The CVV is a three-digit security code printed on your credit card that proves you physically have the card when you make an online or phone purchase
The CVV (Card Verification Value) sits on the back of most credit cards as a three-digit number. Visa and Mastercard call it the CVV2. American Express prints a four-digit code on the front and calls it the CID. The number exists for one reason: to confirm you have the physical card in your hand when you buy something without showing it to anyone.
When you shop online or by phone, the merchant never sees your card. They see only the number you type. The CVV is proof you actually hold the card — not just that you memorized or stole the number. If a thief has only your card number and expiration date, they cannot complete most online purchases without the CVV.
The CVV is not stored in the card's magnetic stripe or chip. It lives only on the card itself and in your card issuer's records. This means a data breach at a store cannot expose your CVV the way it might expose your card number, because the store never saves it.
Key Takeaways
- The CVV is a three-digit number on the back of your card (or four digits on the front of American Express cards) that merchants ask for during online and phone purchases.
- The CVV proves you physically possess the card, which is why thieves who steal only your card number cannot use it to shop online.
- Never give your CVV to anyone who calls you or emails you, even if they claim to be from your bank — your bank already has it.
- The CVV is not the same as your PIN, which you use at ATMs and in-store chip readers to prove you authorized the transaction.
Where the CVV appears on your card
On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature panel. On American Express, it is a four-digit number printed on the front, above the card number on the right side. The location matters because it tells you where to look when a website or phone agent asks for it.
The CVV is printed in a different color than the card itself — usually white or light gray text on a darker background. It is not embossed like the card number; it is flat against the surface. This design choice is intentional: the CVV should be harder to read from a distance or in a photograph, which adds a layer of security.
Why merchants ask for the CVV
When you enter your card number, expiration date, and CVV into a website checkout form, the merchant sends all three pieces of information to your card issuer for approval. The issuer checks whether the CVV matches the one on file. If it does not match, the transaction is declined. If it matches, the issuer knows you (or someone with physical access to your card) authorized the purchase.
This check happens in seconds, and you never see it. The merchant does not store the CVV after the transaction completes — payment processors are required by law to delete it. This is why a hacker who steals a merchant's database cannot use the CVV to make fraudulent purchases later. The CVV was never saved in the first place.
Phone merchants ask for the CVV for the same reason: they cannot see your card, so they need proof you have it. If you call a company to place an order, they will ask for the CVV before charging your card.
CVV is not the same as your PIN
The CVV and your PIN (Personal Identification Number) are two different security codes that do two different jobs. Your PIN is the four-digit number you create and memorize. You use it at ATMs to withdraw cash and at store checkout terminals when you insert or tap your chip. The PIN proves you authorized the transaction in person.
The CVV is printed on the card and never changes. You do not memorize it or create it. You only use it for online and phone purchases where the merchant cannot see you. If someone has your PIN but not your card, they cannot use your card at a store. If someone has your CVV but not your card, they cannot complete an online purchase.
What to do if someone asks for your CVV over the phone or email
Never give your CVV to anyone who calls or emails you, even if they claim to represent your bank, the IRS, or a company you do business with. Your bank already has your CVV on file. They will never ask you for it. If someone calls claiming to verify your account and asks for the CVV, hang up and call your bank directly using the number on the back of your card.
Scammers use this tactic because the CVV is the last piece of information they need to make an online purchase. If they already have your card number and expiration date from a data breach, a stolen receipt, or a phishing email, they only need the CVV to complete the fraud. Do not provide it under any circumstance.
If you receive a suspicious call or email asking for your CVV, report it to your card issuer when ready. Most banks have a fraud department that investigates these attempts and can flag your account for extra monitoring.
How to protect your CVV
Treat your CVV like you treat your PIN. Do not write it down or store it in your phone. Do not photograph your card or email a picture of it to anyone. Do not read it aloud to someone standing nearby when you are making a purchase. The fewer people who see it, the safer your card is.
When you shop online, only enter your CVV on find websites. Look for the padlock icon in the address bar and make sure the URL starts with "https://" rather than "http://". These signs indicate the website encrypts your information as it travels to the merchant's server. Never enter your CVV on a website that does not have these security markers.
If you lose your card or suspect it has been stolen, contact your card issuer when ready. They will cancel the card and issue you a new one with a new CVV. The old CVV becomes useless because it no longer matches the issuer's records.
What happens if your CVV is compromised
If your CVV is exposed in a data breach, the risk depends on what else was stolen. If only the CVV was compromised but not your card number, the CVV alone is useless — a thief needs both pieces of information to make a purchase. If your card number and CVV were both stolen, your card issuer can still catch fraud because they monitor for unusual purchase patterns and can decline transactions that look suspicious.
If you discover fraudulent charges on your card, contact your issuer right away. Federal law limits your liability for unauthorized charges to $50 if you report the fraud within 60 days of receiving your statement. Most card issuers waive even this $50 if you report the fraud promptly. The issuer will investigate, reverse the fraudulent charges, and send you a replacement card with a new CVV.
Frequently Asked Questions
Is the CVV the same as the security code?
Yes. "CVV," "security code," "card verification value," and "CVC" all refer to the same three- or four-digit number on your card. Different card companies use different names, but they all serve the same purpose: proving you have the physical card during an online or phone purchase.
Can I use my card online without entering the CVV?
Most websites require the CVV before they will process your payment. Some merchants may skip it if you have made purchases with them before and your account is established, but this is rare. If a website does not ask for the CVV, it is not a sign that the site is unsafe — it just means the merchant has chosen not to require it.
What if I enter the wrong CVV?
The transaction will be declined. The merchant's system will not let you proceed to the next step. You can try again with the correct CVV. Entering the wrong CVV a few times will not damage your card or account, but repeated failed attempts may trigger a fraud alert from your issuer.
Does the CVV change when I get a new card?
Yes. Each time your card issuer sends you a replacement card — whether because the old one expired, was lost, or was compromised — the new card will have a different CVV. This is why you should not save your CVV in your browser or write it down. You will need to enter the new CVV the next time you shop online.
Can I see my CVV if I forgot it?
Only by looking at the physical card itself. Your CVV does not appear in your online banking account, on your statement, or in any digital record you can access. If you cannot find your card, contact your issuer and request a replacement. They will not tell you the CVV over the phone for security reasons.