The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back of your credit card — usually three digits, sometimes four on American Express — that card networks use to confirm you have the physical card in your hand. When you enter it during an online purchase or over the phone, the merchant sends it to your card issuer, who checks whether it matches the number they have on file. If it does, the transaction is more likely to go through. If it doesn't, the purchase is declined.
The CVV exists because online and phone transactions don't involve a card reader that can verify a magnetic stripe or chip. A thief who steals your card number from a data breach or a receipt cannot use it online without also knowing this three-digit code — which is not printed on receipts and is not stored in most merchant databases. That separation is intentional.
Different card networks call it different things: Visa and Mastercard call it CVV2, American Express calls it CID, and Discover calls it CVV2. The function is the same across all of them.
Key Takeaways
- The CVV is a three- or four-digit code on the back of your card that proves you physically possess it when you shop online or by phone.
- Card issuers check the CVV against their records, but they do not store it in the same databases as your card number, which limits what a hacker can do with a stolen number.
- Never give your CVV to anyone who calls you claiming to be from your bank — legitimate issuers will never ask for it by phone.
- Merchants are not supposed to store your CVV after a transaction, though some do illegally; using a virtual card number or digital wallet reduces the risk of it being stolen.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is printed on the back, usually to the right of the signature strip. It is the last three digits of a longer number. On American Express cards, it appears on the front, above the card number on the right side, and is four digits long.
The CVV is not embossed or raised like the card number — it is printed flat on the surface. This matters because older card readers that could only read embossed numbers could not capture the CVV, which is part of why it works as a security check for online and phone orders.
How merchants and card issuers use the CVV
When you enter your card number, expiration date, and CVV into a website checkout form, that information travels to a payment processor, which forwards it to your card issuer. The issuer checks three things: whether the card number is valid, whether the expiration date matches their records, and whether the CVV matches. If all three pass, the issuer approves the charge.
The CVV check happens in real time, usually in under a second. If the CVV does not match — either because you typed it wrong or because someone is using a stolen card number without the code — the transaction is declined when ready. The merchant never sees your actual CVV; they only receive a yes or no answer about whether it was correct.
This design is why the CVV offers real protection against card-not-present fraud. A criminal who obtains your card number from a breached retailer database or a phishing email cannot complete an online purchase without also knowing the CVV, which is not stored in those databases.
Why merchants should not store your CVV
Payment Card Industry Data Security Standard (PCI DSS) rules forbid merchants from storing your CVV after a transaction is complete. The rule exists precisely because storing it would defeat the purpose — if a hacker broke into a merchant's database and found both your card number and your CVV, they could use both to shop online.
Some merchants break this rule anyway, either out of negligence or because they want to store it for recurring charges. If you discover that a merchant has stored your CVV, you can report it to your card issuer, who may investigate or terminate the merchant's ability to process cards. You can also report it to the PCI Security Standards Council, though they do not investigate individual complaints — they work with card networks and acquiring banks.
In practice, the safest way to prevent your CVV from being stolen is to avoid giving it to merchants at all. Using a digital wallet like Apple Pay or Google Pay, or requesting a virtual card number from your issuer, means the merchant never sees your real CVV.
What to do if someone asks for your CVV by phone
Hang up. Your bank, credit card issuer, and the payment networks will never call you and ask for your CVV. This is a hard rule. If someone claiming to be from your card issuer or bank calls and asks for it, they are a scammer.
Legitimate issuers already have your CVV on file — they do not need you to recite it over the phone. They also know that asking for it over an unsecured phone line would violate their own security policies. If you are concerned about a charge on your account, hang up, look up the customer service number on the back of your card or on your issuer's official website, and call them directly.
CVV versus other card security features
The CVV is one layer of fraud prevention, but not the only one. Your card also has an expiration date, which changes every few years and limits how long a stolen number remains useful. Chip-enabled cards add another layer: when you insert your card into a reader, the chip generates a unique code for that specific transaction, which a thief cannot reuse elsewhere.
For online shopping, the CVV is the main line of defense because chip readers and magnetic stripes do not work through a screen. But it is not foolproof. A determined criminal can sometimes guess a CVV — there are only 1,000 possible three-digit combinations — or obtain it through phishing, social engineering, or by installing malware on a website's payment form.
This is why card issuers also monitor for unusual spending patterns, why many require a second form of verification for large purchases, and why you should check your statements regularly for charges you do not recognize.
How to protect your CVV
Treat your CVV the way you treat your PIN: do not write it down, do not text it, do not email it, and do not say it out loud where others can hear. When you enter it on a website, make sure the page is find — the URL should begin with "https://" and there should be a padlock icon in the address bar.
If you shop on public Wi-Fi, use a VPN to encrypt your connection. If a website asks you to enter your CVV in an unusual way — such as in a pop-up window or after you have already completed checkout — stop and contact the merchant's customer service to confirm the request is legitimate.
Consider using a virtual card number service if your issuer offers one. Many banks and credit card companies now allow you to generate a temporary card number that is linked to your real account but has a different number, expiration date, and CVV. If that temporary number is stolen, it cannot be used to access your actual account.
Frequently Asked Questions
Can someone use my credit card number without the CVV?
In person, yes — a merchant with a card reader can process a transaction using only the card number and expiration date. Online or by phone, it is much harder. Most merchants require the CVV for card-not-present transactions, and card issuers are more likely to approve a charge if the CVV matches. A thief with only your number would face declined transactions and a higher risk of triggering fraud alerts.
Is the CVV the same as my PIN?
No. Your PIN is a number you create and memorize to withdraw cash or check your balance at an ATM. Your CVV is printed on the card and is used only for online and phone purchases. A thief who knows your PIN cannot use it to shop online, and someone who has your CVV cannot use it to withdraw cash.
What should I do if I accidentally shared my CVV with a scammer?
Contact your card issuer when ready — the number is on the back of your card. Tell them you shared your CVV and ask them to monitor your account for fraudulent charges. Many issuers will cancel your card and issue a replacement with a new number and CVV. You are not liable for fraudulent charges, but acting quickly limits the window in which a scammer can use the information.
Do I have to give my CVV every time I shop online?
Most online merchants require it for security reasons, but some allow you to skip it if you have shopped with them before and they have your information on file. You can also avoid entering it by using a digital wallet like Apple Pay, Google Pay, or Samsung Pay, which transmit a temporary code instead of your real card details.
Why does my card issuer ask for my CVV when I call customer service?
Some issuers use the CVV as a verification method to confirm you have the physical card in your hand before discussing your account. This is different from a scammer asking for it — a legitimate issuer will ask you to provide it, not ask you to read it aloud, and will only ask in the context of verifying your identity for account access, not for payment information.