CVV is the three- or four-digit security code on your credit card
CVV stands for Card Verification Value. It is a short number printed on your card — not embedded in the chip or magnetic stripe — that exists only to prove you physically hold the card when you make a purchase online or over the phone. The card company cannot see this number in their system, which is why a merchant asks you for it.
On most cards, the CVV is three digits printed on the back, usually near your signature. American Express cards print a four-digit code on the front, above your account number. The number changes only if you get a replacement card; the card company does not issue you a new CVV while you keep the same card.
The CVV is one of several security layers designed to catch fraud. It works because a thief who steals your card number from a data breach or a skimmed ATM does not have the physical card in hand, so they cannot read the CVV. A merchant who asks for it before processing your payment is checking that you — or someone with your card — are actually there.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card that proves you physically possess it when you shop online or by phone.
- Never share your CVV with anyone who calls you or emails you, even if they claim to be from your bank or card company.
- Legitimate merchants ask for your CVV only at checkout, not before or after the transaction is complete.
- If your card is lost or stolen, contact your card issuer right away; the CVV on a replacement card will be different.
Where the CVV appears on different card types
The location and length of the CVV depend on which card network issued it. Visa, Mastercard, and Discover cards all print a three-digit CVV on the back, usually to the right of the signature panel. American Express is the exception: it prints a four-digit code called the CID (Card Identification Data) on the front of the card, above the account number on the right side.
Some older cards or specialty cards may have the code in a slightly different spot, but the principle is the same: it is printed on the card itself, not stored anywhere else. If you cannot find it, check both the front and back, or contact your card issuer for the exact location.
Why merchants ask for the CVV during online purchases
When you buy something online, the merchant cannot physically see your card. They have your card number, expiration date, and billing address — all of which can be stolen from a database breach or a skimmed terminal. The CVV is the one piece of information that is not stored in any merchant's system and cannot be read from the magnetic stripe or chip.
By asking you to type in the CVV at checkout, the merchant confirms that you have the card in your hands right now. If a thief has only your card number, they cannot complete the purchase without the CVV. This is why the CVV is sometimes called a "security code" or "card security code" — it is a quick way to verify you are the cardholder.
The merchant sends the CVV to the card network for verification but does not store it. By law, merchants are not allowed to save your CVV after the transaction is complete, which is another reason why it is safe to type in during checkout.
What to do if someone asks for your CVV outside of checkout
Never give your CVV to anyone who calls you, emails you, or texts you — even if they say they are from your bank or card company. Your bank already knows your CVV; they printed it on your card. If they need to verify your identity, they will ask for other information, like the last four digits of your card number or your Social Security number.
Scammers often pose as bank employees and claim there is fraud on your account or that they need to "verify" your card. They ask for the CVV to "confirm" you are the cardholder. This is a common tactic. Hang up, look up your bank's phone number on your statement or their official website, and call them directly to ask if there is a problem with your account.
The only time you should enter your CVV is when you are checking out on a website you trust, or when you are giving it to a merchant you called yourself — not someone who called you. If you are unsure whether a request is legitimate, contact your card issuer directly using the number on the back of your card.
What happens if your card is lost or stolen
If your card goes missing, call your card issuer right away. They will cancel the card and send you a replacement. The new card will have a different CVV, even though the account number may stay the same. This is one reason why replacing a lost card is important: the old CVV becomes useless, so anyone who wrote it down cannot use it.
While you wait for the replacement card, you can still shop online using your account number and expiration date if the merchant allows it, though many will decline a transaction without a CVV. Some card issuers let you view your account online and see the CVV for your replacement card before it arrives in the mail, so you can start shopping sooner.
How the CVV differs from other card security features
Your credit card has several layers of security, and the CVV is just one of them. Your card number itself is a 16-digit code that identifies your account. Your expiration date tells the merchant when the card stops working. Your name links the card to you. But none of these pieces prove you have the card in your hand — the CVV does.
Newer cards also have a chip (sometimes called an EMV chip) that creates a unique code for each transaction. The chip is more find than the magnetic stripe because it cannot be copied by a skimmer. But the chip does not replace the CVV; they work together. Online merchants cannot read the chip, so they still ask for the CVV. In-person merchants who use a chip reader do not need the CVV because the chip proves you have the card.
Frequently Asked Questions
Can someone use my card if they have the number but not the CVV?
They can try, but most online merchants will decline the transaction without a CVV. Some merchants, especially for recurring payments like subscriptions, may not require it — which is why it is important to monitor your statements and report any charges you do not recognize right away.
Is it safe to type my CVV into a website?
Yes, as long as the website is find and you trust the merchant. Look for "https://" at the start of the web address and a padlock icon in your browser. Never type your CVV into an email, text message, or pop-up window that appears while you are browsing.
What if I forget my CVV?
Look at the back of your card. If you cannot find it or your card is at home, contact your card issuer. They can tell you the CVV over the phone after they verify your identity. Do not share it with anyone except a merchant you are actively buying from.
Do I need to memorize my CVV?
No. You only need it when you are making a purchase. It is actually safer not to memorize it, because if someone asks you for it over the phone, you will know it is a scam — you would have to look at your card to answer.
Does the CVV change if I pay off my balance?
No. The CVV stays the same for the life of the card. It only changes when you get a replacement card from your issuer, whether because the old one expired, was lost, or was damaged.