CVV is the three- or four-digit security code on the back of your card
CVV stands for Card Verification Value. It's a number printed on your credit card — usually on the back, near your signature — that exists only to prove you physically have the card when you're making a purchase. The card issuer never stores it in their system, and you should never type it into a website you don't trust.
The CVV is not the same as your PIN (the number you enter at an ATM or checkout terminal). It's also not your card number. It's a separate piece of information that sits between you and the merchant as a basic anti-fraud layer.
American Express calls theirs the CID (Card Identification Number) and prints it on the front of the card in four digits. Visa, Mastercard, and Discover call theirs the CVV2, CVV, or CVC and print it on the back in three digits. The function is identical.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically have it when making online or phone purchases.
- The CVV is never stored by your bank or the merchant, so a hacker who steals your card number alone cannot use it without the CVV.
- You should only enter your CVV on secure websites (those with "https://" in the address) or when speaking directly to a merchant you trust.
- If someone asks for your CVV in person, by email, or by unsolicited phone call, it is a scam — legitimate merchants never ask for it that way.
Why the CVV exists and what it protects against
The CVV was created to stop a specific type of fraud: someone stealing your card number (either from a receipt, a data breach, or by skimming a card reader) and then using that number to make purchases online or over the phone without ever holding the physical card.
If a thief has only your card number and expiration date, they cannot complete a transaction on most websites because the system will ask for the CVV. They would need to have the card itself, or know the three-digit code on the back — which is much harder to obtain remotely.
This is why the CVV is printed on the card but never stored in the merchant's database. Your bank knows it, your card issuer knows it, but the store where you shop does not keep a record of it. If that store's database is hacked, the thief gets your number and expiration date but not the CVV.
When you need to provide your CVV
You'll be asked for your CVV in these situations: online shopping (when you enter your card details into a website), phone orders (when you're reading your card number to a customer service representative), and some in-person transactions at gas pumps or ATMs (where you may be asked to enter it on a keypad).
You should never be asked for your CVV in person at a checkout counter. If a cashier asks you to read it aloud or show them the back of your card, that is unusual and a sign something is wrong. Legitimate point-of-sale terminals do not require the CVV for in-person transactions.
You should also never be asked for your CVV by email, text message, or unsolicited phone call. Your bank will never contact you asking for this information. If someone calls claiming to be from your card issuer and asks for your CVV, hang up and call the number on the back of your card instead.
How to protect your CVV from theft
The simplest protection is to keep your card in your wallet and out of sight. Don't leave receipts lying around — they may show the last four digits of your card number, and a thief who sees your card in person can read the CVV directly off the back.
When shopping online, only enter your CVV on websites that use encryption. Look for "https://" at the start of the web address (not just "http://"), and look for a small padlock icon in the address bar. These signs mean the website is encrypted and your information is being sent securely.
If you're shopping on a website you don't recognize or trust, consider using a virtual card number instead. Many banks and card issuers offer this feature — it generates a temporary card number that works only once or for a single merchant, so even if it's stolen, it cannot be used elsewhere.
Never save your CVV in your browser or in a password manager. Some websites will ask if you want to save your card for next time — this is convenient, but it means your full card information is stored on their server. If you do this, at minimum make sure the website is one you trust completely.
What happens if your CVV is compromised
If you believe your CVV has been stolen — for example, because you entered it on a fraudulent website or gave it to someone you later realized was a scammer — contact your card issuer immediately. You can find the number on the back of your card or on your monthly statement.
Your bank can issue you a new card with a new CVV. This usually takes five to ten business days. In the meantime, monitor your account for unauthorized charges. Most card issuers will reverse fraudulent transactions, though the process can take a few weeks.
You are not responsible for fraudulent charges made with your card, even if the thief had your CVV. Federal law limits your liability to $50 if you report the fraud promptly, and most major issuers have zero-fraud policies that cover you completely.
CVV versus other card security features
The CVV is one layer of protection, but it's not the only one. Your card also has a chip (the small metal square on the front), which creates a unique code for each transaction and is much harder to counterfeit than the magnetic stripe on the back. If you're shopping in person, always insert your card into the chip reader rather than swiping it.
Your card issuer also monitors your account for unusual activity. If you suddenly make a large purchase in a different state or country, your bank may flag it and call you to confirm. This is called fraud monitoring, and it catches many fraudulent transactions before they're completed.
Online merchants also use address verification (checking that the billing address you enter matches what's on file) and other tools to reduce fraud. The CVV is just one piece of a larger system designed to keep your card safe.
Frequently Asked Questions
Is the CVV the same as my PIN?
No. Your PIN is a number you create and memorize, used at ATMs and checkout terminals. Your CVV is printed on the card and used for online and phone purchases. They serve different purposes and are completely separate.
Can someone use my card if they have the number and CVV but not the card itself?
Yes, they can make online and phone purchases. This is why you should never share your CVV with anyone, and why you should only enter it on secure websites you trust. In-person purchases require the physical card.
What should I do if I accidentally gave my CVV to a scammer?
Call your card issuer immediately using the number on the back of your card. Ask them to issue you a new card with a new CVV. Monitor your account for unauthorized charges and report any you find. You are protected by federal law and your issuer's fraud policy.
Why do some websites ask for my CVV but others don't?
It depends on the merchant's fraud prevention system and the type of transaction. Some merchants have other ways of verifying you (like address verification), while others rely more heavily on the CVV. Legitimate merchants will always ask for it on their checkout page if they need it.
Is it safe to save my card information on a website?
It's convenient but carries a small risk. If that website is hacked, your information could be stolen. Only save your card on websites you trust completely and use regularly. Never save your card on a website you've never used before or don't recognize.