CVV is the three- or four-digit security code on the back of your card
CVV stands for Card Verification Value. It is a number printed on your credit card — usually on the back, near your signature — that exists only to prove you physically have the card when you are making a purchase. The code is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online or over the phone.
Visa and Mastercard call this code CVV2. American Express calls it CID and prints it on the front of the card, above the account number. Discover calls it CID as well. The length varies: Visa, Mastercard, and Discover use three digits; American Express uses four. When someone asks for your CVV, they are asking for whichever code your specific card carries.
The CVV is a security layer, not a may provide. It reduces the risk that someone using a stolen card number can complete a transaction, but it does not prevent fraud entirely. If your card is physically stolen, the thief has both the number and the CVV. If your card number is breached in a data theft, the CVV is usually not included in what the thief obtains — which is why merchants ask for it separately during checkout.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically possess it; Visa, Mastercard, and Discover use three digits, while American Express uses four.
- The CVV is not stored in your card's magnetic stripe or chip, so a thief with only your card number cannot use it for online or phone purchases.
- You should never share your CVV with anyone except a merchant you are actively paying, and legitimate companies will never ask for it via email, text, or phone.
- If your CVV is compromised, contact your card issuer immediately; they can issue a new card with a new CVV without changing your account number.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is printed on the back of the card in the signature panel — the white or light-colored strip on the back right side. It appears after the last four digits of your account number and is usually the last three digits you see on that panel.
On American Express cards, the CVV (called CID on Amex) is printed on the front of the card, above and to the right of your account number. It is four digits instead of three. This placement is different from other card networks, so if you are entering your Amex CVV online and the form asks for three digits, you may have the wrong field selected.
The CVV is always printed, never embossed or raised like your account number. This matters because embossed numbers can be read by touch or copied by rubbing, but a printed CVV cannot. The printing-only approach is intentional: it makes the code harder to steal through physical contact or simple copying.
Why merchants ask for your CVV
A merchant asks for your CVV to confirm that you have the physical card in your possession at the moment of purchase. When you enter your CVV during an online checkout or over the phone, the merchant sends it to your card issuer, who checks whether it matches the CVV on file. If it does not match, the transaction is declined.
This check happens in real time, in the background, and you usually do not see it. The merchant never stores your CVV — payment processors are required by law not to keep it after the transaction completes. This is why a thief who steals a merchant's database of card numbers does not also get the CVV: the CVV was never saved there in the first place.
The CVV is most commonly requested during card-not-present transactions: online shopping, phone orders, or mail orders. In-person transactions at a physical store do not require a CVV because the cashier can see your card and verify your identity through your signature or ID. Some merchants also ask for CVV during recurring billing setups, such as subscription services or automatic bill payments.
What to do if someone asks for your CVV in a suspicious way
Never give your CVV to anyone who contacts you first — not by phone, email, text, or social media. Your card issuer already has your CVV on file and will never ask you for it. If someone claiming to be from your bank or card company calls and asks for your CVV, hang up and call the number on the back of your card to report the contact.
Legitimate merchants only ask for your CVV during checkout, when you are the one initiating the purchase. If a company sends you an email asking you to "verify your card information" by replying with your CVV, that is a phishing attempt. Do not respond. Instead, log into your account directly through the company's website (not through a link in the email) to check whether there is a real issue.
If you have given your CVV to someone you did not intend to, or if you suspect your card information has been compromised, contact your card issuer immediately. Most issuers have a fraud line listed on the back of your card. They can cancel your current card and issue a replacement with a new CVV within one to two business days, often with a temporary card number for urgent purchases.
How CVV differs from other card security features
Your card has several security layers, and CVV is only one. Your account number is the primary identifier; your expiration date tells the merchant when the card expires; your name links the card to you. The CVV is different because it is not encoded in the card's magnetic stripe or chip — it exists only in printed form on the physical card and in your issuer's records.
Chip technology (EMV) adds another layer by creating a unique code for each transaction, making it harder to clone a card. But the chip does not replace the CVV. Online and phone purchases still rely on CVV because the merchant cannot read the chip remotely. The CVV and chip work together: the chip protects in-person transactions, and the CVV protects remote ones.
Your PIN (Personal Identification Number) is different again. You create your PIN, you keep it secret, and you enter it at an ATM or in-person at a store when you use debit. The CVV is printed on your card and you share it with merchants. A PIN is for your protection; a CVV is for the merchant's protection, to confirm you have the card.
What happens if your CVV is compromised
If your CVV has been exposed — for example, you gave it to a scammer or a website was breached — your card issuer can issue a new card with a new CVV. This is a straightforward process and does not change your account number, so you do not have to update automatic payments or recurring subscriptions unless you want to.
A new card typically arrives within five to seven business days. Many issuers offer a temporary card number or expedited shipping if you need to make purchases before the physical card arrives. Some also offer a virtual card number that you can use online immediately while you wait for the physical card.
The old CVV becomes invalid as soon as the new card is issued. Any merchant or scammer holding the old CVV cannot use it, because it no longer matches the card on file at your issuer. This is why replacing your card is an effective response to CVV exposure — it is not just a precaution, it is a reset.
Frequently Asked Questions
Can someone use my card if they have my number but not my CVV?
They can attempt to, but most online and phone merchants will decline the transaction if the CVV does not match. In-person transactions do not require a CVV, so a thief with a physical card can use it at a store. If only your number is stolen, the thief cannot easily complete remote purchases, which is why the CVV exists.
Is it safe to enter my CVV on a website?
Yes, if the website is legitimate and uses encryption. Look for a padlock icon in your browser's address bar and a URL that starts with "https" (not "http"). The merchant should never ask you to enter your CVV in an email or text message. If you are unsure whether a website is real, call the company directly using a number from their official website or a bill you received.
What if I lost my card and someone finds it?
Call your card issuer immediately using the number on your account statement or the back of another card you have. They will cancel the card and issue a replacement. The finder can see your CVV, but they cannot use it online without your account number and expiration date, and they cannot use it in-person without your signature or ID. Report the loss as soon as you notice it.
Do I need to memorize my CVV?
No. You only need to enter it when you are making a purchase. Do not write it down or store it anywhere. If you need it, look at your physical card. Memorizing it serves no purpose and creates an unnecessary security risk if someone gains access to your devices or notes.
Why does American Express put the CVV on the front instead of the back?
American Express designed their cards this way decades ago, before the CVV became a standard security feature across all card networks. The front placement does not make it less secure — the CVV still is not stored in the chip or stripe, and it still proves you have the physical card. It is simply a different design choice that Amex has kept consistent.