CVV is the three- or four-digit security code on the back of your card
CVV stands for Card Verification Value. It is a short number printed on your credit card — usually three digits on the back, sometimes four on the front — that exists only to prove you physically have the card in your hand. When you buy something online or over the phone, you give the merchant your card number, expiration date, and CVV. The merchant sends all three to the card network (Visa, Mastercard, American Express) to verify the transaction.
The CVV is not stored in the card's magnetic stripe or chip. It is printed on the card itself. This means a thief who steals your card number from a data breach cannot use it online without also having the physical card or knowing the CVV — which they would not.
Different card networks call it different names. Visa and Mastercard call it CVV2. American Express calls it CID (Card Identification Data). Discover calls it CID as well. But they all work the same way: a three- or four-digit code that proves you have the card.
Key Takeaways
- CVV is a three- or four-digit security code printed on your card that merchants ask for during online and phone purchases.
- The code is not stored in your card's chip or magnetic stripe, so a stolen card number alone cannot be used online without it.
- You should never share your CVV with anyone except the merchant you are actively paying, and never in an email or text.
- Visa, Mastercard, American Express, and Discover all use CVV codes but may call them by different names.
Where to find your CVV on your card
For Visa, Mastercard, and Discover cards, the CVV is on the back of the card. Look at the signature panel — the white or light-colored strip on the back. The CVV is the last three digits printed to the right of the signature line. It is separate from your card number, which runs across the front.
American Express cards are different. The four-digit code appears on the front of the card, above the card number on the right side. American Express calls this the CID instead of CVV, but it serves the same purpose.
If your card is damaged or the CVV is worn away, you can call your card issuer and they will read it to you over the phone. You can also log into your online banking account — most banks display the CVV in your card details section.
Why merchants ask for it during online purchases
When you swipe or insert your card in a store, the card reader can verify that the card is real and that you have it physically present. Online, the merchant cannot see or touch your card. They only have your card number, which is the same number printed on the front of millions of cards. The CVV proves you actually have the card in your hand right now.
The merchant never stores your CVV. Payment processors are required by law not to keep it on file. This is why you have to enter it every time you make an online purchase — even from the same store. If a hacker breaks into a merchant's database and steals card numbers, the CVV is not there to steal.
Some merchants do store your card number if you ask them to (for faster checkout next time), but the CVV stays off their servers. This is a key reason why the CVV system works: the most sensitive piece of information is the one piece merchants are forbidden to keep.
What CVV does and does not protect you from
The CVV protects you from one specific threat: someone using your card number online without having your physical card. If a thief gets your card number from a website breach, they cannot complete an online purchase without the CVV. This stops a large category of fraud.
The CVV does not protect you if someone steals your actual card. If they have the physical card, they have the CVV printed right on it. It also does not protect you from in-person fraud — a cashier who writes down your card number and CVV can use both. And it does not protect you if you give your CVV to a scammer who calls pretending to be your bank.
The CVV is one layer of security, not a complete shield. Your card issuer also monitors for unusual activity, and you have the right to dispute fraudulent charges. But the CVV's job is narrow and specific: to make it harder for someone with only your card number to commit fraud online.
Never share your CVV except during a purchase
You should only enter your CVV when you are actively making a purchase from a merchant you trust. Never give your CVV to someone who calls you, texts you, or emails you claiming to be your bank. Real banks never ask for your CVV by phone or email.
If someone asks for your CVV in any other context — to "verify your account," to "update your information," or to "confirm your identity" — it is a scam. Hang up or delete the message. Your bank already has everything it needs to identify you without asking for the security code that proves you have the card.
The same rule applies to in-person situations. A legitimate cashier will ask you to enter your PIN or sign a receipt, not to read your CVV aloud. If someone asks you to read the three digits on the back of your card, do not do it.
What happens if your CVV is compromised
If you believe someone has your card number and CVV — for example, if you entered it on a website you later realized was fake — contact your card issuer right away. Tell them you may have shared your CVV and ask them to issue you a new card.
Your card issuer can cancel your current card and send you a replacement with a new number and a new CVV. This stops anyone who has the old information from using it. The process usually takes five to ten business days, though many issuers can issue a temporary card number you can use online while you wait.
You are not responsible for fraudulent charges made with your card, even if someone has your CVV. Federal law limits your liability to $50 if you report the fraud promptly, and most card issuers waive that $50 entirely. Report it as soon as you notice it.
Frequently Asked Questions
Is my CVV the same as my PIN?
No. Your PIN is a four-digit number you create and use at ATMs and in-store card readers. Your CVV is printed on the card and is used only for online and phone purchases. You choose your PIN; the card issuer prints your CVV.
Can someone use my card number without the CVV?
In a store, yes — the card reader does not ask for CVV. Online, no — most websites require it. Over the phone, a merchant may ask for it, but some older phone systems do not. The CVV is one security layer, not the only one.
What if I enter the wrong CVV?
The transaction will be declined. The merchant's system will reject it and ask you to try again. There is no penalty for entering it wrong — you just cannot complete the purchase until you enter the correct code.
Do debit cards have a CVV?
Yes. Debit cards issued by Visa or Mastercard have a CVV on the back, just like credit cards. It works the same way for online purchases. Some debit cards also have a PIN for in-store use, which is separate.
Why do I have to enter my CVV every time if the merchant stores my card number?
Because merchants are not allowed to store the CVV. Payment processors require them to delete it after each transaction. This is why you enter it fresh every time — it is the only way the merchant can verify you have the card without keeping the code on file.