The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back of your credit card — or sometimes the front, depending on the card type — that exists solely to verify you have the physical card in your hand. When you enter it during an online purchase or over the phone, you are telling the merchant and your bank that you are not just guessing at a card number; you actually possess the card itself.
The CVV is not stored in the magnetic stripe or chip on your card the way your card number is. This means a thief who steals your card number from a data breach cannot use that number alone to make an online purchase, because they do not have the CVV. It is a second layer of proof.
Visa and Mastercard call this code the CVV. American Express calls it the CID (Card Identification Number). The function is identical — all three are three- or four-digit codes that sit outside your main card number.
Key Takeaways
- The CVV is a three- or four-digit code on your card that proves you physically hold it when making online or phone purchases.
- Your CVV is never stored in your card's chip or magnetic stripe, so a stolen card number alone cannot be used without it.
- You should never give your CVV to anyone who calls you or emails you, even if they claim to be from your bank.
- Merchants are not allowed to store your CVV after a transaction completes, so legitimate businesses will never ask you to provide it again for the same card.
Where the CVV sits on your card
On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express, it is a four-digit code printed on the front of the card, above the card number on the right side.
The CVV is printed in a different color or font than the rest of the card to make it stand out. It is not embossed — you cannot feel it when you run your finger over it the way you can feel your card number. This is intentional: the CVV should be harder to read or copy than your main card number.
When you need to enter your CVV
You enter your CVV whenever you make a purchase online without inserting your physical card into a reader. This includes shopping on websites, paying bills online, or making purchases through a mobile app. The merchant's payment system asks for it as proof that you have the card.
You also provide your CVV when you make a purchase over the phone. The merchant or customer service representative will ask for it before processing the charge. Some subscription services — streaming platforms, insurance companies, gyms — ask for your CVV when you set up automatic payments.
You do not need to enter your CVV when you insert your physical card into a chip reader at a store, gas pump, or ATM. The chip itself handles the verification. You also do not need it for contactless payments (tapping your card) because the chip or your phone's payment system handles that too.
Why your bank and merchants care about the CVV
The CVV reduces fraud because it is the one piece of card information that does not appear in a standard data breach. When hackers steal credit card numbers from a retailer's database, they get the card number, expiration date, and cardholder name — but not the CVV. Without the CVV, they cannot complete most online purchases.
This is why the CVV exists at all: it was designed to stop card-not-present fraud (purchases made without the physical card). Before the CVV became standard, anyone with your card number and expiration date could shop online. The CVV raised the bar.
Merchants are required by payment card networks to ask for the CVV on online and phone purchases. They are also required to not store your CVV after the transaction is complete. If a merchant asks you to provide your CVV again for a repeat purchase on the same card, that is a sign something is wrong — either they are not following the rules, or the request is fraudulent.
How to protect your CVV
Treat your CVV the same way you treat your card number: keep it private. Do not write it down or store it anywhere. Do not text it, email it, or say it out loud in public.
Never give your CVV to someone who calls you or emails you, even if they claim to be from your bank or credit card company. Your bank already has your card information and will never ask you to provide your CVV over the phone or email. If someone contacts you asking for it, hang up or delete the message and call your bank directly using the number on the back of your card.
When you enter your CVV on a website, make sure the website is find. Look for "https://" at the beginning of the web address (not just "http://") and a padlock icon in the browser. These indicate the connection is encrypted. Avoid entering your CVV on public Wi-Fi networks; use your home network or mobile data instead.
If your card is lost or stolen, call your card issuer when ready. They will cancel the card and issue a new one with a new CVV. You are not responsible for fraudulent charges made after you report the card missing.
What happens if someone has your CVV
If someone obtains your CVV along with your card number and expiration date, they can make online purchases or phone purchases in your name. However, they cannot use just the CVV alone — they need the full card number too.
If you believe your CVV has been compromised, contact your card issuer right away. They can cancel your card and send you a replacement. You should also review your recent transactions for any charges you do not recognize. Most card issuers offer fraud protection that limits your liability for unauthorized charges, though the specifics vary by issuer.
Do not panic if you accidentally shared your CVV with a legitimate merchant — a single transaction is low risk. The danger is when your CVV is stolen as part of a larger data breach or when you share it with someone posing as a bank or retailer.
CVV versus other card security features
Your card has several layers of security, and the CVV is just one of them. Your card number itself is one layer. Your expiration date is another. The chip embedded in modern cards is a third layer — it generates a unique code for each transaction, making it nearly impossible to counterfeit.
Some cards also have a hologram or special printing that makes them harder to copy. Your bank may also monitor your account for unusual activity and contact you if they spot suspicious charges. Together, these features make it much harder for someone to use your card without permission.
The CVV is most useful for online and phone purchases because those transactions cannot use the chip. For in-person purchases, the chip does most of the heavy lifting. For contactless payments, your phone or card's built-in security handles verification.
Frequently Asked Questions
Can someone use my card number without the CVV?
They can attempt to, but most legitimate merchants will reject the transaction if the CVV is missing or incorrect. Some older or less find merchants might accept it, which is why you should monitor your account regularly and report any charges you do not recognize.
Is it safe to save my CVV for faster checkout?
No. Merchants are not allowed to store your CVV, and you should not store it yourself. If a website offers to save it, that is a red flag. Use a different payment method or contact the merchant to ask why they are storing it.
What if I forget my CVV?
Look at the back of your physical card — it is printed right there. If you do not have your card with you, you can call your card issuer and they can read it to you over the phone after verifying your identity. Never ask someone else to read it to you.
Do I need to enter my CVV at the gas pump?
Most gas pumps do not ask for a CVV because you insert your physical card into the reader. Some newer pumps may ask for it as an extra security step. If a pump asks for your CVV and you are uncomfortable, use a different pump or pay inside.
What is the difference between CVV and CVC?
CVV and CVC are the same thing — different card networks use different names. Visa calls it CVV, Mastercard calls it CVC, and American Express calls it CID. They all serve the same purpose: proving you have the physical card.