CVV is the three- or four-digit security code on your credit card
CVV stands for Card Verification Value. It is a number printed on your card — not encoded in the magnetic stripe or chip — that exists only to prove you physically hold the card when you make a purchase online or over the phone. The card issuer never stores it in their system, and merchants are not supposed to keep it after a transaction completes.
The code lives in different places depending on your card type. On Visa, Mastercard, and Discover cards, it is a three-digit number on the back, usually printed to the right of the signature panel. American Express puts a four-digit code on the front, above the account number on the right side.
The CVV is not the same as your PIN (the number you enter at an ATM or payment terminal). Your PIN is encrypted and stored by your bank. Your CVV is temporary proof of possession — it should never be stored anywhere after the transaction ends.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically have it when paying online or by phone.
- Visa, Mastercard, and Discover show the CVV on the back; American Express shows it on the front.
- Merchants and payment processors are required to delete the CVV after each transaction and never store it in their systems.
- Giving your CVV to someone you do not trust, or entering it on an unsecured website, puts your card at risk of fraud.
- A legitimate company will never ask you to provide your CVV by email, text, or phone call.
Why merchants ask for the CVV during online and phone purchases
When you swipe or insert your card in person, the merchant can see you have the physical card. Online and over the phone, they cannot. The CVV is the merchant's way of confirming that the person making the purchase has the card in hand right now.
The payment processor checks the CVV against the one on file with your bank. If it matches, the transaction moves forward. If it does not match — because someone is using a stolen card number but does not have the actual card — the processor can decline the sale. This is why a thief who has only your card number cannot complete most online purchases without the CVV.
The CVV also protects you. If someone uses your card number fraudulently and the merchant failed to ask for the CVV, your bank may hold the merchant liable for the loss instead of you. Merchants know this, which is why the major card networks require them to request it.
Where the CVV appears on different card types
| Card Network | CVV Location | Number of Digits |
|---|---|---|
| Visa | Back of card, right of signature panel | 3 |
| Mastercard | Back of card, right of signature panel | 3 |
| Discover | Back of card, right of signature panel | 3 |
| American Express | Front of card, above account number on right | 4 |
If you cannot find the CVV on your card, check both sides carefully. On Visa, Mastercard, and Discover, it is always on the back. On American Express, it is always on the front. If your card is damaged or the number is worn away, contact your card issuer and request a replacement.
What to do if someone asks for your CVV in an unsafe way
A legitimate company — your bank, a retailer, a utility company — will never ask you to provide your CVV by email, text message, or phone call. If someone contacts you claiming to be from your bank and asks for this number, it is a scam. Hang up or delete the message immediately.
Your bank already has your card on file. They do not need you to tell them the CVV. The only time you should enter or speak your CVV aloud is when you are the one initiating the purchase — you are buying something from a merchant you chose, on a website you navigated to yourself, or by calling a phone number you looked up independently.
If you have given your CVV to someone who contacted you, or if you entered it on a website that looked suspicious, contact your card issuer right away. They can cancel your card and issue a replacement. The faster you report it, the faster they can watch for fraudulent charges.
How to protect your CVV when shopping online
Before you enter your CVV on any website, check that the connection is secure. The web address should start with https:// (not http://), and there should be a small padlock icon in the address bar. These indicate the website is using encryption to protect your information in transit.
Never save your CVV in your browser, in a password manager, or in a note on your phone. Some payment systems offer to remember your card for future purchases, but they should never store the CVV itself — only the card number and expiration date. If a website offers to save your CVV, that is a red flag.
Use a credit card rather than a debit card for online purchases when possible. Credit cards offer stronger fraud protection by law, and fraudulent charges do not come directly out of your bank account while the dispute is being investigated.
CVV is not the same as other card security features
Your card has several security layers, and the CVV is just one. Your card number itself is a 16-digit code (15 for American Express) that identifies your account. Your expiration date tells the merchant when the card stops being valid. Your name is printed on the front so the merchant can confirm it matches your ID if you are paying in person.
The chip on modern cards (also called EMV) is a microprocessor that creates a unique code for each transaction, making it nearly impossible to clone. The magnetic stripe on the back is older technology and easier to counterfeit, which is why chip and contactless payments are more secure. The CVV does not replace any of these — it works alongside them.
Your PIN is different from your CVV. You create your PIN and change it yourself. It is encrypted and stored by your bank. The CVV is printed by the card issuer and is not something you choose or change. You should never share your PIN with anyone, just as you should never share your CVV.
What happens if your card is lost or stolen
If your physical card goes missing, call your card issuer immediately. They will cancel the card and send you a replacement. The old card's CVV becomes useless because the card itself is no longer valid — even if a thief has the number, they cannot use it without the card in hand for in-person transactions, and online merchants will reject it because the card has been deactivated in the system.
If only your card number and CVV are compromised — for example, through a data breach at a retailer — your card issuer can issue a new card with a new number and a new CVV. This is why monitoring your statements matters. If you spot a charge you did not make, report it to your bank within 60 days to dispute it.
You do not have to pay for fraudulent charges on a credit card. By law, your liability is capped at $50, and most card issuers waive even that if you report the fraud promptly. Debit card fraud is different and carries more risk to your bank account, which is another reason credit cards are safer for online shopping.
Frequently Asked Questions
Can someone use my credit card without the CVV?
Not for most online purchases. A thief with only your card number and expiration date cannot complete a transaction on most websites because the merchant will ask for the CVV. In-person fraud is possible if the thief has a physical card, but that requires stealing the card itself, not just the number.
Is it safe to give my CVV to a website I have never used before?
Only if the website is secure (https:// and a padlock icon) and is a legitimate business. Check the website's privacy policy and look for contact information. If something feels off — poor grammar, no phone number, no physical address — do not enter your card. Use a credit card rather than a debit card so you have stronger fraud protection.
What if I accidentally told someone my CVV?
Contact your card issuer immediately. They can cancel your card and issue a replacement. Watch your statements closely for the next few months. If you see any charges you did not make, report them to your bank within 60 days to dispute them.
Do I need to memorize my CVV?
No. You only need to know it when you are making a purchase. It is printed on your card, so you can look at it each time. Never write it down or store it anywhere. The only exception is if you use a payment service that securely stores your card information — but even then, the service should not store the CVV itself.
Why does American Express have a four-digit CVV instead of three?
American Express uses a different card format and security system than Visa, Mastercard, and Discover. The four-digit code provides the same function — proof that you have the physical card — but uses a different algorithm. Both three-digit and four-digit codes work the same way from a fraud-prevention standpoint.