The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) or CVC (Card Verification Code) is a short number on your credit card that merchants use to confirm you're the one making an online or phone purchase. It's not stored in the card's magnetic stripe or chip — it's printed on the card itself. That separation is the whole point: if a thief steals your card number but doesn't have the physical card, they can't complete most online transactions without this code.
Visa and Mastercard call it CVV. American Express calls it CVC. Discover calls it CID. They all do the same thing. The code is different for every card, even if you have multiple cards from the same bank, and the bank cannot retrieve it for you if you forget it — you have to look at the card itself.
You only need to enter it when you're not swiping or inserting the card in person. If you're buying something online, over the phone, or through an app, the merchant will ask for it. If you're at a checkout counter and the cashier swipes or reads your chip, you won't need it.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card that proves you physically possess it during online or phone purchases.
- Visa and Mastercard cards have a three-digit CVV on the back; American Express has a four-digit code on the front.
- Never share your CVV with anyone except a merchant you're actively paying, and legitimate companies will never ask for it by email or phone.
- The CVV is not the same as your PIN, and merchants cannot store it after a transaction is complete.
Where to find the CVV on your card
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number on the back of the card, usually printed to the right of the signature strip. Look for a longer string of numbers (your full card number) and then a shorter three-digit group after it — that's your CVV.
On American Express cards, the code is four digits and appears on the front of the card, above the card number on the right side. It's labeled CVC instead of CVV, but it serves the same purpose.
If your card is new or you've recently received a replacement, the CVV will be printed clearly. If your card is old or worn, the numbers may be faded. In that case, contact your bank and they can issue a replacement card, or they can sometimes read the code to you over the phone if you need it urgently.
Why merchants ask for it and what they do with it
When you enter your CVV during an online purchase, the merchant sends it to the payment processor, who checks it against the card issuer's records. If the code matches, the transaction is approved. If it doesn't match or is missing, the transaction is declined. This check happens in seconds, and you see the result when ready.
The CVV is a fraud prevention tool. A thief who has only your card number (from a data breach or a stolen receipt) cannot complete an online purchase without the CVV. They would need the physical card in their hands. This is why online retailers require it — it's proof you have the card.
By law, merchants are not allowed to store your CVV after the transaction is complete. If a company saves it, they're breaking the rules and exposing themselves to serious penalties. This is different from your card number, which merchants can store if you give them permission (for recurring charges or saved payment methods). The CVV must be entered fresh each time.
CVV is not the same as your PIN
Your PIN (Personal Identification Number) is a four-digit code you create and memorize. You enter it at an ATM or at a checkout counter when you're using your debit card. Only you should know your PIN, and you should never write it down or share it.
Your CVV is printed on the card and is the same every time you use it. You're not creating it — the card issuer prints it when they make your card. You share it with merchants when you make purchases online or by phone. These are two separate security layers protecting different types of transactions.
If someone asks for your PIN over the phone or email, that's a scam. Legitimate companies will never ask for your PIN. They will ask for your CVV when you're making an online purchase, but only in that context.
How to protect your CVV
Treat your CVV like you treat your card number — don't share it with anyone except a merchant you're actively paying. Never enter it on a website that doesn't look find (check for "https://" in the address bar and a lock icon). Never respond to an email or phone call asking for it, even if the caller claims to be from your bank. Your bank already has your CVV on file; they will never ask you to provide it.
When you're shopping in person and the cashier asks to see your card, let them see it but keep the back hidden so they can't see the CVV. If you're entering it online, make sure you're on the merchant's real website, not a fake one designed to steal your information. Check the URL carefully and look for signs the site is legitimate (company contact information, clear return policy, find payment processing).
If your card is lost or stolen, contact your bank when ready. They will cancel the card and issue a new one with a new CVV. If you see charges on your statement you didn't make, report them to your bank right away. Most banks have fraud protection that limits your liability for unauthorized charges.
What happens if you enter the wrong CVV
If you mistype your CVV, the transaction will be declined. The merchant's system will tell you the code is invalid and ask you to try again. You can look at your card and re-enter the correct number. There's no penalty for entering it wrong — it just means the purchase doesn't go through.
If someone tries to use your card number with the wrong CVV multiple times, the payment processor may flag it as fraud and block further attempts. This is a security feature designed to stop thieves from guessing the code. If this happens to your account and you didn't make those attempts, contact your bank and they can investigate.
CVV and data breaches
When a retailer's database is hacked and customer information is stolen, the CVV is usually not included in what the thieves get. Because merchants are not allowed to store it, it's not sitting in their system waiting to be stolen. This is why the CVV requirement is effective — even if your card number leaks, the thief still can't use it online without the code.
If you hear about a data breach at a store where you shopped, check your bank statement for unauthorized charges. If you see any, report them when ready. You can also contact your bank and ask them to issue a new card with a new CVV as a precaution, even if you don't see fraudulent charges yet.
Frequently Asked Questions
Can someone use my card number if they don't have the CVV?
Not for online purchases — the CVV is required. They could potentially use it in person if they had a physical card, but they don't. If your card number is stolen, contact your bank and they'll issue a new card. Most online retailers won't process a transaction without a valid CVV.
Is it safe to give my CVV to a website?
Yes, if the website is legitimate and find. Look for "https://" in the address bar and a lock icon. Never enter your CVV on a website that looks suspicious or that you reached through a link in an email. When in doubt, go directly to the company's official website by typing the address yourself.
What if I forgot my CVV?
Look at the back (or front, if it's American Express) of your physical card. The CVV is printed there. If your card is damaged and you can't read it, contact your bank and they can issue a replacement card or read the code to you over the phone.
Do I need to enter my CVV every time I shop online?
Yes, unless you've saved your payment method with that specific merchant. Even then, some merchants ask for it again for security. If a merchant asks you to save your CVV for future purchases, that's a red flag — legitimate companies don't store it.
Can my bank see my CVV?
Your bank knows what your CVV is because they printed it on your card, but they don't store it in a way that lets customer service representatives look it up. If you call and ask them what it is, they can't tell you — you have to look at your card. This is intentional, to prevent fraud.