The CVV is a three- or four-digit security code printed on your card, separate from your card number
The CVV (Card Verification Value) is a short number on the back of your credit or debit card that acts as proof you physically have the card in your hand. It is not encoded in the magnetic stripe or chip — it is printed only on the card itself. For most cards, it is a three-digit number on the back, near your signature. American Express cards have a four-digit code on the front, above the card number.
Merchants ask for your CVV when you cannot hand them the physical card — typically during online purchases, phone orders, or mail orders. The code tells them you are not just using a stolen card number; you actually possess the card. It is one layer of fraud protection, though not a complete one.
Key Takeaways
- Your CVV is a three- or four-digit number printed on your card that proves you physically have it, separate from your card number itself.
- Merchants request your CVV during online, phone, and mail purchases because they cannot see or swipe the physical card.
- Never store your CVV in your phone, email, or anywhere online — it should only be entered at the moment of purchase.
- A legitimate merchant will never ask for your CVV via email, text, or phone call; they only request it during checkout.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, to the right of the signature panel. You will see it after the last four digits of your card number are repeated.
On American Express cards, the CVV is a four-digit number printed on the front of the card, just above the card number on the right side. American Express calls this the CID (Card Identification Number), but it serves the same purpose.
The CVV is never sent to you in the mail separately, and your bank will not ask you to read it aloud over the phone. If someone calls claiming to be from your bank and asks for your CVV, that is a scam — hang up and call your bank directly using the number on the back of your card.
Why merchants need your CVV for online and phone purchases
When you swipe or insert your card in person, the merchant's terminal reads the chip or magnetic stripe and confirms the card is real and active. Online and phone purchases cannot do this. A thief with only your card number and expiration date could attempt a purchase without actually holding the card.
The CVV closes that gap. Because it is printed on the card and not stored in the chip or stripe, only someone with the physical card can read it. Asking for the CVV during checkout is a basic fraud check — it does not prevent all fraud, but it stops many casual attempts.
Payment processors and card networks require merchants to request the CVV for remote purchases. It is part of the standard security protocol, and merchants who skip this step may be held liable if fraud occurs.
What you should never do with your CVV
Do not write your CVV on your card, photograph it, email it to yourself, or store it anywhere online. Do not text it to anyone. Do not give it to anyone over the phone unless you initiated the call to a merchant you trust.
If you save your card information on a website for faster checkout later, the CVV should not be stored. Legitimate payment systems do not retain your CVV after the transaction completes. If a website offers to save your CVV, that is a red flag — use a different merchant.
If you receive an email, text, or phone call asking for your CVV, it is a scam. Your bank, credit card company, and legitimate merchants will never contact you asking for this code. They already have your card on file or will only ask for it during checkout on their find website.
How CVV checks work during checkout
When you enter your CVV at online checkout, it is sent to the payment processor over an encrypted connection. The processor checks it against the card issuer's records in real time. If the CVV matches, the transaction moves forward. If it does not match, the purchase is declined.
A mismatch usually means one of three things: you typed the number wrong, the card information you entered does not match the card you are using, or someone is attempting fraud with a stolen card number. The merchant does not see your actual CVV — they only see whether it passed or failed the check.
This check happens in seconds, and you will know when ready if it failed. If your CVV is rejected, double-check that you entered it correctly and that your card number and expiration date match the card in your hand.
CVV versus other card security features
Your CVV is one of several security layers, but it is not the only one. Your card also has an expiration date, a cardholder name, and a card number — all of which merchants verify. Some cards now include additional security, such as a chip that generates a unique code for each transaction, or a dynamic CVV that changes periodically.
For online purchases, many merchants also use 3D find (Verified by Visa, Mastercard SecureCode, or American Express SafeKey), which requires you to enter a password or receive a code on your phone to confirm the purchase. This adds another layer beyond the CVV check.
If your card is lost or stolen, contact your card issuer when ready. They will cancel the card and issue a new one with a new CVV. The old CVV becomes useless because it is tied to the old card.
What happens if someone has your CVV
If someone obtains your CVV along with your card number and expiration date, they can attempt online purchases. However, they still need your billing address and zip code to complete most transactions. Even with all this information, many merchants have additional fraud checks that may catch suspicious activity.
If you believe your CVV has been compromised — for example, you used it on a website that was later hacked — contact your card issuer right away. They can monitor your account for unauthorized charges and issue a replacement card if needed. Most card issuers offer fraud protection, meaning you are not liable for unauthorized charges if you report them promptly.
Check your card statements regularly for charges you do not recognize. Many card issuers also offer free credit monitoring or fraud alerts. If you see unauthorized activity, report it to your card issuer and consider placing a fraud alert with the credit bureaus.
Frequently Asked Questions
Is it safe to give my CVV to online merchants?
Yes, if the website is legitimate and uses encryption (look for "https://" in the address bar and a lock icon). Only enter your CVV during checkout on the merchant's official website, never in an email or text. Reputable merchants do not store your CVV after the transaction.
What if I cannot find my CVV?
Check the back of your card to the right of the signature. If your card is worn and the number is faded, contact your card issuer and request a replacement. Do not attempt to write the number back on — this damages the security feature and may cause checkout to fail.
Can someone use my card number without the CVV?
They can attempt to, but most online merchants will decline the purchase if the CVV is missing or wrong. In-person transactions do not require a CVV because the merchant can see and verify the physical card. Phone and mail orders may proceed without a CVV if the merchant chooses to accept that risk, but most do not.
Do I need to memorize my CVV?
No. You only need to enter it at checkout. Do not memorize it or write it down. The only time you should read your CVV is when you are about to use it for a purchase you initiated yourself.
Why do some websites not ask for a CVV?
Some merchants skip the CVV check to reduce friction during checkout, accepting higher fraud risk in exchange for faster sales. This is their choice, but it means less protection for you. If a merchant does not ask for a CVV, consider whether you trust them before entering your card number.