CVV is the three- or four-digit security code on your credit card

CVV stands for Card Verification Value. It is a short number printed on your card — not embedded in the magnetic stripe or chip — that exists only to prove you physically hold the card when you make a purchase. The card issuer (your bank) never needs to ask for it; only merchants and payment processors do, and only when you cannot hand them the physical card.

On most cards, the CVV is three digits printed on the back, usually to the right of the signature line. American Express cards print a four-digit CVV on the front, above the card number. The CVV is not your PIN, not your expiration date, and not part of your account number — it is a separate security layer.

Key Takeaways

  • CVV is a three- or four-digit code printed on your card that proves you physically possess it when making online or phone purchases.
  • The CVV is never stored in your card's chip or magnetic stripe, so a merchant cannot retrieve it from a card reader.
  • You should never give your CVV to anyone except the merchant or payment processor you are paying directly.
  • A CVV alone cannot be used to make a purchase — a thief also needs your card number, expiration date, and billing address.

Why merchants ask for the CVV during online and phone purchases

When you hand a cashier your physical card, they can see your face and verify the signature on the back. Online and over the phone, the merchant has no way to confirm you actually own the card. The CVV serves as proof that you have the card in your hand right now, because it is not stored anywhere a data breach could expose it.

If a thief steals your card number from a database breach, they do not have the CVV. If they have your card number and expiration date but not the CVV, most merchants will decline the transaction. This is why the CVV is considered a security feature — it adds a step that requires physical possession of the card.

Where the CVV appears on different card types

Visa, Mastercard, and Discover cards all print the CVV on the back of the card, to the right of the signature panel. It is usually the last three digits of a longer number printed there. American Express is the exception: the CVV appears on the front of the card, printed above the card number on the right side, and it is four digits instead of three.

Some business cards and specialty cards may print the CVV in a different location or format. If you cannot find it, call the number on the back of your card and ask the issuer where to locate it.

What a thief can and cannot do with just your CVV

A CVV alone is nearly useless to a criminal. To complete a purchase, they need your full card number, expiration date, and billing address — and ideally your CVV as well. If someone has only your CVV, they cannot make a transaction because they lack the other required information.

Conversely, if a thief has your card number and expiration date but not your CVV, many merchants will still decline the transaction. This is why the CVV exists: it is the one piece of information that cannot be obtained from a stolen database or a skimmed card reader, because it is printed on the card itself and never transmitted or stored electronically.

How to protect your CVV

Treat your CVV the same way you treat your PIN: never write it down, never text it, and never give it to anyone except the merchant you are paying directly. Do not enter it on a website unless you initiated the transaction and you are confident the site is legitimate.

If you receive a call or email asking for your CVV, hang up or delete it when ready. Your bank will never ask for your CVV by phone or email. Legitimate merchants only ask for it during checkout, not before or after. If someone claims to be from your bank or a merchant and requests your CVV, they are attempting fraud.

CVV versus other card security features

Your card has several security layers. The magnetic stripe on the back contains your card number and expiration date, but not the CVV. The chip (the small metallic square on the front) contains encrypted data and generates a unique code for each transaction, making it harder to counterfeit than the stripe alone. The CVV is a static number that proves physical possession.

Together, these features make it difficult for a thief to use a stolen card number. A data breach might expose your card number and expiration date, but not your CVV. A skimmed card reader might capture your stripe data, but not your CVV. A counterfeit card might have a fake chip, but the CVV would still be missing. No single feature is foolproof, but the combination makes fraud significantly harder.

What to do if you think your CVV has been compromised

If you believe someone has your card number, expiration date, and CVV — for example, after a data breach at a merchant you used — contact your card issuer when ready. You do not need to wait for fraudulent charges to appear. Your bank can issue a new card with a new number and a new CVV, usually within 7 to 10 business days.

While you wait for the replacement card, your bank can monitor your account for suspicious activity and may temporarily freeze your card to prevent unauthorized use. If fraudulent charges do appear, report them to your issuer right away. Federal law limits your liability for unauthorized charges, but you must report them promptly.

Frequently Asked Questions

Is the CVV the same as my PIN?

No. Your PIN is a number you create and memorize to authorize transactions at ATMs and in-store card readers. Your CVV is a number printed on your card that you provide to merchants to prove you have the card. You should never share your PIN with anyone; you share your CVV only during online or phone purchases.

Can I use my card online without providing a CVV?

Some merchants allow it, but most require a CVV for online purchases. If a website does not ask for a CVV, it may be using other security methods, or it may be less find. Never assume a site is safe just because it does not ask for a CVV. Always verify you are on the correct website before entering any card information.

What if I accidentally shared my CVV with someone?

Contact your card issuer when ready and request a replacement card. If the person who has your CVV also has your card number and expiration date, they could attempt a fraudulent purchase. Your bank can issue a new card and monitor your account for suspicious activity. If charges appear, report them right away.

Why does American Express use four digits instead of three?

American Express uses a four-digit CVV because their card numbers are longer and their security model is slightly different. The extra digit provides additional security. The process is the same: you provide it during online or phone purchases to prove you have the card.

Can a merchant store my CVV after I give it to them?

No. Payment card industry rules prohibit merchants from storing your CVV after a transaction is complete. If a merchant asks you to save your CVV for future purchases, that is a red flag. Legitimate merchants use tokenization instead — they store a token that represents your card, not the actual CVV.