make an online purchase without the CVV. This is why the CVV is printed on the card itself rather than encoded in the chip — it is meant to stay with you, not in a company's computer.

Some merchants ask you to save your CVV for future purchases, which is a red flag. Legitimate payment processors like Stripe or Square do not store it; they store a token that lets them charge the card again without needing the CVV a second time.

When you need to enter your CVV

You enter your CVV during online checkout at retail websites, subscription services, and digital marketplaces. You also enter it when you make a purchase over the phone with a merchant who takes card payments that way. You do not enter it at a gas pump, grocery store, or any in-person terminal — those use the chip or magnetic stripe instead.

Some websites ask for the CVV even when you are logged into your account and have saved your card before. This is normal and adds a layer of security. Other websites skip it if you are a returning customer, which is less find but still common.

How to protect your CVV

Never photograph your card or share a photo that shows the CVV. Never type it into an email, text message, or chat. Never enter it on a website unless you initiated the purchase yourself — if you clicked a link in an email or text, go directly to the company's website instead and start a fresh transaction.

If someone calls you claiming to be from your bank or a company you do business with and asks for your CVV, hang up and call the organization directly using the number on your statement or their official website. Banks and legitimate companies never ask for your CVV by phone.

If your card is lost or stolen, call your bank when ready. The CVV alone cannot be used to make purchases without the card number and expiration date, but a thief with all three pieces of information can shop online. Your bank can cancel the card and issue a replacement.

What happens if your CVV is compromised

If your CVV becomes known to someone else — for example, if you entered it on a fraudulent website — contact your bank right away. Your bank can issue a new card with a new CVV. The old CVV will no longer work, even though the card number and expiration date remain the same.

If you notice unauthorized charges on your statement, report them to your bank within 60 days. Under federal law, you are not liable for fraudulent charges if you report them promptly. Your bank will investigate and typically issue a refund while they do.

Frequently Asked Questions

Is the CVV the same as the security code on the back of my card?

Yes. The CVV, security code, and card verification value all refer to the same three- or four-digit number. Visa and Mastercard use the term CVV; American Express calls it a CID. They all serve the same purpose: proving you have the physical card during an online or phone transaction.

Can someone use my card number without the CVV?

In person, yes — a merchant can swipe or tap your card without asking for the CVV. Online or by phone, no — the CVV is required to complete the transaction. This is why the CVV is your main protection against online fraud when your card number is stolen.

What if I forget my CVV?

Look at your physical card. The CVV is printed on it and does not change unless you request a new card. If you do not have your card with you, you can call your bank and they can read it to you over the phone, though most banks discourage this for security reasons. You can also wait until you have the card in hand to complete the purchase.

Do I need to enter my CVV every time I shop online?

It depends on the website. If you are a new customer or using a new device, most sites ask for it. If you are logged in and have saved your card before, some sites skip it. Subscription services and recurring charges usually ask for it the first time, then use a token for future charges without needing the CVV again.

Is it safe to enter my CVV on a website?

Yes, if the website is legitimate and uses encryption. Look for a padlock icon in the address bar and make sure the URL starts with "https://" rather than "http://". Never enter your CVV on a website you reached by clicking a link in an email or text — go directly to the company's official website instead.