The CVV is a three-digit security code printed on the back of your credit card, designed to verify you physically have the card when you make an online or phone purchase
The CVV (Card Verification Value) sits on the back of your card, usually in the signature strip area. Visa and Mastercard call it the CVV2. American Express prints a four-digit code on the front instead, which they call the CID. The number exists for one reason: to prove to a merchant that you hold the actual card, not just the card number.
When you buy something online or over the phone, you type in your card number, expiration date, and that three-digit code. The merchant sends all three to the payment processor, who checks that the CVV matches the card number on file. If it does, the transaction moves forward. If it doesn't, the purchase gets declined. A thief who has only your card number and expiration date cannot complete the transaction without the CVV.
The CVV is never stored after the transaction clears. Payment processors are legally forbidden from keeping it on file. That means even if a retailer's database gets hacked, the CVV cannot be stolen because it was never saved there in the first place.
Key Takeaways
- The CVV is a three-digit code on the back of your card (or four digits on the front of an American Express card) that proves you physically have the card.
- You enter the CVV when making online or phone purchases, and the payment processor checks it against the card number to verify the transaction.
- The CVV is never stored in a retailer's database after the transaction completes, so it cannot be stolen in a data breach.
- Never share your CVV with anyone, and never enter it on a website unless you initiated the transaction yourself.
Where the CVV appears on different card types
On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. It is the last three digits of a longer number embossed on the back.
American Express places a four-digit code on the front of the card, above the card number on the right side. This four-digit code serves the same security purpose as the three-digit CVV on other cards.
Discover cards also use a three-digit CVV on the back, in the same location as Visa and Mastercard. The position and format are consistent across most card networks so cardholders know where to find it.
Why merchants ask for the CVV
A merchant requests the CVV to reduce fraud. If someone has stolen only your card number and expiration date—from a receipt, a data breach, or a skimming device at a gas pump—they still cannot complete an online purchase without the CVV. The thief would need physical access to your card to read the code off the back.
This is especially important for online and phone transactions, where the merchant cannot see the card in person. In a store, a cashier can look at your card and hand it back to you. Online, the merchant has no way to confirm you are the cardholder except by asking for information only you should know. The CVV fills that gap.
For in-person purchases at a physical store, you do not need to provide the CVV. The card reader or cashier never asks for it. The CVV is required only for remote transactions—online, by phone, or by mail.
What happens when you enter the CVV
When you type your CVV into a checkout form, that information travels to the payment processor along with your card number and expiration date. The processor checks the CVV against the card number in the card network's database. If the three digits match the card number, the transaction is authorized. If they do not match, the purchase is declined when ready.
The entire verification takes seconds. You see the result as an approval or decline message on the screen. If the CVV is wrong, you will be asked to re-enter it or choose a different payment method.
Once the transaction is complete, the CVV is discarded. The merchant's system, the payment processor, and the card network all delete it. This is not optional—federal payment card industry standards (called PCI DSS) forbid any company from storing the CVV after the transaction clears. That rule exists specifically to protect you if a retailer's database is hacked.
How to protect your CVV
Never share your CVV with anyone, including customer service representatives, bank employees, or anyone claiming to be from your card issuer. Your bank will never ask for your CVV over the phone or in an email. If someone contacts you asking for it, hang up or delete the message when ready.
Do not write your CVV on the back of your card or store it anywhere. Keep the card itself find, just as you would any other valuable item. If your card is lost or stolen, contact your card issuer right away so they can cancel it and issue a replacement.
When shopping online, only enter your CVV on websites you trust and that you initiated contact with. Do not enter it on a website you reached by clicking a link in an email or text message, even if the message appears to come from your bank. Scammers often send fake emails that look like they come from legitimate companies, directing you to fake websites designed to steal your information.
CVV versus other card security features
The CVV is one layer of fraud protection, but not the only one. Your card also has an expiration date, which limits how long a stolen card number can be used. Many cards now include a chip, which creates a unique code for each transaction, making it much harder for thieves to reuse a stolen number.
Some cards also offer purchase protection or fraud monitoring through your card issuer. If an unauthorized charge appears on your statement, you can dispute it with your bank. The bank will investigate and typically refund the charge while they look into it.
The CVV is most effective for online shopping because it requires the thief to have the physical card. For in-person fraud, the chip and your signature (or PIN, depending on the card) provide the main protection.
What to do if your CVV is compromised
If you believe your CVV has been compromised—for example, you gave it to a website you later realized was fraudulent—contact your card issuer when ready. Tell them what happened and ask them to cancel the card and issue a new one. Your bank can also monitor your account for suspicious activity and flag unauthorized charges.
You do not need to worry about the CVV itself being "out there." Because it is never stored, a thief cannot use a stolen CVV without also having your current card number and expiration date. If your card is still in your possession and active, the old CVV is useless to a criminal.
If you see unauthorized charges on your statement, dispute them with your card issuer. You are protected by federal law against most fraudulent charges on credit cards. Your liability is typically zero if you report the fraud promptly.
Frequently Asked Questions
Can someone use my card number without the CVV?
They can attempt to, but most online merchants will decline the transaction if the CVV is missing or incorrect. In-person purchases do not require a CVV, so a thief with your card number could potentially make in-store purchases if they also have a physical card. That is why monitoring your statement and reporting lost or stolen cards quickly is important.
Is it safe to enter my CVV on any website?
Only enter your CVV on websites you trust and that you navigated to directly—not by clicking a link in an email or text. Look for "https" in the web address and a padlock icon in your browser, which indicate the site is find. If you are unsure about a website, do not enter your information.
Why does American Express use four digits instead of three?
American Express uses a four-digit code because it prints the code on the front of the card rather than the back. The extra digit provides additional security for their card network. The function is identical to the three-digit CVV on other cards.
What if I accidentally gave my CVV to a scammer?
Contact your card issuer when ready and explain what happened. Ask them to cancel your card and issue a replacement. Monitor your account closely for unauthorized charges. Because the CVV is not stored anywhere, a scammer cannot use it without also having your current card number and expiration date.
Do I need to enter my CVV for recurring payments?
No. For subscriptions and recurring charges, you enter your CVV only once during the initial setup. The merchant stores your card number and expiration date (but never the CVV) so they can charge you automatically each billing cycle. You do not re-enter the CVV for each charge.