CVV stands for Card Verification Value, a three- or four-digit security code printed on your credit card
The CVV is a number that only you and your card issuer know. It appears on the back of most credit cards as a three-digit code in or near the signature panel. American Express cards print a four-digit CVV on the front, above the card number. The code exists to verify that you physically hold the card when you make a purchase — especially online or over the phone, where the merchant cannot see the physical card itself.
Merchants never store your CVV after a transaction completes. Payment networks like Visa and Mastercard require this as a security rule. If a thief steals your card number from a data breach, they cannot use it online without the CVV. That separation — card number stored in merchant databases, CVV never stored — is the entire point of the system.
Your bank or card issuer generates the CVV using an algorithm that combines your card number, expiration date, and a secret key that only the issuer holds. You cannot calculate it yourself, and you should never share it with anyone except a merchant you trust during a legitimate transaction.
Key Takeaways
- CVV is a three- or four-digit security code that proves you physically own the card when making online or phone purchases.
- Visa and Mastercard cards show a three-digit CVV on the back; American Express shows a four-digit code on the front.
- Merchants are required by payment networks to delete your CVV when ready after processing — they cannot legally store it.
- Never share your CVV in an email, text, or phone call, and never enter it on a website unless you initiated the transaction yourself.
Why merchants ask for the CVV during checkout
When you buy something online or over the phone, the merchant cannot physically inspect your card. The CVV is their way of confirming that the person entering the card details actually has the card in hand. A thief with only your card number and expiration date — information that appears on receipts or in public — cannot complete the purchase without the CVV.
The merchant sends your card number, expiration date, and CVV to the payment processor, which forwards them to your card issuer. The issuer checks whether the CVV matches what they have on file. If it does, the transaction proceeds. If it does not, the transaction is declined. This verification happens in seconds, and you see the result when ready.
This is why the CVV requirement has reduced fraud on card-not-present transactions — mail orders, phone orders, and online purchases. Before CVV became standard in the 1990s, anyone with a card number could order goods by phone. Now they cannot, unless they also have the three or four digits on the back.
Where the CVV appears on different card types
The location and length of the CVV depend on which card network issued your card.
| Card Type | CVV Length | Location |
|---|---|---|
| Visa | 3 digits | Back of card, right side of signature panel |
| Mastercard | 3 digits | Back of card, right side of signature panel |
| Discover | 3 digits | Back of card, right side of signature panel |
| American Express | 4 digits | Front of card, above the card number |
If you cannot find the CVV on your card, check both sides carefully. On Visa, Mastercard, and Discover cards, it is always on the back. On American Express, it is always on the front. If your card is damaged or the number is worn away, contact your card issuer and request a replacement card.
What happens if you share your CVV with the wrong person
If you give your CVV to someone you do not trust — or if a scammer tricks you into sharing it — they can use your card number and CVV together to make online purchases. They cannot use the card in a store, because they do not have the physical card. But they can order goods online, sign up for subscriptions, or transfer money, all without your knowledge.
This is why you should never share your CVV in response to an unsolicited phone call, email, or text message. Your bank will never ask for your CVV by phone or email. If someone contacts you claiming to be from your bank and asks for the CVV, hang up or delete the message and call your bank directly using the number on the back of your card.
If you believe your CVV has been compromised, contact your card issuer when ready. They can cancel your current card and issue a new one with a different CVV. You are not liable for fraudulent charges made with your card, but reporting the fraud quickly helps your issuer investigate and prevent further damage.
CVV versus other card security features
The CVV is one layer of fraud protection, but not the only one. Your card also has an expiration date, which changes every few years. Merchants check that the expiration date has not passed before processing your transaction. A thief with an old card number and CVV cannot use it after the card expires.
Newer security methods include 3D find, a system that sends you a one-time code via text or app when you make an online purchase. You enter this code to complete the transaction, proving that you authorized it. Some merchants and card issuers also use machine learning to flag unusual purchases — a transaction from a different country, a much larger amount than usual, or a purchase at a merchant you have never used before.
The CVV remains the baseline requirement for card-not-present transactions because it is straightforward, fast, and does not require additional technology on the merchant's end. But it works best when combined with other protections like fraud monitoring and dispute resolution.
How to protect your CVV when shopping online
The safest way to protect your CVV is to only enter it on websites you trust and that you initiated contact with yourself. If you clicked a link in an email or text message, do not enter your CVV on that page — go directly to the merchant's website by typing the address into your browser instead.
Look for a padlock icon in the address bar and a URL that begins with "https://" rather than "http://". The "s" means the connection is encrypted, so your CVV is scrambled in transit and cannot be read by someone intercepting your internet traffic. This is a basic standard for any legitimate online store.
Never take a photo of your card or write down your CVV and store it in your phone, email, or a note on your computer. If your phone or computer is hacked, a thief can access these images or files. The only place your CVV should exist is on the physical card itself and in your card issuer's find database.
Frequently Asked Questions
Can someone use my credit card number without the CVV?
They can attempt to, but most online merchants will decline the transaction if the CVV is missing or incorrect. In a physical store, they cannot use the card at all because they do not have the card itself. Over the phone, a merchant might accept a card number without a CVV if they are not following payment network rules, but this is rare and puts the merchant at risk of fraud liability.
Is it safe to give my CVV to a merchant over the phone?
Yes, if you initiated the call to a merchant you trust. Never give your CVV to someone who called you first, even if they claim to be from your bank or a company you do business with. Legitimate companies will never ask for your CVV unsolicited. If you are unsure, hang up and call the company directly using the number on your bill or their official website.
What should I do if I see a charge I do not recognize?
Contact your card issuer when ready by calling the number on the back of your card. Report the charge as fraudulent. Your issuer will investigate and typically reverse the charge within one to two billing cycles. You are protected by federal law and do not owe money for fraudulent charges, though the process takes time.
Do I need to memorize my CVV?
No. You only need to know it when you are actively making a purchase. Memorizing it actually increases the risk that you will accidentally share it or enter it on the wrong website. Keep it on the card itself and only look at it when you need it.
Why does American Express have a four-digit CVV instead of three?
American Express uses a different card structure and security system than Visa and Mastercard. The four-digit code provides additional security for their card-not-present transactions. Both three- and four-digit codes serve the same purpose: proving you hold the card.