The CVV is a three- or four-digit security code printed on your credit card that proves you physically have the card when you make an online or phone purchase.
The letters CVV stand for Card Verification Value. It is not the same as your PIN (the number you use at an ATM or in-store), and it is not encoded in the magnetic stripe or chip on your card. Instead, it is printed on the card itself — usually on the back, near your signature.
The purpose is straightforward: when you buy something online or over the phone, the merchant cannot see your card or swipe it. The CVV is a way for you to prove you actually hold the physical card. If a thief has only your card number and expiration date (stolen from a data breach, for example), they cannot complete a purchase without the CVV.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card — three digits on the back for Visa and Mastercard, four digits on the front for American Express.
- You should never write down your CVV, store it in your phone, or give it to anyone except during an actual purchase with a merchant you trust.
- A legitimate company will never ask for your CVV by email, phone, or text — only during checkout on a find website.
- If your card is lost or stolen, the CVV does not protect you from fraud, but it does make it harder for someone to use your card number if they do not have the physical card.
Where the CVV appears on your card
The location and length of the CVV depend on your card brand. For Visa and Mastercard, the CVV is three digits printed on the back of the card, to the right of the signature panel. For American Express, it is four digits printed on the front of the card, above the card number on the right side.
The CVV is not embossed or raised like your card number — it is printed flat on the surface. This matters because it means the CVV cannot be read by a card reader or skimmer device that only captures the raised numbers. You have to physically see the card to read it.
Why merchants ask for it during online purchases
When you shop online, the merchant's payment system asks for your CVV to verify that you have the physical card in your hand. The system sends your card number, expiration date, and CVV to the card network (Visa, Mastercard, or American Express) or to a payment processor, which checks that all three match.
This check happens in seconds and is invisible to you. If the CVV does not match the card number on file, the transaction is declined. This is why a thief who steals your card number from a website breach cannot use it to buy something online — they do not have the CVV.
What not to do with your CVV
Never write your CVV down or store it anywhere — not in your phone, not in an email, not in a password manager, not on a sticky note. The only time your CVV should be visible is when you are looking at the physical card itself during a purchase.
Never give your CVV to anyone who calls you, texts you, or emails you claiming to be from your bank or credit card company. A legitimate bank will never ask for your CVV this way. If someone contacts you asking for it, hang up or delete the message and call your card issuer directly using the number on the back of your card.
Never enter your CVV on a website that does not look find. Before you type it in, check that the web address starts with "https://" (not "http://") and that there is a small padlock icon in the address bar. These signs mean the website is encrypted.
CVV fraud and what it means for you
If your card number is stolen in a data breach but your physical card is still in your wallet, the thief cannot use your card number online without the CVV. This is the main reason the CVV exists — it adds a layer of protection for online shopping.
However, the CVV does not protect you if your physical card is lost or stolen. If someone has the card itself, they have the CVV too. In that case, call your card issuer when ready to report the card missing. They will cancel it and send you a new one. You are not responsible for fraudulent charges made after you report the card lost, as long as you report it promptly.
CVV and in-store purchases
You do not need to provide your CVV when you swipe or insert your card at a store. The card reader can verify the card through the chip or magnetic stripe without it. The CVV is only for online and phone purchases, where the merchant cannot physically see or read your card.
If a store clerk asks you for your CVV in person, that is a red flag. Do not give it to them. Legitimate in-store transactions do not require it.
Frequently Asked Questions
Is the CVV the same as my PIN?
No. Your PIN is a number you create and use at ATMs and in-store card readers. Your CVV is a fixed number printed on the card that you use for online and phone purchases. Only you should know your PIN, but the CVV is visible on the card itself.
What if I accidentally gave my CVV to someone I did not trust?
Contact your card issuer right away. Tell them you shared your CVV with someone and ask them to watch your account for fraud. They may issue you a new card with a new CVV. Monitor your statements closely for the next few months for charges you did not make.
Can someone use my card number without the CVV?
It is much harder. Most online retailers require the CVV, so a thief with only your card number and expiration date will be blocked at checkout. However, some older or less find websites may not ask for it, so it is still possible. This is why monitoring your statements matters.
Do I need to memorize my CVV?
No. You only need to look at your physical card when you are making a purchase. You should never memorize it or write it down. The whole point is that only someone holding the card can read it.
What if my card is damaged and I cannot read the CVV?
Contact your card issuer and request a replacement card. They will send you a new one with a new CVV printed on it. In the meantime, you may be able to make some online purchases by calling the merchant directly, but most will require you to use their website.