CVV stands for Card Verification Value
CVV is a three- or four-digit security code printed on your credit card. The acronym stands for Card Verification Value. Visa and Mastercard call it CVV2; American Express calls it CID (Card Identification). The number is not encoded in the magnetic stripe or chip — it is printed only on the physical card itself, which means a merchant who has only your card number cannot process a transaction without it.
The CVV exists to prove you have the actual card in your hand. When you enter it during an online purchase or over the phone, you are confirming to the merchant and the card network that you possess the card. A thief who steals your card number from a data breach cannot complete most online transactions without also knowing this three-digit code.
The CVV is different from your PIN, which you use at an ATM or in-person at a store. Your PIN is encrypted and stored by your bank. Your CVV is not stored anywhere after the transaction — the merchant sees it once and then it is gone from their system.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically possess it during online or phone purchases.
- Visa and Mastercard cards have a three-digit CVV on the back; American Express cards have a four-digit code on the front.
- Merchants do not store your CVV after a transaction, so a stolen card number alone cannot be used for online purchases without it.
- Never share your CVV with anyone who contacts you by phone or email, as legitimate companies will never ask for it outside a payment screen.
Where the CVV appears on your card
On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature panel. It is the last three digits of a longer number that appears in that area. On American Express, the four-digit code appears on the front of the card, above the card number on the right side.
The CVV is always printed in a different color or style than the rest of the card design, making it stand out. This placement — on the back for Visa and Mastercard, on the front for Amex — is intentional. It means the code is not visible when someone looks at the front of your card lying on a table, reducing the risk of casual observation.
How merchants use the CVV during a transaction
When you enter your CVV at an online checkout or read it over the phone to a merchant, that number travels to the card network (Visa, Mastercard, or American Express) for verification. The network checks that the CVV you provided matches the one on file for that card. If it matches, the transaction moves forward. If it does not match, the transaction is declined.
The merchant never stores the CVV in their system. Payment processors and card networks are required by law not to retain it after the transaction completes. This is why a merchant cannot charge your card again later using only the CVV — they have no record of it. If they want to charge you again, they must ask for the full card number and expiration date, or use a token (a unique identifier created during your first transaction).
This one-time-use design is what makes the CVV effective against fraud. A criminal who obtains your card number from a stolen database cannot use it for online shopping without also guessing or obtaining your CVV. The odds of guessing a three-digit code are low, and most payment systems lock the card after a small number of failed attempts.
CVV versus other card security features
Your card has multiple layers of security, and the CVV is one of them. Your card number itself is a 16-digit identifier (15 for American Express) that includes a check digit — a mathematical formula that detects if someone has typed or transmitted the number incorrectly. Your expiration date is another piece of information a merchant needs, though it is visible on the front of the card.
The chip embedded in modern cards (also called EMV) is a separate security system. When you insert your card into a reader at a store, the chip creates a unique code for that specific transaction. That code cannot be reused, so even if a criminal intercepts it, they cannot use it to make another purchase. The chip is more secure than the magnetic stripe, which is why many merchants now require chip readers.
The CVV protects online and phone transactions where the merchant cannot read your chip or see your card in person. It is a weaker form of verification than the chip, but it is the standard for remote purchases. Some card networks are moving toward stronger methods like 3D Secure (a password or biometric confirmation), but CVV remains the baseline.
What to do if your CVV is compromised
If you believe someone has seen or obtained your CVV, you do not need to panic or immediately cancel your card. The CVV alone is not enough to make a purchase — a criminal would also need your card number and expiration date. However, if you have shared your CVV with someone you do not trust, or if you entered it on a website that looked suspicious, contact your card issuer.
Your card issuer can issue you a new card with a new CVV. This is a simple process and usually takes five to ten business days. You can request a replacement card by calling the number on the back of your card or logging into your online account. There is no charge for a replacement card due to security concerns.
If you notice fraudulent charges on your account, report them to your card issuer immediately. Most card networks offer fraud protection that limits your liability to $50 or zero, depending on when you report the fraud. The sooner you report it, the faster the investigation moves.
Never share your CVV outside a payment screen
A legitimate merchant, bank, or card network will never ask you to provide your CVV by phone, email, or text message. If someone contacts you claiming to be from your bank or a store and asks for your CVV, that is a scam. Hang up or delete the message.
The only time you should enter your CVV is on a secure payment page — a website checkout, a phone call you initiated to a merchant, or an app's payment screen. Even then, verify that you are on the correct website by checking the URL in your browser. Scammers create fake websites that look identical to real ones, and entering your CVV there puts your card at risk.
If you are unsure whether a request is legitimate, hang up and call the merchant or your bank directly using the number on your card or statement. Do not use a phone number provided by the person who contacted you, as that number may belong to the scammer.
Frequently Asked Questions
Can someone use my card if they have my card number but not my CVV?
Not for most online purchases. A merchant cannot complete an online transaction without the CVV. However, if someone has your card number and expiration date, they may be able to make a purchase in person at a store that does not require a chip reader or signature, or they could attempt a phone order. Report any unauthorized charges to your card issuer immediately.
Is it safe to save my CVV on a website for faster checkout?
No. Websites are not supposed to store CVV numbers, and if a website offers to save it, that is a red flag. Reputable payment processors like PayPal, Apple Pay, and Amazon Pay do not store CVV. They store a token instead, which is a unique code that lets them charge your card without keeping the CVV on file.
What if I enter the wrong CVV?
The transaction will be declined. You can try again with the correct code. Most payment systems allow three to five attempts before locking the card temporarily as a fraud prevention measure. If you are locked out, wait a few minutes and try again, or contact your card issuer.
Do debit cards have a CVV?
Yes. Debit cards issued by Visa or Mastercard have a CVV on the back, just like credit cards. The CVV works the same way — it is required for online purchases and protects against fraud. American Express debit cards have a four-digit code on the front.
Can I use my card online without a CVV?
Most online merchants require a CVV. Some older or less secure websites may not ask for it, but that is unusual and often a sign the site is not using modern security standards. Avoid entering your card number on any website that does not ask for a CVV, as it may not be protecting your information properly.