The CVC is a three- or four-digit security code printed on your card that proves you physically have it

CVC stands for Card Verification Code. It's a number the card issuer prints on your card — not encoded in the magnetic stripe or chip — specifically so online and phone merchants can confirm you're holding the actual card, not just using a stolen card number.

When you buy something online or over the phone, the merchant asks for this code. You type it in or read it aloud. The merchant sends it to your card issuer, who checks whether that code matches what they have on file for your card number. If it matches, the transaction goes through. If it doesn't, the merchant declines the purchase.

The CVC is not the same as your PIN (the number you use at an ATM or in-store). Your PIN is secret and encrypted. Your CVC is printed right on the card where anyone holding it can see it.

Key Takeaways

  • The CVC is a three- or four-digit code printed on the back of your card (or front, depending on the card type) that merchants use to verify you have the physical card.
  • Visa and Mastercard use a three-digit code called the CVV; American Express uses a four-digit code on the front called the CID.
  • You should never share your CVC with anyone except the merchant you're paying, and legitimate companies will never ask for it by email or phone.
  • The CVC protects merchants from fraud, not you — it reduces their loss if a card number is stolen, but it does not prevent unauthorized charges to your account.

Where to find your CVC on different card types

Most cards print the CVC on the back, in the signature panel on the right side. It's usually the last three digits of a longer number. Visa and Mastercard both use this layout.

American Express is different. The CVC on an Amex card is four digits and appears on the front of the card, above the card number on the right side. Amex calls it the CID (Card Identification Number), but it serves the same purpose.

Some older or specialty cards may have the code in a different location. If you can't find it, call the number on the back of your card and ask. The issuer can tell you where it is or read it to you over the phone.

Why merchants ask for it, and what it actually protects

A merchant asks for your CVC to reduce their own fraud risk. Here's the scenario: someone steals your card number (from a data breach, a skimmed ATM, or a compromised website). They try to use it to buy something online. If the merchant only asks for the card number and expiration date, the thief can complete the purchase. But if the merchant also asks for the CVC, the thief can't provide it — because they don't have the physical card.

This protects the merchant, not you. If a thief uses your card number and the merchant didn't ask for the CVC, the merchant often eats the loss. If the merchant did ask for the CVC and the thief couldn't provide it, the merchant is protected. This is why the CVC requirement has become standard.

The CVC does not prevent someone from charging your account if they have your full card number, expiration date, and CVC. If all three pieces of information are compromised, a thief can make online purchases. Your protection against unauthorized charges comes from your card issuer's fraud monitoring and your right to dispute charges — not from the CVC itself.

When it's safe to share your CVC, and when it's not

It is safe to share your CVC with a merchant you're actively paying — a website checkout, a phone order, a mail-order form. The merchant needs it to process your payment.

It is not safe to share your CVC in any other situation. Legitimate companies — your bank, the credit card issuer, the IRS, your utility company — will never ask for your CVC by email, text, or unsolicited phone call. If someone contacts you asking for it, hang up or delete the message. This is a common phishing tactic.

Do not write your CVC on the back of a check or include it in an email. Do not give it to someone who calls claiming to verify your account. Do not enter it on a website unless you initiated the transaction and you recognize the merchant.

What happens if your CVC is compromised

If your CVC is exposed in a data breach or you suspect someone has it, you don't need to do anything immediately. The CVC alone is useless without your card number and expiration date. But if all three pieces of information are compromised, a thief could make online purchases.

If you notice unauthorized charges on your card, contact your issuer right away. Report the fraudulent transactions and ask them to cancel the card and issue a replacement. Your issuer will investigate the charges and typically remove them from your account within a few days to a few weeks, depending on the card issuer's process.

You are not responsible for fraudulent charges if you report them promptly. Federal law limits your liability to $50 if someone uses your card without permission, and most card issuers waive even that $50 if you report the fraud quickly.

CVC vs. CVV vs. CID: what the different names mean

Different card networks use different names for the same thing. Visa calls it the CVV (Card Verification Value). Mastercard also calls it the CVV. American Express calls it the CID (Card Identification Number). Discover calls it the CID as well.

All of these are the same concept: a three- or four-digit security code printed on the card that merchants use to verify you have the physical card. When someone says "CVC," they usually mean any of these codes, regardless of which network issued your card. The term CVC has become the catch-all phrase.

For practical purposes, you can treat them as interchangeable. When a checkout form asks for your "CVV" or "security code" or "CVC," it's asking for the same number.

Why the CVC is printed, not hidden

You might wonder why the CVC is printed on the card where anyone can see it, rather than hidden like your PIN. The answer is practical: the CVC is meant to be shared with merchants during a transaction. Your PIN is meant to stay secret forever.

The CVC works because it's only useful for online and phone purchases. In a physical store, you don't give your CVC to anyone — the card reader reads the chip or stripe, and you enter your PIN. A thief who steals your card number from a website can't use it in a store because they don't have the physical card to insert or swipe. Online, the CVC is the merchant's way of confirming you have the card.

This is also why the CVC changes when you get a replacement card. Each card has its own unique CVC. If your old card number is compromised, the CVC on that card is useless once you get a new card with a new number and new CVC.

Frequently Asked Questions

Can someone use my card number if they don't have the CVC?

They can try, but most online merchants will decline the transaction if the CVC doesn't match. In-store purchases don't require a CVC at all — the chip or magnetic stripe is read instead. Phone orders might go through if the merchant doesn't ask for the CVC, though many now require it.

Should I memorize my CVC or write it down?

You don't need to memorize it. Keep your card with you when you shop online or by phone, and read the CVC from the card when the merchant asks. Don't write it down or store it separately from the card. If you need to reference it later, look at the card itself.

What if I enter the wrong CVC by accident?

The transaction will be declined. Check the number on your card and try again. If you keep entering it wrong, the merchant's system may lock you out temporarily as a fraud prevention measure. Wait a few minutes and try once more, or contact the merchant's customer service.

Does the CVC protect me from identity theft?

No. The CVC protects the merchant from fraud losses, not you. Your protection against unauthorized charges comes from your card issuer's fraud monitoring and your right to dispute charges. If someone has your full card information including the CVC, they can make online purchases, and you'll need to report them as fraudulent.

Can I use my card online without giving the CVC?

Some merchants don't require it, but most do. If a merchant doesn't ask for the CVC, they're taking on more fraud risk themselves. You can't force a merchant to accept your card without the CVC — it's their choice whether to require it.