Your CVV is a three- or four-digit security code printed on your card, separate from your card number
The CVV (Card Verification Value) is a short number on the back of your credit card that exists only to prove you physically hold the card. Visa and Mastercard call it CVV2; American Express calls it CID and prints it on the front. It is not encoded in the magnetic stripe or chip — it lives only on the card itself and in your card issuer's records.
When you enter your card number online or over the phone, the merchant cannot see your CVV. You type it separately. That separation is the whole point: a thief who steals your card number from a database still cannot complete a purchase without the CVV, because they do not have the physical card.
The CVV changes every time your card is reissued. If your card expires or your issuer sends you a replacement, the new card has a new CVV. This is why a CVV from an old card statement is useless for fraud.
Key Takeaways
- Your CVV is a three- or four-digit code printed on your card that proves you physically hold it when you make online or phone purchases.
- Visa and Mastercard print the CVV on the back of the card; American Express prints it on the front.
- Never give your CVV to anyone who calls you or emails you, even if they claim to be from your bank.
- Merchants are not allowed to store your CVV after a transaction, so if you see it saved in your account, report it to the card issuer immediately.
- A CVV protects you against fraud when your card number is compromised, because a thief cannot use the number alone.
Where the CVV appears on different card types
On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express, it is a four-digit number printed on the front, above the card number on the right side.
Discover cards also use a three-digit CVV on the back. If you have an older card or a specialty card from a smaller issuer, check the back first; if it is not there, look at the front near the card number.
The CVV is always printed in a different color or font than the rest of the card, making it visually distinct. This is intentional — it signals that this number is separate from your account number and has a different purpose.
Why merchants ask for your CVV online and over the phone
When you buy something online, the merchant's payment system asks for your CVV to verify that you have the physical card. The merchant sends your card number, expiration date, and CVV to the payment processor, which checks the CVV against the issuer's records. If it matches, the transaction is approved. If it does not, the transaction is declined.
Over the phone, a merchant or customer service representative may ask for your CVV for the same reason — to confirm you are the cardholder. This is standard practice for phone orders, subscription renewals, and customer service calls where you need to verify your identity.
The CVV is not stored after the transaction. Payment Card Industry (PCI) rules forbid merchants from keeping it in their system. If you see your CVV saved in an online account or in a confirmation email, that is a violation of PCI standards and you should contact your card issuer to report it.
How CVV fraud happens and how you are protected
CVV fraud occurs when a thief has your card number but not the physical card. They might have stolen your number from a data breach, a skimmed ATM, or a compromised website. Without the CVV, they cannot complete an online purchase or a phone order. They can only use the card number at a gas pump or ATM, where no CVV is required.
This is why the CVV exists: it is a barrier between your card number and actual fraud. A stolen card number alone is much less useful than a stolen card number plus CVV. The CVV protects you in situations where your number has been exposed but your physical card has not.
If someone uses your card number fraudulently, your issuer will investigate and typically reverse the charge. You are not liable for unauthorized transactions on a credit card. However, you still need to report the fraud quickly — call the number on the back of your card as soon as you notice an unauthorized charge.
Never share your CVV with anyone who contacts you
Your bank, credit card company, and legitimate merchants will never ask for your CVV by phone, email, or text message. If someone contacts you claiming to be from your card issuer and asks for your CVV, it is a scam. Hang up or delete the message immediately.
Scammers use urgency and authority to pressure you into giving up the number. They might say your account has been compromised, your card is about to be frozen, or you need to verify your identity immediately. None of this changes the rule: your issuer already has your CVV on file and has no reason to ask you for it.
The only time you should enter your CVV is when you are initiating a transaction yourself — typing it into a website you chose to visit, or reading it over the phone to a merchant you called. If anyone else asks for it, assume it is fraud.
What happens if your CVV is compromised
If your CVV has been exposed in a data breach or you suspect someone has it, contact your card issuer immediately. They can reissue your card with a new number and a new CVV. The old CVV will no longer work, even if someone has your card number.
You do not need to wait for fraudulent charges to appear. If you know your CVV has been compromised, call the number on the back of your card and ask for a replacement card. Most issuers can mail a new card within 5 to 10 business days, and many offer expedited shipping for a fee.
While you wait for the new card, you can still use your current card for in-person purchases at stores and ATMs. The CVV is only needed for online and phone transactions, so your card remains usable for everyday spending.
CVV and card security: what you should know
The CVV is one layer of fraud protection, not the only one. Modern payment systems also use address verification (checking that your billing address matches what you entered), 3D Secure (a password or one-time code sent to your phone), and fraud detection algorithms that flag unusual purchases.
For in-person purchases, your card uses a chip or magnetic stripe, which is encrypted differently than online transactions. The chip is harder to counterfeit than the stripe, which is why many merchants now require chip readers instead of swipe machines.
Your card issuer also monitors your account for suspicious activity. If you make a purchase that does not match your usual spending pattern, they may decline it or call you to confirm. This is a feature, not a bug — it catches fraud before it becomes a problem.
Frequently Asked Questions
Can someone use my card number without the CVV?
Yes, but only in situations where the CVV is not required. Gas pumps, ATMs, and some older payment systems do not ask for it. For online shopping and phone orders, a CVV is almost always required. If your card number is stolen, the thief's options are limited without the CVV.
Is it safe to save my CVV in my browser or online account?
No. Merchants are not allowed to store your CVV, and neither should you. If a website offers to save it for faster checkout, decline. If you see your CVV stored anywhere, contact your card issuer and the website to report it. Use your browser's built-in payment tools instead, which store card data securely.
What if I give my CVV to a scammer?
Contact your card issuer immediately. Ask them to cancel your card and issue a replacement with a new CVV. Monitor your account for unauthorized charges. You are not liable for fraud on a credit card, but the faster you report it, the faster your issuer can protect your account.
Do I need to memorize my CVV?
No. You only need to know where to find it on your card when you are making a purchase. Do not write it down or store it anywhere. If you need it, look at your physical card.
Why does American Express print the CVV on the front instead of the back?
American Express designed their cards differently and has always printed the four-digit CID on the front. The placement does not make it less secure — the principle is the same. The number is still separate from your account number and still proves you have the physical card.