The CVC is a three- or four-digit security code printed on your card that proves you physically have it
The CVC (Card Verification Code) is a number on the back of your credit card — usually three digits, sometimes four on American Express cards — that merchants ask for when you pay online or over the phone. It exists because someone who has only your card number and expiration date cannot complete a transaction without also knowing this code. The merchant never stores it after the transaction, so even if their database gets breached, the CVC stays unknown to the thief.
The code is printed directly on the card itself, not encoded in the magnetic stripe or chip. This means a criminal who steals your card number from a data breach cannot guess it — they would need a photo of your physical card or access to the card issuer's records, which are kept separately from transaction data.
Key Takeaways
- The CVC is a three- or four-digit code on the back of your card that merchants request for online and phone purchases to confirm you have the physical card.
- Merchants are not allowed to store your CVC after a transaction completes, so a data breach of their system does not expose this code.
- The CVC is different from your PIN — your PIN is for ATM withdrawals and in-person debit transactions, while the CVC is for credit card purchases.
- Never share your CVC with anyone who contacts you by phone or email, because legitimate companies will never ask for it outside of a payment screen you initiated.
Where the CVC appears on different card types
On Visa, Mastercard, and Discover cards, the CVC is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express cards, it is a four-digit code printed on the front, above the card number on the right side. The code is always printed in raised or flat text — never embedded in the chip or stripe — so you can see it without any special equipment.
If your card is damaged and the CVC is no longer readable, you can contact your card issuer to request a replacement card. The issuer will mail you a new card with a new CVC. You cannot change the CVC yourself, and it does not change unless you get a new card.
Why merchants ask for it online and by phone
When you enter your card number, expiration date, and CVC on a website or give them to a customer service representative over the phone, the merchant is verifying that you have the physical card in your possession. Without the CVC requirement, someone who found your card number alone could make purchases. The CVC adds a second piece of information that is harder to obtain through a data breach.
In-person transactions at a store or gas pump do not require you to enter the CVC because the card reader can read the chip or stripe, which serves the same verification purpose. The merchant's terminal communicates directly with your card issuer to confirm the transaction is legitimate.
How the CVC differs from your PIN
Your PIN (Personal Identification Number) is a four-digit code you create and memorize for ATM withdrawals and debit card purchases at stores. Your CVC is a fixed code printed on the card that you read and enter when prompted. They serve different purposes: the PIN proves you authorized a debit transaction, while the CVC proves you have the physical credit card.
If someone steals your debit card, they cannot use it at an ATM or in-store without knowing your PIN. If they steal your credit card number but not the physical card, they cannot complete online purchases without the CVC. The two codes protect against different types of fraud.
What happens if you share your CVC with the wrong person
If you give your CVC to someone you do not trust — or to a scammer posing as your bank — they can make online purchases and phone purchases using your card number. They cannot withdraw cash from an ATM or use the card in person, but they can buy goods and services remotely. The damage is limited compared to giving away your PIN, but it is still serious.
Never share your CVC in response to an unsolicited phone call, email, or text message. Your bank and legitimate merchants will never ask for it outside of a payment screen you initiated yourself. If someone claims to be from your card issuer and asks for your CVC, hang up and call the number on the back of your card to report the contact.
How to protect your CVC
Treat your CVC the same way you treat your card number: do not write it down, do not photograph it, and do not share it except on a secure payment page you reached yourself. When you enter it online, make sure the website URL begins with "https://" (the "s" indicates encryption) and that you see a padlock icon in the address bar. These signs mean the page is secure and your information is encrypted in transit.
If you are paying over the phone, call the merchant directly using the number on your receipt or their official website — do not use a number from an email or text message. This ensures you are actually speaking to the company and not a scammer. Cover the CVC on your card with your hand or a piece of paper while you read it aloud, so no one nearby can see the number.
What to do if your CVC is compromised
If you believe someone has your card number and CVC, contact your card issuer immediately. You can find the number on the back of your card or on your monthly statement. The issuer will cancel your current card and mail you a new one with a new CVC. You are not responsible for fraudulent charges made with your card, but you need to report them within a specific time frame — usually 60 days from when the charge appears on your statement.
While you wait for the new card, ask the issuer whether you can use a temporary card number for online purchases, or whether they can issue a virtual card number that works only for a single merchant or a set time period. Some issuers offer this feature to reduce fraud risk.
Frequently Asked Questions
Can someone use my credit card without the CVC?
In person, yes — the card reader can access the information from the chip or stripe without needing the CVC. Online or by phone, no — the CVC is required to complete the transaction. This is why in-person card theft is more dangerous than online card number theft.
Is the CVC the same as the security code?
Yes. The CVC, CVV (Card Verification Value), and security code all refer to the same three- or four-digit number. Different card issuers use different names, but they are the same thing. American Express calls it the CID (Card Identification Number).
What if I enter the wrong CVC?
The transaction will be declined. You can try again with the correct number. Entering the wrong CVC multiple times may temporarily lock your card for security reasons, so contact your issuer if this happens.
Do I need to memorize my CVC?
No. You only need to read it from the card when a merchant asks for it. Memorizing it is actually less secure because you might write it down or tell someone. Keep the card itself in a safe place and read the number only when you are making a purchase.
Can I change my CVC?
No. The CVC is generated by your card issuer and printed on the card. You cannot change it yourself. If you want a different CVC, you must request a replacement card from your issuer.