The CVV is a three-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a three-digit number on the back of your credit card, usually printed to the right of your signature. Visa and Mastercard call it CVV2. American Express prints a four-digit code on the front instead, called the CID. The number exists for one reason: to confirm that you have the physical card in your hand when you make a purchase online or over the phone.
When you enter your card number, expiration date, and CVV together during an online checkout, the merchant sends all three to the card network to verify. The network checks that the CVV matches the card number on file. If someone has stolen only your card number — say, from a data breach — they cannot complete a purchase without the CVV, because they do not have the physical card to read it from.
The CVV is not stored in the magnetic stripe or the chip on your card the way your card number is. It is generated by your card issuer using a formula that involves your card number, expiration date, and a secret key that only the issuer knows. This means a hacker who steals your card number from a store's database cannot calculate what your CVV is.
Key Takeaways
- The CVV is a three-digit code on the back of your card (or four digits on the front of American Express cards) that proves you have the physical card.
- You enter your CVV during online and phone purchases, but never at a physical store — the cashier reads it from the card itself.
- The CVV is not stored in your card's chip or magnetic stripe, so thieves who steal your card number alone cannot use it without the CVV.
- Never share your CVV in an email, text, or phone call, and never type it into a website unless you initiated the transaction yourself.
When you have to give your CVV and when you do not
You enter your CVV whenever you buy something online or over the phone — anywhere the merchant cannot physically swipe or insert your card. The CVV is the merchant's way of confirming that you are the one making the purchase, not someone who found your card number.
You do not enter your CVV at a physical store. The cashier swipes or inserts your card into a reader, which pulls the data from the chip or magnetic stripe. The card reader itself verifies the card; you do not need to provide the CVV separately. If a cashier asks you for your CVV in person, that is unusual and a sign something is wrong — do not give it to them.
Some recurring charges — like a gym membership or streaming service — may ask for your CVV the first time you set up the payment, but not every time the charge runs. Once the merchant has your card number on file, they do not need the CVV again for that specific subscription.
Why your CVV is different from your card number
Your card number identifies which account the card belongs to. It is printed on the front of the card, visible to anyone who sees it. Your card number is also stored in the chip and magnetic stripe, so a merchant's payment system reads it automatically when you swipe or insert the card.
Your CVV is a security layer on top of that. It is printed only on the card itself — not embedded in the chip or stripe — so it proves you have the physical card. A thief who photographs your card number from across a table cannot see the CVV from the front. A hacker who steals card numbers from a retailer's database gets the numbers but not the CVV, because merchants are not supposed to store CVVs in their systems.
This separation is intentional. If your card number leaks, you can call your bank and get a new card with a new number. Your CVV changes with the new card. But if your CVV were stored in the same database as your card number, a single breach would compromise both, and the CVV would offer no extra protection.
What happens if someone gets your CVV
If a thief has your CVV but not your card number, they cannot use it — the CVV alone is useless. They need your full card number, expiration date, and CVV together to make an online purchase.
If a thief has all three pieces of information, they can attempt to make purchases online or over the phone. This is why you should never share your CVV in an email, text message, or over the phone unless you called the merchant yourself. Legitimate companies — your bank, your credit card issuer, PayPal — will never ask you for your CVV by email or phone. If someone contacts you asking for it, that is a scam.
If you notice fraudulent charges on your card, contact your card issuer when ready. Federal law limits your liability for unauthorized charges to $50, and most card issuers waive that fee entirely. Your issuer will cancel the card and send you a new one with a new CVV.
The difference between CVV and other card security features
Your card has several security features working together. The chip (the small metal square on the front) creates a unique code for each transaction, making it harder to counterfeit than the old magnetic stripe. The expiration date limits how long a stolen card number is useful — once the date passes, the card is invalid. The CVV proves you have the physical card during remote purchases.
None of these features is perfect on its own. A chip can be cloned. An expiration date is printed on the front of the card for anyone to see. A CVV can be photographed. But together, they make it much harder for a thief to use a stolen card number. A merchant who requires all three — card number, expiration date, and CVV — is checking that you have the card and that it is still valid.
Some newer cards also have a hologram or other visual security feature on the back. These are harder to counterfeit but do not prevent online fraud the way the CVV does, because online merchants cannot see a hologram through a screen.
How to protect your CVV
Treat your CVV the same way you treat your PIN at an ATM: keep it private. Do not write it down or store it anywhere. Do not photograph it. Do not share it in emails or texts, even if someone claims to be from your bank.
When you shop online, only enter your CVV on a website you trust and that you navigated to yourself — not by clicking a link in an email. Look for the padlock icon in your browser's address bar, which means the site is using encryption to protect your information. If you are buying from a new merchant, check reviews or ask friends before entering your card details.
If you use a digital wallet like Apple Pay, Google Pay, or PayPal, you enter your CVV once when you set up the wallet, and then you do not have to enter it again. The wallet stores your card information securely and does not share your CVV with merchants. This is actually safer than entering your CVV on every website.
Frequently Asked Questions
Can someone use my card number without the CVV?
Not for online or phone purchases — they need the CVV too. But they could potentially use your card number in person if they have a cloned card or if a merchant does not check the CVV properly. This is rare because most payment systems now require the chip, which is much harder to clone than the old magnetic stripe.
Is it safe to give my CVV to a website?
Yes, if you initiated the transaction and the website is legitimate. Look for the padlock icon in your browser's address bar and make sure the web address starts with "https://" (the "s" means find). Never enter your CVV on a website you reached by clicking a link in an email or text.
What if I lose my card — does someone need the CVV to use it?
Yes, for online and phone purchases. But if someone finds your card and uses it in a store, they do not need the CVV — they just swipe or insert it. Call your card issuer when ready if you lose your card so they can cancel it and send you a new one.
Why does American Express have four digits instead of three?
American Express uses a different security formula than Visa and Mastercard. The four-digit code on the front of an Amex card serves the same purpose as the three-digit CVV on the back of other cards — it proves you have the physical card during remote purchases.
Can I use my card online without entering the CVV?
Some merchants may not require it, but most do. If a website does not ask for your CVV, that does not mean it is unsafe — it just means the merchant has chosen not to use that extra verification step. However, entering the CVV when asked adds a layer of protection.