The CVC is a three- or four-digit security code printed on your card that proves you physically have it
The CVC (Card Verification Code) is a short number on the back or front of your credit card that acts as a proof-of-possession check. When you enter it during an online or phone purchase, you are telling the merchant "I have this card in my hands right now." The merchant sends that number to your card issuer, who checks whether it matches their records. If it does, the transaction moves forward. If it does not, the purchase is declined.
The CVC exists because online and phone transactions cannot use the magnetic stripe or chip on your card the way an in-person swipe or tap does. Without it, a thief who knows only your card number and expiration date could make purchases without ever touching the physical card. The CVC closes that gap.
Different card networks call this number by different names — Visa and Discover call it CVV (Card Verification Value), while Mastercard calls it CVC and American Express calls it CID (Card Identification). The function is the same across all of them.
Key Takeaways
- The CVC is a three- or four-digit number that proves you have the physical card, not just the card number.
- Visa and Discover call it CVV, Mastercard calls it CVC, and American Express calls it CID — but they all work the same way.
- You should never give your CVC to anyone over the phone or email, and legitimate companies will never ask for it that way.
- The CVC is printed on your card and cannot be changed; if someone has seen it, contact your card issuer and request a new card.
Where to find your CVC on your card
For Visa, Mastercard, and Discover cards, the CVC is a three-digit number printed on the back of the card, to the right of the signature strip. You will see it after the last four digits of your card number are repeated.
American Express cards are different: the four-digit CID appears on the front of the card, above the card number on the right side. If you have an Amex, look there instead of the back.
The number is printed in raised or flat ink — it is not embossed like the card number itself. This matters because it means the CVC was never meant to be readable from a physical imprint. That design choice reinforces its purpose: it should only exist on the card itself and in your card issuer's secure database, nowhere else.
Why merchants ask for it during online checkout
When you buy something online, the merchant's payment system asks for your card number, expiration date, and CVC. The first two pieces of information are printed on the front of your card and are relatively easy to steal — a data breach at a retailer, a photo of your card, or even someone looking over your shoulder can expose them.
The CVC is harder to steal because it is not stored in the magnetic stripe or chip, and it is not printed on receipts. A thief who steals your card number from a database breach cannot use it for online purchases without also having the CVC. This makes the CVC a second checkpoint that catches many fraudulent transactions before they go through.
The merchant never stores your CVC after the transaction is complete. Payment processors are required by law to delete it immediately. This means even if a merchant's database is breached, the CVC is not sitting there waiting to be stolen.
What to do if someone has seen your CVC
If you believe someone has seen or written down your CVC — whether because you shared it accidentally, someone looked over your shoulder, or you are unsure how it was exposed — contact your card issuer right away. You can find the number on your statement or the back of your card.
Tell them you want to report that your CVC may have been compromised. They will issue you a new card with a new CVC. The old card will be deactivated, usually within 24 hours. You will receive the replacement card in the mail within 7 to 10 business days, though some issuers can rush it.
While you wait for the new card, you can still use the old one for in-person purchases at stores where you can use the chip or tap feature. You just should not use it for online or phone transactions. Once the new card arrives, destroy the old one by cutting it in half.
Never give your CVC over the phone or email
Legitimate companies — your bank, your credit card issuer, retailers you trust — will never ask for your CVC over the phone or in an email. This is a hard rule. If someone calls claiming to be from your bank and asks for your CVC, hang up and call your bank directly using the number on the back of your card. If you receive an email asking for it, do not reply and report the email as phishing.
Scammers use phone calls and emails to collect CVCs because they work. They call and say there is fraud on your account, or that they need to verify your identity, and ask you to read the CVC aloud. By the time you realize it was a scam, they have already made purchases or sold the number to someone else.
The only time you should ever enter your CVC is on a secure payment page during checkout — a website where the URL starts with "https://" and you see a padlock icon in the address bar. If you are unsure whether a website is legitimate, do not enter your card information. Close the browser and go directly to the company's official website by typing the address yourself.
How the CVC check actually works behind the scenes
When you enter your CVC during checkout, the merchant's payment processor sends it to your card issuer in an encrypted message. Your issuer checks the number against the CVC they have on file for that card. If it matches, they send back a code saying "yes, this is valid." If it does not match, they send back a code saying "no, decline this transaction."
The merchant sees only the yes-or-no answer, not the actual CVC. This is by design. The fewer places your CVC travels and the fewer systems that touch it, the safer it is.
This check happens in seconds, which is why you see an instant approval or decline at checkout. It is also why a stolen card number without the CVC will usually fail at the online payment step — the thief cannot pass the CVC check without having the physical card or having seen the number somewhere.
CVC is not the same as your PIN
Your PIN (Personal Identification Number) is a four-digit code you create and use at ATMs and in-store chip readers. Your CVC is a three- or four-digit code printed on your card that you do not choose and cannot change. They serve different purposes and are checked in different ways.
Your PIN is stored in encrypted form in your card's chip and in your issuer's system. Only you should know it. Your CVC is printed on the card itself and is checked against your issuer's records during online transactions. You should never have to enter your PIN online.
If someone asks for your PIN over the phone or email, that is a scam. Hang up or delete the message. Your bank will never ask for your PIN that way.
Frequently Asked Questions
Can I use my card online without entering the CVC?
Most online retailers require the CVC as part of their payment process, so you will need to enter it. Some subscription services or saved payment profiles may not ask for it on repeat purchases, but the first time you add a card, you almost always have to provide it. If a website does not ask for a CVC, that is a sign the payment system may not be secure — proceed with caution.
What if I enter the wrong CVC by accident?
The payment will be declined. You can try again with the correct number. Entering the wrong CVC a few times will not lock your card or trigger fraud alerts. If you keep getting declined and you are sure the number is correct, contact your card issuer — there may be a technical issue on their end.
Is my CVC the same as the three-digit number on my receipt?
No. Your receipt shows the last four digits of your card number, not your CVC. Your CVC never appears on receipts, statements, or any document you receive. If you see a three-digit number on a receipt, it is part of your card number, not your security code.
Do I need to memorize my CVC?
You do not need to memorize it, but you should not write it down or store it in your phone or email. Keep it only on the physical card itself. If you need it for an online purchase, look at your card in the moment and enter it. This way, if your card is lost or stolen, the CVC is not floating around in a notebook or a digital file.
Can someone use my card number without the CVC?
They can try, but most online merchants will decline the transaction if the CVC is missing or wrong. In-person purchases do not require a CVC, so a thief with just your card number could potentially make in-person purchases if they had a physical card or a cloned version. This is why the CVC is important — it adds a layer of protection for online transactions specifically.