CVV is the three- or four-digit security code on your card
CVV stands for Card Verification Value. It is a number printed on your credit card — not embedded in the chip or magnetic stripe — that exists only to verify you physically hold the card when you make a purchase. The card issuer does not store it in their system the way they store your account number.
On most cards, the CVV is three digits printed on the back, in the signature panel or just above it. American Express cards have a four-digit CVV printed on the front, above the account number. Visa, Mastercard, and Discover all use the three-digit version on the back.
The CVV serves one purpose: to reduce fraud on transactions where the merchant cannot physically inspect your card. When you buy something online, over the phone, or by mail, the merchant asks for the CVV. If the number matches what the card issuer has on file, the transaction is more likely to be legitimate.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically possess it; Visa, Mastercard, and Discover use three digits on the back, while American Express uses four digits on the front.
- The card issuer does not store the CVV in their main database, so a data breach of account numbers does not expose your CVV.
- You should never give your CVV to anyone who calls you or emails you, even if they claim to represent your bank or card issuer.
- Merchants are not allowed to store your CVV after a transaction completes, so if a website asks you to save it for future purchases, that is a sign of a fraudulent or poorly secured site.
Why the CVV is separate from your account number
The CVV exists because your account number alone is not enough to prove you own the card. Your account number appears on receipts, statements, and anywhere else a merchant might see it. A thief who steals your account number can try to use it online, but without the CVV they cannot complete most transactions.
The card issuer keeps the CVV in a separate system from the account number. This means that if a merchant's database is breached and your account number is stolen, the CVV is not exposed in the same breach. The thief would need to obtain the CVV through a different route — usually by seeing the physical card or by stealing it from a different source.
This separation is why merchants are forbidden from storing your CVV after a transaction is complete. Payment processors and card networks have rules against it. If a website offers to save your CVV so you do not have to enter it next time, that site is either breaking the rules or is not legitimate.
When you need to provide your CVV
You provide your CVV whenever you cannot hand your physical card to the merchant. Online purchases, phone orders, and mail orders all require the CVV. In-person transactions at a store or restaurant do not — the merchant can see and inspect the card itself.
Some subscription services and recurring billing arrangements ask for your CVV when you set up the account. This is normal. The merchant stores your account number and expiration date so they can charge you each month, but they should not store the CVV. When the charge goes through, the payment processor uses the account number and expiration date, not the CVV.
If a merchant asks you to provide your CVV over the phone or email, or if someone claiming to be from your bank asks for it, do not provide it. Your bank will never ask for your CVV. Scammers often call pretending to be from your card issuer and ask for the CVV to "verify your account" or "confirm a suspicious charge." This is always a scam.
How the CVV protects you from fraud
The CVV reduces a specific type of fraud called card-not-present fraud. This happens when someone uses your account number to make a purchase without having the physical card — typically online or by phone. If they have your account number and expiration date but not your CVV, the transaction is more likely to be declined.
The CVV does not protect you from all fraud. If a thief steals your physical card, they have the CVV and can use it. If someone hacks a merchant's website and steals both your account number and CVV from that merchant's database, they have both pieces. But because merchants are not supposed to store the CVV, this is less common than it would be otherwise.
The CVV also does not protect you if someone uses your card information to set up a subscription or recurring charge. Once the merchant has your account number and expiration date, they can charge you repeatedly without the CVV. This is why you should monitor your statements for charges you do not recognize, even from merchants you have done business with before.
What happens if your CVV is compromised
If you believe your CVV has been exposed — for example, because you entered it on a fraudulent website — contact your card issuer immediately. You do not need to wait for fraudulent charges to appear. The issuer can cancel your current card and issue a new one with a new CVV.
A new card means a new CVV, even if the account number stays the same. The issuer will send the new card to your address on file. You can usually request expedited shipping if you need it quickly. Once the new card arrives, the old CVV is no longer valid.
If fraudulent charges have already appeared on your account, report them to your issuer as well. Federal law limits your liability for unauthorized charges to $50 if you report them within 60 days of the statement date. Most card issuers offer zero-liability policies that cover unauthorized charges entirely, but you must report them promptly.
CVV versus other card security features
The CVV is one of several security features on your card. Your account number identifies the account. Your expiration date tells the merchant when the card expires. Your name on the card is used to verify that the person using it is the cardholder. Together, these pieces of information allow a merchant to process a transaction.
Chip technology and contactless payments add another layer. When you insert your chip card into a reader or tap a contactless card, the card generates a unique code for that specific transaction. This code cannot be reused, so even if a thief intercepts it, they cannot use it again. This is why chip and contactless transactions are more secure than swiping a magnetic stripe.
The CVV is not a replacement for these other features — it works alongside them. Online merchants cannot read your chip, so they rely on the CVV. In-person merchants can read your chip, so they do not ask for the CVV. Each method is designed for the situation where it is used.
Frequently Asked Questions
Is my CVV the same as my PIN?
No. Your PIN is a number you create and enter at an ATM or point-of-sale terminal to authorize a transaction. Your CVV is printed on the card and is used for card-not-present transactions. You choose your PIN; the card issuer assigns your CVV. They serve different purposes and are not interchangeable.
Can someone use my card if they have my account number and expiration date but not my CVV?
It depends on the merchant and the transaction type. Most online merchants will decline the transaction if the CVV does not match. Some merchants, particularly those processing recurring charges or in certain industries, may not require the CVV. This is why monitoring your statements is important — you may see charges from merchants you do not recognize.
What should I do if I accidentally shared my CVV with someone?
Contact your card issuer right away and request a new card. Do not wait to see if fraudulent charges appear. The issuer can cancel your current card and send a replacement with a new CVV. If charges do appear before the new card arrives, report them immediately.
Why does my American Express card have a four-digit CVV instead of three?
American Express uses a four-digit code called the CID (Card Identification Data) instead of the three-digit CVV used by Visa, Mastercard, and Discover. The extra digit provides additional security. The function is the same — it verifies you have the physical card — but the format is different.
Can a merchant store my CVV for future purchases?
No. Payment Card Industry standards forbid merchants from storing your CVV after a transaction completes. If a website asks you to save your CVV for next time, that is a violation of the rules and a sign that the site is either fraudulent or poorly secured. You should not use that merchant.