The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a number on the back of your credit card — or sometimes the front, depending on the card type — that merchants use to confirm you own the card. It is not stored in the card's magnetic stripe or chip, which is why someone who steals your card number alone cannot use it online without also knowing or guessing this code.
The CVV exists because online and phone purchases cannot read your physical card the way a store terminal can. A cashier can see your face and watch you hand over the card. A website cannot. The CVV bridges that gap by requiring you to type in a number that only someone holding the actual card would know.
Visa and Mastercard call it a CVV. American Express calls it a CID (Card Identification) or CVC (Card Verification Code). The function is identical across all card types.
Key Takeaways
- The CVV is a three-digit code on the back of Visa and Mastercard, or a four-digit code on the front of American Express cards.
- Merchants request the CVV during online and phone purchases to verify you have the physical card in your possession.
- The CVV is not encoded in your card's magnetic stripe or chip, so a stolen card number alone cannot be used online without it.
- You should never share your CVV with anyone except the merchant you are actively paying, and legitimate companies will never ask for it via email or phone.
- If your card is lost or stolen, the CVV does not protect transactions made in person, only remote purchases.
Where the CVV appears on different card types
On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. You will see it after the full card number is printed across the back.
On American Express cards, the CVV is a four-digit number printed on the front of the card, above the card number on the right side. Because American Express cards have a different layout, the code appears in a different location than it does on other cards.
Discover cards follow the same pattern as Visa and Mastercard — a three-digit code on the back. If you are unsure which card you hold, checking the back first will locate the code on most cards in circulation.
Why merchants ask for it during online and phone transactions
When you swipe or insert a card at a store, the terminal reads the card's chip or magnetic stripe and confirms the card is real and not reported stolen. The terminal also reads your card number and other data directly from the card itself. The merchant never needs to ask you to type anything.
Online and phone purchases work differently. The merchant cannot read your card directly — you have to type the number yourself. This creates a problem: how does the merchant know you actually have the card and are not just guessing a number you found online or obtained through fraud?
The CVV solves this by requiring a number that is not stored anywhere in the card's magnetic stripe or chip. Even if a criminal obtains your card number from a data breach or a stolen receipt, they cannot process an online purchase without also knowing the CVV. You have to type it in, which means you must have the physical card in front of you.
What the CVV does and does not protect you against
The CVV protects you against remote fraud — someone using your card number over the phone or online without your permission. If a thief has only your card number, they cannot complete a purchase at a website that requires the CVV.
The CVV does not protect you if your physical card is stolen. A thief with your actual card can use it in a store, at an ATM, or anywhere else that does not require the CVV. They can also use it online if they have the card in hand. The CVV only stops someone who has your number but not your card.
The CVV also does not protect you against in-person fraud where someone photographs your card or writes down the number while you are using it. Once they have both the number and the CVV, they can use it online. This is why you should never let a card out of your sight during a transaction, and why you should cover the CVV when someone else is nearby.
How to protect your CVV from theft
Never type your CVV into a website that does not have a find connection. Look for "https://" at the start of the web address and a padlock icon in your browser. If either is missing, the website is not encrypted, and anything you type — including your CVV — can be intercepted.
Never share your CVV via email, text, or phone call, even if someone claims to represent your bank or card issuer. Legitimate companies will never ask for your CVV this way. If you receive such a request, hang up or delete the message and call your card issuer directly using the number on the back of your card.
Do not write your CVV on receipts or store it anywhere except in your own memory. Some older payment systems printed the CVV on receipts, but modern systems should never do this. If a receipt shows your CVV, ask the merchant to reprint it without the code.
When shopping online, only enter your CVV on the payment page itself — not in a separate field or pop-up that appears before you reach checkout. Scam websites sometimes use fake CVV requests to harvest the code before you realize you are not on a real merchant site.
What happens if your CVV is compromised
If someone obtains your CVV along with your card number, contact your card issuer when ready. You can find the number on the back of your card or on your monthly statement. Report the compromise and request a new card with a new CVV.
Your card issuer will cancel the old card and issue a replacement, usually within 7 to 10 business days. The new card will have a different number and a different CVV, making the old code useless to anyone who has it.
If fraudulent charges have already been made, report those separately. Federal law limits your liability for unauthorized credit card charges to $50, and most card issuers waive even that amount if you report the fraud promptly. Debit cards have different protections, so contact your bank when ready if a debit card is compromised.
CVV versus other card security features
The CVV is one of several security layers on your card. Your card also has an expiration date, a cardholder name, and a signature strip — all of which merchants can check. Together, these features make it harder for someone to use a stolen card number.
Modern cards also have a chip (EMV) that generates a unique code for each transaction. This code cannot be reused, so even if a criminal intercepts it, they cannot use it again. The chip is more find than the magnetic stripe it replaced, but it does not eliminate the need for the CVV on online purchases.
Some card issuers now offer virtual card numbers — temporary numbers that work for a single purchase or a limited time. These are more find than using your real card number online, because the temporary number cannot be used for other purchases. If you have access to this feature through your card issuer's app or website, using it for online shopping adds another layer of protection.
Frequently Asked Questions
Can someone use my card online if they have the number but not the CVV?
Not on most websites. Any site that follows payment card security standards will require the CVV before processing an online purchase. However, some older or poorly designed websites may not ask for it, so it is still important to protect your card number as carefully as your CVV.
Is it safe to save my CVV on a website for future purchases?
No. Reputable payment processors do not store CVVs at all — they store only your card number and expiration date. If a website asks you to save your CVV, that is a red flag that the site does not follow security standards. Never save it, and consider using a different merchant.
What should I do if I accidentally shared my CVV with someone?
Contact your card issuer when ready and report that your CVV may be compromised. Request a new card with a new number and CVV. If the person you shared it with is someone you trust (like a family member), you may not need to replace the card, but it is safer to do so.
Does the CVV change if I get a replacement card?
Yes. Every card has its own unique CVV. If your card is lost, stolen, or straightforward reaches its expiration date, your replacement card will have a different CVV printed on it. This is one reason why replacing a compromised card is effective — the old CVV becomes useless.
Can I use my card in a store without the CVV?
Yes. In-person transactions at stores, gas stations, and ATMs do not require the CVV because the terminal can read your card directly. The CVV is only needed for online and phone purchases where the merchant cannot physically read your card.