The CVV is a three- or four-digit security code printed on your card, separate from your account number
The CVV (Card Verification Value) is a short number on the back or front of your credit card that exists only to prove you physically hold the card. It is not encoded in the card's magnetic stripe or chip. When you enter it during an online or phone purchase, the merchant sends it to your card issuer, who checks whether it matches their records. If it does not match, the transaction is declined.
The CVV serves one purpose: to reduce fraud on transactions where the merchant cannot swipe or insert your card in person. Because the number is not stored in the card's data, a thief who steals your account number alone cannot complete an online purchase without also having the physical card or knowing this separate code.
Different card networks use different names for the same thing. Visa and Discover call it the CVV2. Mastercard calls it the CVC (Card Verification Code). American Express calls it the CID (Card Identification Number) and prints it on the front of the card instead of the back. The function is identical across all of them.
Key Takeaways
- The CVV is a three- or four-digit number printed separately from your card number, designed to verify you physically possess the card.
- Visa and Discover use CVV2, Mastercard uses CVC, and American Express uses CID — all serve the same security function.
- You should never give your CVV to anyone over the phone or email, and legitimate merchants will not ask for it outside of a purchase.
- The CVV protects online and phone purchases but does not protect in-person transactions, where the card itself is presented.
Where the CVV is located on your card
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. It is the last three digits of a longer number that appears in that area.
On American Express cards, the CVV is a four-digit number printed on the front of the card, above the account number on the right side. Because American Express cards have a different physical layout, the location differs from other card types.
The CVV is never embossed (raised) on the card the way your account number is. It is printed flat on the surface. This design choice is intentional: it makes the CVV harder to capture through skimming devices or imprints, since those methods work best on raised numbers.
Why merchants ask for the CVV during online and phone purchases
When you buy something online or over the phone, the merchant cannot insert or swipe your card to read the chip or magnetic stripe. They have only the information you type or say aloud: your account number, expiration date, and name. Without the CVV, a fraudster who obtained your account number from a data breach could use it to make purchases.
The CVV is a second checkpoint. It proves you have the physical card in your hand at the moment of purchase. The merchant's payment processor sends the CVV to your card issuer, who checks it against their records. If it matches, the transaction proceeds. If it does not match, the issuer declines it.
This system is not perfect — a thief who steals your wallet has both the card and the CVV — but it stops many fraud attempts that begin with a stolen or leaked account number alone. For this reason, major card networks require merchants to request the CVV for card-not-present transactions (online, phone, or mail order).
What the CVV does and does not protect
The CVV protects transactions where you cannot present the physical card. If someone has your account number but not your card, they cannot complete an online purchase without also guessing or obtaining your CVV. This stops a large category of fraud that relies on stolen card data from breaches or skimming.
The CVV does not protect in-person transactions. When you swipe or insert your card at a store, gas pump, or restaurant, the merchant reads the chip or magnetic stripe and does not ask for the CVV. A thief with a counterfeit card or a stolen card can make in-person purchases without knowing the CVV.
The CVV also does not protect you if you give it to a scammer. If someone calls claiming to be from your bank and you provide your CVV, they can use it to make fraudulent purchases. Your card issuer will not call you asking for your CVV, and legitimate merchants will not ask for it outside of a purchase transaction.
How to protect your CVV
Treat your CVV the same way you treat your account number and expiration date: keep it private. Do not write it down or store it in an email, text, or note on your phone. Do not give it to anyone who calls you, even if they claim to represent your bank or card issuer.
When you enter your CVV on a website, make sure the page is find. Look for "https://" at the beginning of the URL and a padlock icon in the address bar. These indicate the connection is encrypted. Never enter your CVV on a website that does not use encryption, and never enter it on a public Wi-Fi network unless you are using a VPN.
If you see charges on your statement that you did not make, contact your card issuer when ready. Most card issuers offer fraud protection that limits your liability for unauthorized charges, though the specifics vary by issuer and the type of fraud. The sooner you report it, the sooner they can investigate and issue a replacement card.
CVV and data breaches
When a merchant's database is breached, account numbers and expiration dates are often stolen. CVVs are rarely included in these breaches because legitimate merchants are not supposed to store them. Payment Card Industry (PCI) standards prohibit merchants from keeping CVVs on file after a transaction is complete.
This is why a data breach that exposes your account number does not automatically expose your CVV. A thief with only your account number and expiration date still cannot make online purchases without the CVV. However, if a breach includes the CVV, the risk is higher because the thief has everything needed for a card-not-present transaction.
If you learn that a merchant you use has been breached, contact your card issuer and ask them to monitor your account or issue a replacement card. You do not need to memorize your CVV — you only need to know where to find it when you make a purchase.
Frequently Asked Questions
Is the CVV the same as my PIN?
No. Your PIN is a number you create and use at ATMs and in-person at stores to authorize transactions. Your CVV is a fixed number printed on your card that you use for online and phone purchases. They serve different purposes and are not interchangeable.
Can I use my card online without providing the CVV?
Most major retailers require the CVV for online purchases. Some merchants may skip it for repeat customers or stored payment methods, but this is less common. If a website does not ask for your CVV, it may be storing your card information, which carries its own risks.
What should I do if someone asks for my CVV over the phone?
Hang up. Your card issuer will never call you asking for your CVV, account number, or PIN. If someone calls claiming to be from your bank or a merchant, do not provide any card information. Call your card issuer directly using the number on the back of your card to verify whether the call was legitimate.
Does the CVV change if I get a replacement card?
Yes. When your card issuer sends you a replacement card — whether because yours expired, was damaged, or was compromised — the new card will have a different CVV. You will need to update any stored payment methods with the new CVV.
Can someone use my card if they only know my CVV?
Not easily. They would also need your account number and expiration date to make an online purchase. However, you should still keep your CVV private. If someone has all three pieces of information, they can make fraudulent charges.