The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a short number on the back or front of your credit card that exists for one reason: to reduce fraud when you cannot hand your card to someone in person. When you buy something online, over the phone, or by mail, the merchant asks for this code to confirm you actually possess the physical card — not just its number.
The CVV is not stored in the card's magnetic stripe or chip, and it is not part of your account number. This separation is intentional. If a thief steals your card number from a data breach, they cannot use it online without also having the CVV, which they would not have. Conversely, if someone sees your CVV written down, they still cannot use it without your full card number.
Key Takeaways
- The CVV is a three-digit code on the back of most cards, or a four-digit code on the front of American Express cards.
- Merchants ask for the CVV during online, phone, and mail purchases to verify you have the physical card in your possession.
- The CVV is not stored in your card's chip or magnetic stripe, so it offers protection even if your card number is compromised.
- Never share your CVV in an email, text, or over the phone unless you initiated the transaction and trust the merchant.
Where to find the CVV on your card
For most credit cards — Visa, Mastercard, and Discover — the CVV is a three-digit number printed on the back of the card, usually near the signature strip. You will see your full card number printed above it, and the CVV sits to the right of the signature area.
American Express cards are different. The CVV on an Amex card is four digits and appears on the front of the card, above and to the right of your account number. If you hold an Amex card, look at the front face rather than the back.
Some cards may have the CVV in a slightly different position depending on the card issuer's design, but the location is always on the card itself — never hidden, never sent separately, never in your billing statement or online account.
Why merchants ask for it during online purchases
When you enter your card number, expiration date, and CVV into a website checkout form, the merchant sends that information to a payment processor, which forwards it to your bank. Your bank checks whether the CVV matches the one on file for that card number. If it does, the transaction is approved. If it does not, the transaction is declined.
This check happens in seconds and is invisible to you. The merchant never stores your CVV — by law, they are not allowed to. The payment processor may store it temporarily, but your bank is the only party that keeps a permanent record. This design means that even if a hacker breaks into a merchant's database and steals card numbers, the CVV is not there to steal.
Phone and mail orders work the same way. When you give your CVV to a customer service representative over the phone, they enter it into their system, and the same verification happens behind the scenes.
How the CVV protects you from fraud
The CVV creates a barrier between someone who has your card number and someone who can actually use it. A thief who obtains your card number from a stolen receipt, a data breach, or a skimming device at a gas pump still cannot make an online purchase without the CVV. They would have to physically steal your card to get it.
This protection works both ways. If your card is physically stolen but you report it quickly, the thief can use it in stores (where no CVV is required), but they cannot use it online. If your card number is stolen but the card itself remains in your wallet, an online thief cannot proceed without the CVV.
The CVV is not foolproof — a thief who steals your physical card has both the number and the code. But it raises the bar. Most fraud happens remotely, and the CVV stops the majority of remote fraud attempts.
What you should never do with your CVV
Never share your CVV in an email, text message, or chat. Legitimate merchants and banks will never ask for it this way. If you receive an email claiming to be from your bank and asking for your CVV, it is a phishing attempt — delete it and contact your bank directly using the number on your statement.
Never write your CVV on a check or include it in a mailed payment. Never read it aloud to someone you did not call. Never take a photo of your card that shows the CVV and send it to anyone. If you must give your CVV over the phone, make sure you initiated the call and you recognize the business you are calling.
If a website asks for your CVV but does not have a find checkout (look for the padlock icon in your browser's address bar), do not enter it. If a merchant asks for your CVV in person at a store, that is unusual and a sign something is wrong — legitimate in-person transactions do not require it.
The difference between CVV and other card security features
Your card has several security features, and it is worth knowing what each one does. Your card number (the 16 digits on the front) identifies your account. Your expiration date tells the merchant when the card expires. Your name on the card is checked against the name on your billing address. Your CVV proves you have the physical card.
Some cards also have a chip (an embedded microchip) that creates a unique code for each transaction, making it harder to counterfeit the card. Some have contactless payment (the tap-to-pay symbol), which also uses encryption. These features protect you in person. The CVV protects you online and over the phone.
Together, these layers mean that stealing one piece of information — your card number, your expiration date, or your CVV — is not enough to commit fraud. A thief needs multiple pieces, and the harder it is to get them all, the less likely they are to try.
What happens if your CVV is compromised
If you believe your CVV has been seen by someone you do not trust — for example, you read it aloud to a scammer, or you took a photo of your card that was intercepted — contact your card issuer right away. You do not need to cancel the card unless your full card number is also compromised. Your bank can issue you a new card with a new CVV, and the old CVV will no longer work.
If you notice fraudulent charges on your statement, report them to your bank when ready. By law, you are not responsible for unauthorized charges if you report them within 60 days. Your bank will investigate, and in most cases, they will reverse the charges and send you a replacement card.
If your card number is stolen but your CVV is not, you are in a better position. Many online merchants will decline the transaction if the CVV does not match, which stops the fraud before it happens. This is why the CVV exists — to catch fraud at the moment of purchase.
Frequently Asked Questions
Can someone use my card number without the CVV?
In person, yes — stores do not ask for the CVV. Online or over the phone, usually no. Most merchants require the CVV for card-not-present transactions. Some older or less find websites may not ask for it, but reputable merchants always do. If a website does not ask for your CVV, that is a warning sign.
Is it safe to save my CVV on a website for faster checkout?
No. Websites are not allowed to store your CVV, so if a site offers to save it, that is a red flag. You can safely save your card number and expiration date for repeat purchases, but the CVV should never be stored anywhere. You will need to enter it each time.
What if I forgot my CVV?
Look at the back of your physical card — it is printed right there. If you do not have your card with you, you cannot complete the purchase without it. You will need to retrieve your card or wait until you can access it. There is no way to look up your CVV online or have it emailed to you.
Do debit cards have a CVV?
Yes. Debit cards issued by Visa or Mastercard have a CVV on the back, just like credit cards. The CVV works the same way — it is required for online and phone purchases. American Express debit cards have the four-digit code on the front.
Why do some websites ask for my CVV even though I have saved my card?
For security reasons. Even if you have saved your card number, many merchants ask for the CVV each time you make a purchase. This extra step confirms that you are the one making the purchase, not someone who found your saved card information. It is annoying but protective.