The CVV is a three- or four-digit security code printed on your card, separate from your card number

The CVV (Card Verification Value) is a short number on the back of your credit card that proves you physically have the card in your hand. It sits on the signature strip, usually after the last four digits of your card number. On American Express cards, it appears on the front instead. The number changes nothing about how your card works — it is purely a security checkpoint.

When you buy something online or over the phone, the merchant asks for this number to confirm you are not just using a stolen card number. Someone who has only your card number (from a data breach, for example) cannot complete the purchase without the CVV. It is one of the reasons why card-not-present fraud — buying online with a stolen number — is harder than it sounds.

The CVV is not the same as your PIN. Your PIN is what you enter at an ATM or a chip reader in a store. The CVV is only for remote purchases where the merchant cannot see your card.

Key Takeaways

  • The CVV is a three- or four-digit code on the back of your card (or front, for American Express) that proves you have the physical card.
  • You only need to provide your CVV for online, phone, or mail purchases — not for in-person transactions where you swipe or insert your card.
  • Never share your CVV in an email, text, or phone call initiated by someone else, because legitimate companies will never ask for it that way.
  • If your CVV is compromised, you do not need to replace your card unless fraud actually occurs, but monitor your statements closely.

Where the CVV appears on different card types

Most Visa, Mastercard, and Discover cards print the CVV on the back, in the signature strip area. It is the last three digits after the card number. American Express cards are different — the four-digit CVV appears on the front, above the card number on the right side.

The location matters only if you are reading it off the card yourself. When you enter it online, the form will tell you where to look. If you cannot find it, check the back signature strip first, then the front if you have an American Express card.

Why merchants ask for the CVV

A thief who steals your card number from a database or a receipt has the 16-digit number but not the CVV. The CVV is printed on the card itself, not stored in the magnetic stripe or chip, so it does not appear in most data breaches. This makes it a quick way for an online merchant to verify that a real person with the actual card is making the purchase.

The CVV also protects you. If someone uses your card number online and you did not authorize it, the CVV requirement means the fraud is less likely to succeed. You can then dispute the charge with your card issuer, and the merchant bears the loss because they accepted a transaction without proper verification.

What not to do with your CVV

Never give your CVV to anyone who calls you, texts you, or emails you claiming to be from your bank or credit card company. Your bank already has your CVV on file — they will never ask you to provide it. If someone requests it, hang up or delete the message when ready.

Do not write your CVV on receipts, store it in your phone, or email it to yourself. If you need to remember it for a recurring payment (like a subscription), store it in your password manager, not in a note or photo. The goal is to keep the CVV as isolated as possible — known only to you and the merchant you are actively paying.

If you receive a receipt that shows your full card number and CVV, ask the merchant to reprint it without that information. Receipts should show only the last four digits of your card number and no CVV at all.

What happens if your CVV is exposed

If your CVV appears in a data breach or you accidentally share it with the wrong person, you do not automatically need a new card. The CVV alone cannot be used to make a purchase — a thief would still need your card number, expiration date, and billing address. Monitor your statements for unauthorized charges, and if you see any, contact your card issuer right away.

If you are worried but have not seen fraud, you can ask your card issuer to reissue your card with a new number and new CVV. This is optional, not required. Most people do this only if fraud has already occurred or if they shared the CVV with someone they no longer trust.

CVV versus other card security features

The CVV is one layer of protection, but not the only one. Your card also has a chip (on newer cards) that creates a unique code for each transaction, making it much harder to counterfeit. Your card issuer also monitors for unusual spending patterns and can block a transaction if it looks suspicious — a purchase in another country minutes after a local one, for example.

Online merchants also use address verification (checking that your billing address matches what the card issuer has on file) and fraud detection software. The CVV is the simplest tool in this toolkit, but it works because most thieves do not have it.

Frequently Asked Questions

Do I need to enter my CVV for in-person purchases?

No. When you swipe, insert, or tap your card at a store, the merchant does not ask for the CVV. The chip or magnetic stripe handles the verification. The CVV is only for online, phone, or mail orders where the merchant cannot physically see your card.

What if a website does not ask for a CVV?

Some merchants skip the CVV check, especially for small purchases or repeat customers. This is their choice and their risk — if fraud occurs, they are more likely to be held responsible. You can use the card safely either way, but a site that asks for the CVV is following better security practice.

Can someone use my card number without the CVV?

In person, yes — they can swipe or insert the card without the CVV. Online, it depends on the merchant. Many require the CVV, but some do not, especially for subscriptions or saved payment methods. This is why monitoring your statements matters even if you keep your CVV private.

Does the CVV change if I get a replacement card?

Yes. When your card issuer sends you a new card (whether because yours expired, was damaged, or you requested a replacement), the new card has a different CVV. If you have saved the old CVV for a recurring payment, you will need to update it with the merchant before your next billing date.

Is the CVV the same as the security code?

Yes, they are the same thing. Different card companies use different names — Visa and Mastercard call it CVV, American Express calls it CID (Card Identification Number) — but they all serve the same purpose. The form you are filling out will tell you which one to enter.