CVV stands for Card Verification Value, a three- or four-digit security code printed on your card
The CVV (Card Verification Value) is a short number on the back or front of your credit card that proves you physically have the card in your hand. It's not stored in the card's magnetic stripe or chip, which is why it's useful for online and phone purchases where the seller can't swipe your card themselves. Visa and Mastercard call it CVV; American Express calls it CVC (Card Verification Code), but they work the same way.
The CVV exists because online fraud is easy — a thief who steals your card number from a data breach or phishing scam may not have the physical card. By asking for the CVV, a merchant confirms that someone with the actual card is making the purchase. It's a simple check, not foolproof, but it catches a lot of casual fraud.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that you must provide for online and phone purchases.
- The CVV is not stored in your card's chip or magnetic stripe, so thieves who steal your card number alone cannot use it without the code.
- Visa and Mastercard print the CVV on the back of the card; American Express prints it on the front.
- Never give your CVV to anyone who calls you or emails you, even if they claim to be from your bank.
Where to find your CVV on your card
On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, to the right of the signature strip. You'll see it after the last four digits of your card number. On American Express, the CVV is a four-digit code printed on the front of the card, above the card number on the right side.
If your card is new or you've requested a replacement, the CVV will be printed on the card itself and also on the envelope or letter that came with it. If you can't find it, call the phone number on the back of your card and ask — your bank can tell you the CVV without sending a new card.
Why merchants ask for your CVV online and by phone
When you buy something online, the merchant's website asks for your CVV because they cannot physically see your card or swipe it. The CVV proves that you have the card right now. The same applies to phone orders — the merchant asks for the CVV to confirm you're the cardholder, not someone who found your card number on a receipt or in a stolen database.
The CVV is sent to the payment processor (the company that handles the transaction between the merchant and your bank), but most merchants are not allowed to store it. This rule, called PCI DSS (Payment Card Industry Data Security Standard), means that even if a hacker breaks into a merchant's database, the CVV won't be there. That's why a thief with your card number but not your CVV will struggle to make online purchases.
CVV is not the same as your PIN
Your PIN (Personal Identification Number) is a four-digit code you create and use at ATMs and in-store chip readers. Your CVV is printed on the card and you don't choose it. They serve different purposes: your PIN protects you at ATMs and in person, while your CVV protects you online and by phone.
If someone has your card number and CVV but not your PIN, they can still make online purchases. If someone has your card number and PIN but not your CVV, they can use the card in a store but not online. Both codes matter, and both should be kept private.
Never share your CVV with anyone who contacts you first
Your bank, your credit card company, and legitimate merchants will never ask you for your CVV by email, text, or phone call. If someone contacts you claiming to be from your bank and asks for your CVV, it is a scam. Hang up or delete the message immediately.
The only time you should enter your CVV is when you are the one initiating the purchase — you're on a website you trust, or you called a merchant's customer service number yourself (not a number they texted you). Even then, make sure the website shows a padlock icon in the address bar and starts with "https://" rather than "http://". That padlock means the connection is encrypted and your CVV won't be intercepted.
What happens if your CVV is compromised
If you believe your CVV has been stolen — for example, because you see fraudulent charges on your statement — contact your bank right away. Your bank can cancel your card and issue a new one with a new CVV. You are not responsible for fraudulent charges if you report them promptly, usually within 60 days of the statement date.
If you gave your CVV to a website that looked legitimate but turned out to be fake, or if you entered it on a site that was later hacked, call your bank immediately. Do not wait to see if charges appear. Your bank can monitor your account and issue a new card before fraud happens.
CVV does not protect you in every situation
The CVV is useful but not a complete shield. A thief who has your card number, CVV, and expiration date can make online purchases at merchants with weak security. Some merchants don't ask for the CVV at all, especially for repeat customers or small purchases. And if someone steals your physical card, they have the CVV and can use it anywhere.
This is why you should also monitor your statements regularly, set up fraud alerts with your bank, and use a strong password on your online banking account. The CVV is one layer of protection, not the only one.
Frequently Asked Questions
Can someone use my credit card online if they have my card number but not my CVV?
Most legitimate online merchants will decline the transaction if the CVV doesn't match. However, some smaller or less secure websites may not check the CVV, so it's possible but less likely. This is why you should monitor your statements and report any unauthorized charges immediately.
Is it safe to give my CVV to a website?
It's safe if the website is legitimate and uses encryption. Look for "https://" in the address bar and a padlock icon. Never enter your CVV on a website you reached by clicking a link in an email or text message — go directly to the merchant's website by typing the address yourself.
What should I do if I accidentally gave my CVV to a scammer?
Call your bank immediately and report what happened. Your bank can cancel your card and issue a new one. Monitor your account closely for the next few months and consider placing a fraud alert with the credit bureaus, which makes it harder for someone to open accounts in your name.
Why does American Express put the CVV on the front instead of the back?
American Express designed their cards differently and placed the CVV on the front for their own security reasons. The location doesn't matter — the function is the same. Always keep it private whether it's on the front or back of your card.
Do I need to memorize my CVV?
No. You only need to look at it when you're making an online or phone purchase. Don't write it down or store it anywhere. If you need it later, you can look at your physical card or call your bank.