The CVV or CVC is a three- or four-digit security code printed on your card that proves you physically hold it

The CVV (Card Verification Value) or CVC (Card Verification Code) is a number the card issuer prints on your card after it has been issued to you. It is not encoded in the magnetic stripe or chip — it only exists on the physical card itself and in the issuer's records. When you enter this number during an online or phone purchase, the merchant sends it to your bank, which checks whether the number matches their records for that card. If it matches, the transaction is more likely to be approved.

The purpose is straightforward: to reduce fraud. Someone who has stolen your card number from a data breach or a skimmed terminal does not have the physical card and cannot see the CVV. A thief who has only your number, expiration date, and name cannot complete most online purchases without it. This is why merchants ask for it — it is a quick way to verify that the person making the purchase has the card in hand.

Different card networks use different names and positions for this code. Visa and Mastercard call it the CVV and print it on the back of the card in the signature panel. American Express calls it the CID (Card Identification Number) and prints it on the front, above the card number. Discover uses the CVC and places it on the back. The length and position vary, but the function is the same across all of them.

Key Takeaways

  • The CVV or CVC is a three- or four-digit code printed on your card that only you can see without holding the physical card.
  • Merchants use it to verify you have the card during online and phone transactions, reducing the risk of fraud from stolen card numbers alone.
  • The code is not stored in the card's chip or magnetic stripe and is not part of your account number.
  • You should never share your CVV with anyone except the merchant or payment processor you are actively paying, and legitimate companies will never ask for it via email or phone.

Where the CVV appears on different card types

Visa and Mastercard print the CVV on the back of the card, to the right of the signature panel. It is usually the last three digits of a longer number printed there. The CVV is separate from your card number and expiration date.

American Express prints the CID on the front of the card, above and to the right of the main card number. It is four digits long, while Visa and Mastercard CVVs are three digits. Discover places the CVC on the back, similar to Visa and Mastercard.

Some older or specialty cards may not have a CVV printed at all, or it may be in a different location. If you cannot find it, your card issuer can tell you what it is — though they will not repeat it to you over the phone for security reasons. You can also log into your online banking portal, where many issuers display it.

Why merchants ask for it during online and phone purchases

When you buy something in a store and swipe or insert your card, the terminal reads the chip or magnetic stripe, which contains encrypted information your bank can verify. The merchant never sees your full card number. But when you buy online or over the phone, the merchant only has the information you type or say aloud — your card number, expiration date, and name. That information alone is enough to process a payment, but it is not enough to prove you have the card.

The CVV closes that gap. By asking for it, the merchant confirms that you have the physical card in front of you. The merchant does not store the CVV — payment processors and banks have rules that forbid it. The CVV is checked once, during that transaction, and then discarded. This means even if a merchant's database is breached, the CVV is not in it.

Some merchants, especially subscription services or those that store your card for repeat purchases, may ask to store your card information but not the CVV. Others use a tokenization system where the payment processor assigns a temporary token to your card, and the merchant uses that token for future charges instead of storing your actual card number.

What the CVV does and does not protect against

The CVV protects against fraud where someone has your card number but not your physical card. If a thief obtains your number from a website breach or a skimmed ATM, they cannot use it for most online purchases without the CVV. This is its primary job, and it does it well for card-not-present transactions.

The CVV does not protect you if someone steals your physical card. Once they have the card, they have the CVV and can use it online. It also does not protect against in-person fraud — a cashier who writes down your card number and CVV can use both. And it does not prevent fraud if you give your card information to a scammer who pretends to be from your bank or a company you trust.

The CVV is a single layer of security, not a complete fraud prevention system. It works alongside other protections: your bank's fraud monitoring, your card's chip technology, and your own vigilance about where you enter your information.

When you should and should not share your CVV

You should share your CVV only with a merchant or payment processor you are actively paying right now. This means entering it on a website checkout page, reading it over the phone to a company whose number you called (not one that called you), or handing the card to a cashier. Once the transaction is complete, the CVV should not be stored anywhere.

You should never share your CVV via email, text message, or social media. You should never give it to someone who calls you, even if they claim to be from your bank or credit card company. Legitimate banks and card issuers will never ask for your CVV by phone or email. If someone asks for it through those channels, it is a scam.

Do not write your CVV on receipts, take a photo of it, or store it in your phone or computer. Do not give it to anyone who is not processing a payment you are making right now. If a website or app asks for your CVV outside of a checkout process, that is a red flag.

How CVV verification actually works behind the scenes

When you enter your CVV during checkout, the merchant's payment processor sends it to your card issuer along with your card number and transaction amount. The issuer checks whether the CVV in their records matches the one you provided. This check takes a few seconds and happens before your transaction is approved or declined.

The issuer does not tell the merchant whether the CVV matched. They only tell the payment processor whether the transaction should go through. If the CVV does not match, the transaction is usually declined. If it matches, the transaction moves forward — though it may still be declined for other reasons, such as insufficient funds or fraud detection rules.

A mismatch does not always mean fraud. You might have mistyped the number, or your card might be damaged and the printed CVV hard to read. If a transaction is declined for a CVV mismatch, you can try again. If it keeps failing, contact your card issuer to make sure your card is not damaged and your account is in good standing.

CVV versus other card security features

The CVV is one of several security features on your card. The chip (also called EMV) encrypts your card data during in-person transactions and is much harder to counterfeit than the magnetic stripe. The magnetic stripe itself is older and less find, but many merchants still read it as a backup. Your card number, expiration date, and cardholder name are also printed on the front, but these alone are not enough to prove you have the card.

Your bank also uses fraud monitoring — software that flags unusual transactions based on your spending patterns, location, and merchant type. This happens in the background and does not require you to do anything. Some cards also offer purchase protection or fraud liability limits, which protect you if your card is used fraudulently.

The CVV is not a replacement for these other protections. It is a straightforward, fast check that works for online and phone purchases. For in-person purchases, the chip is the primary security layer. For all purchases, your bank's monitoring and your own attention to your statements are your best defense.

Frequently Asked Questions

Can someone use my card number without the CVV?

They can try, but most online merchants will decline the transaction if the CVV is missing or wrong. In-person merchants do not ask for the CVV, so a thief with your card number could potentially use it at a physical store. However, your bank monitors for fraud and can block suspicious transactions.

Is it safe to save my CVV for repeat purchases?

No. Payment processors and merchants are not allowed to store your CVV. If a website asks you to save it, that is a violation of payment card industry rules and a sign the site may not be trustworthy. Use a payment method like Apple Pay or Google Pay instead, which tokenizes your card without storing the CVV.

What should I do if I think my CVV has been compromised?

Contact your card issuer and request a new card. They will issue a replacement with a new CVV. You do not need to close your account or change your card number unless your issuer recommends it. A new physical card usually arrives within 7 to 10 business days.

Why do some websites not ask for the CVV?

Some merchants, especially those you have used before, may skip the CVV check if they use tokenization or if their fraud monitoring system recognizes you as a repeat customer. Others may not ask because they are not following best practices, which is a reason to be cautious about using them.

Can I find my CVV if I lost my card?

You cannot see your CVV without the physical card. Your bank can tell you what it is, but they will not repeat it over the phone for security reasons. You can usually view it in your online banking portal or mobile app. If you cannot access it that way, contact your issuer and ask them to mail you a replacement card.