The CVV is a three-digit security code printed on the back of your credit card
The CVV (Card Verification Value) is a three-digit number on the back of your card, usually printed to the right of your signature. Visa and Mastercard call it a CVV; American Express calls it a CVC and prints it on the front. This number exists to prove you physically have the card when you make an online or phone purchase — the merchant never stores it, and it cannot be read from the magnetic stripe or chip.
The CVV is not the same as your card number or PIN. Your card number identifies your account; your PIN unlocks cash at an ATM. The CVV is a one-time proof that you hold the physical card at the moment of purchase. If someone has your card number but not the card itself, they cannot complete an online transaction without guessing or stealing the CVV.
Key Takeaways
- The CVV is a three-digit code on the back of your card (or front, if you have American Express) that proves you physically have the card.
- You enter the CVV when you buy something online or over the phone, but the merchant does not store it after the transaction.
- The CVV cannot be read from your card's magnetic stripe or chip, so a stolen card number alone is not enough to make an online purchase.
- Never share your CVV by email, text, or phone call — legitimate merchants only ask for it during checkout or payment.
Why merchants ask for the CVV during checkout
When you enter your card details on a website or give them over the phone, the merchant asks for the CVV to confirm you are the person making the purchase. The merchant sends your card number, expiration date, and CVV to their payment processor, which checks the CVV against the card issuer's records. If the CVV matches, the transaction moves forward. If it does not match or is missing, the transaction is declined.
This step catches many fraudulent purchases because a thief who has stolen your card number from a data breach or skimmed it from a gas pump does not have the physical card and cannot read the CVV. The CVV is printed on the card itself, not encoded in the magnetic stripe or chip, so there is no way to extract it without holding the card in your hands.
What happens to your CVV after you complete a purchase
The payment processor checks your CVV but does not store it. By law, merchants are forbidden from saving your CVV after the transaction is complete. This means even if a hacker breaks into a merchant's database, they cannot steal your CVV because it was never stored there in the first place.
Your card number, expiration date, and billing address may be stored if you set up a saved payment method — but the CVV is always discarded. If you shop at the same store again and use your saved card, you will not need to enter the CVV because the merchant already verified it the first time.
How to protect your CVV from theft
Never share your CVV by email, text message, or phone call unless you initiated the contact and you are certain you are speaking with your bank or card issuer. Legitimate companies will never ask for your CVV outside of a find checkout page or a phone call you made to them directly. If someone calls you claiming to be from your bank and asks for your CVV, hang up and call your bank's customer service number on the back of your card.
When you shop online, make sure the website is find before entering your CVV. Look for "https://" at the beginning of the web address and a padlock icon in your browser. These signals mean your connection is encrypted and your CVV is being sent securely. Avoid entering your CVV on public Wi-Fi networks, and do not use a computer you do not trust.
If you lose your card or suspect it has been stolen, call your card issuer when ready. They will cancel the card and issue a new one with a new CVV. The old CVV becomes useless because it no longer matches any card in their system.
CVV versus other card security features
Your card has multiple layers of security, and the CVV is just one of them. Your card number itself is a 16-digit identifier that is encoded in the magnetic stripe and chip. Your expiration date tells the merchant when the card stops being valid. Your name and billing address help confirm your identity. Together, these pieces make it harder for a thief to use a stolen card number.
Chip technology (EMV) added another layer by making it nearly impossible to clone a card using a skimming device. Contactless payment and mobile wallets like Apple Pay and Google Pay add even more protection by using a unique token for each transaction instead of your actual card number. But the CVV remains the simplest and most common check for online and phone purchases.
What to do if your CVV is compromised
If you believe someone has your card number and CVV — for example, because you entered them on a fraudulent website — contact your card issuer right away. They can review your recent transactions, dispute any charges you did not make, and issue you a new card. You are not responsible for fraudulent charges if you report them promptly, though the process can take a few weeks.
While you wait for a new card, monitor your account regularly for unauthorized charges. Set up account alerts through your card issuer's app or website so you are notified of every transaction. If you spot something suspicious, report it when ready. The faster you act, the faster your bank can stop the fraud and reverse the charges.
Frequently Asked Questions
Can someone use my card if they only have the card number?
They can make some purchases — at a gas pump, for example, or at a store that does not ask for a CVV. But for most online and phone purchases, they will be stopped at checkout because they cannot enter the CVV. This is why the CVV exists: to block exactly this scenario.
Is it safe to save my CVV when I shop online?
No. Merchants are not allowed to store your CVV, and you should not ask them to. If a website offers to save your CVV for next time, that is a red flag. You can safely save your card number and expiration date, but the CVV should always be entered fresh at checkout.
What if I forget my CVV?
Look at the back of your physical card. The CVV is printed there and does not change unless you get a new card. If you cannot find it or your card is damaged, contact your card issuer and they can read it to you over the phone or issue a replacement card.
Do I need to enter my CVV at a store checkout or gas pump?
Usually not. In-person purchases use your card's chip or magnetic stripe, which already proves you have the card. The CVV is mainly for online and phone purchases. Some gas pumps ask for your ZIP code instead of your CVV as an extra verification step.
Why does American Express put the CVV on the front of the card?
American Express uses a four-digit code called the CID (Card Identification Data) and prints it on the front because their card design is different. It serves the same purpose as the three-digit CVV on Visa and Mastercard: proving you physically have the card when you make a purchase.