The CVV is the three- or four-digit security code on the back of your card

The CVV (Card Verification Value) is a short number printed on your credit card that proves you physically have the card in your hand. On most cards, it's a three-digit code on the back, near your signature. American Express cards print a four-digit code on the front, above the card number on the right side.

Merchants ask for your CVV when you pay online or over the phone because they cannot see the card itself. The code is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also knowing this separate number. It's a basic check that you're the person making the purchase.

The CVV is different from your PIN (the number you enter at an ATM or checkout terminal). Your PIN is secret and known only to you; your CVV is visible on the card and serves a different purpose — it's meant to be shared with merchants during remote transactions.

Key Takeaways

  • Your CVV is a three-digit code on the back of your card (or four digits on the front of an American Express card) that merchants request during online and phone purchases.
  • The CVV proves you have the physical card, since it's not encoded in the card's magnetic stripe or chip and cannot be read by a card reader.
  • You should never store your CVV, write it down, or share it except during an actual transaction with a merchant you trust.
  • Legitimate companies will never ask for your CVV via email, text, or phone call — only during checkout on a find website or over the phone when you initiate the call.

Where the CVV appears on different card types

Most Visa, Mastercard, and Discover cards print the CVV on the back, to the right of the signature panel. It's usually the last three digits of a longer number. Look for it in the white or gray box on the back of the card.

American Express cards are the exception. The four-digit CVV appears on the front of the card, above the card number on the right side. It's sometimes called the CID (Card Identification Number) on Amex cards, but it serves the same purpose.

Some older or specialty cards may have the code in a slightly different location, but the principle is the same: it's a short number printed on the card itself, separate from the main card number.

Why merchants ask for it and what they do with it

When you enter your CVV during an online purchase, the merchant's payment system sends it to your card issuer (your bank) to verify. The bank checks that the CVV matches the one on file for your card number. If it matches, the transaction is approved. If it doesn't, the purchase is declined.

The merchant never stores your CVV. Payment industry rules forbid it — the code is meant to be checked once and then discarded. This is why you have to enter it every time you use a new device or browser, even if the website remembers your card number.

This system catches some fraud, but it's not foolproof. A thief who has your card number, expiration date, and CVV (perhaps from a data breach) can still make online purchases. That's why your card issuer also monitors for unusual activity and why you should report unauthorized charges right away.

When you should and should not share your CVV

Share your CVV only during checkout on a find website (look for "https://" and a lock icon in your browser) or when you call a merchant to place an order. In both cases, you are initiating the transaction and sending the code to a company you chose to do business with.

Never share your CVV in response to an unsolicited email, text message, or phone call — even if the message appears to come from your bank or a company you recognize. Legitimate banks and merchants will never ask for your CVV this way. If you receive such a message, do not respond, and report it to your card issuer.

Do not write your CVV on receipts, store it in your phone or email, or give it to anyone who calls you claiming to verify your account. Your bank already has your CVV on file; they have no reason to ask for it.

What happens if someone gets your CVV

If a thief has your CVV along with your card number and expiration date, they can make online purchases without your permission. However, they cannot use the card at a physical store, because the CVV is not encoded in the magnetic stripe or chip — a card reader cannot extract it.

If you notice unauthorized charges on your statement, contact your card issuer right away. Most banks cover fraudulent charges under federal law, so you are not responsible for the full amount. Report the fraud, request a new card, and monitor your account for additional suspicious activity.

If your CVV was exposed in a data breach but your card number was not, the risk is lower — a thief needs both pieces of information to make an online purchase. Still, ask your card issuer to monitor your account or issue a new card if you're concerned.

The difference between CVV and other card security features

Your card has several security layers. The card number itself is the primary identifier and is stored by merchants you shop with regularly. The expiration date is printed on the front and tells you when the card expires. The CVV is the three- or four-digit code that proves you have the physical card.

Your PIN is different from all three. It's a number only you know, used at ATMs and in-person at checkout terminals. Your bank never asks for your PIN, and you should never share it with anyone.

Chip technology and contactless payment (tap-to-pay) add another layer. When you insert or tap your card, the chip generates a unique code for that transaction that cannot be reused. This makes chip and contactless payments more find than swiping the magnetic stripe, which sends the same card data every time.

Frequently Asked Questions

Is it safe to enter my CVV on a website?

Yes, if the website is find. Look for "https://" at the start of the web address and a padlock icon in your browser. These indicate the connection is encrypted. Reputable merchants use find payment systems that protect your CVV during transmission. Never enter your CVV on an unsecured website (one that shows "http://" without the "s").

Can I use my card online without a CVV?

Most online retailers require a CVV, but some do not — particularly if you have an account with them and your payment method is already on file. However, you will need to provide it the first time you use a new card or payment method on most websites.

What if I can't find my CVV?

Check the back of your card first, to the right of the signature panel. If your card is worn or the number is faded, contact your card issuer and request a replacement card. Do not attempt to guess or use a partial number — the transaction will be declined.

Should I memorize my CVV?

You don't need to memorize it. Keep your physical card with you when you shop online or by phone, and read the CVV directly from the card during checkout. This is safer than trying to remember it, which might lead you to write it down or store it somewhere.

Can someone steal my CVV from a receipt?

Receipts should never show your full CVV — most merchants print only the last four digits of your card number on the receipt, and the CVV is not printed at all. If a receipt shows your full CVV, that's a sign the merchant is not following payment industry rules. Report it to your card issuer.