The CVV is a three- or four-digit security code printed on your card that proves you physically hold it

The CVV (Card Verification Value) is a number on the back of your credit card — or sometimes the front, depending on the card type — that exists to verify you actually have the card in your hands. When you enter it during an online purchase or over the phone, you are telling the merchant and the card network that you possess the physical card. It is not stored in the card's magnetic stripe or chip, which is why a thief who steals your card number alone cannot easily use it online.

Visa and Mastercard call this code the CVV. American Express calls it the CID (Card Identification Number) and prints it on the front of the card instead of the back. Discover uses the same back-of-card placement as Visa and Mastercard. The length and location vary, but the function is identical across all networks.

The CVV is not the same as your PIN. Your PIN is what you enter at an ATM or in-store terminal to prove you authorized a transaction. The CVV is only for remote transactions — online, by phone, or by mail — where the merchant cannot physically see your card.

Key Takeaways

  • The CVV is a three- or four-digit code on your card that proves you physically hold it when making online or phone purchases.
  • Visa and Mastercard print the CVV on the back; American Express prints the CID on the front; Discover follows Visa and Mastercard placement.
  • Never share your CVV with anyone except a merchant you are actively paying, and never enter it on a website unless you initiated the transaction.
  • If your card is lost or stolen, contact your card issuer immediately; the CVV alone cannot be used without your card number and expiration date.

Where to find your CVV on different card types

On Visa, Mastercard, and Discover cards, the CVV appears on the back of the card, to the right of the signature strip. It is the last three digits of a longer number printed there. You do not need to memorize it — you only need to read it when you are making a purchase.

On American Express cards, the four-digit CID is printed on the front of the card, above the account number on the right side. This placement is one of the ways to spot a counterfeit Amex card: if the security code is on the back, it is not genuine.

Some business cards and specialty cards may have the code in a different location or format. If you cannot find it, call the number on the back of your card and ask the issuer where the security code is located.

Why merchants ask for it and what they do with it

When you buy something online or over the phone, the merchant sends your card number, expiration date, and CVV to their payment processor. The processor checks the CVV against the card network's records to confirm that the number matches the card. If it does not match, the transaction is declined. This check happens in seconds and you usually do not see it happen.

The merchant is not supposed to store your CVV after the transaction completes. Payment Card Industry Data Security Standard (PCI DSS) rules forbid it. If a merchant stores CVVs and their system is breached, the thief gets card numbers but not the security codes — which limits what they can do with the stolen data online.

Some merchants, like subscription services or hotels, may ask you to save your card on file. In those cases, they store your card number and expiration date but not your CVV. When you make a purchase using the saved card, you may be asked to enter the CVV again to confirm you still have the physical card.

How the CVV protects you from fraud

The CVV stops a thief who has only your card number from using it online. If someone steals your card number from a data breach or a skimmed ATM, they have the number and expiration date but not the CVV — because the CVV is not stored in the magnetic stripe or chip. Without it, they cannot complete most online purchases.

The CVV also protects you if your card is used in person by someone else. A thief who physically steals your card can use it at a store or ATM without the CVV. But if they try to use it online or by phone, they need the CVV, which they can see on the card itself. This is why you should report a lost or stolen card immediately: the longer you wait, the more time a thief has to use it in person or to write down the CVV before you cancel it.

The CVV is not a complete fraud shield. It does not protect you from a merchant's website being hacked, from phishing emails that trick you into entering your information, or from someone using your card in person. But it does add a layer of verification that makes remote fraud harder.

What to do if someone asks for your CVV in a suspicious way

Never give your CVV to anyone unless you initiated the transaction. If a merchant calls you out of the blue asking for your CVV, hang up and call the merchant's official number from your statement or their website. Scammers often pose as customer service representatives and ask for the CVV to "verify your account" or "update your information."

Do not enter your CVV on a website unless you are actively making a purchase and you recognize the site. If you are unsure whether a website is legitimate, type the merchant's name and the word "scam" into a search engine. Look for the padlock icon in your browser's address bar, which indicates the site is using encryption. A padlock does not mean the site is legitimate, but its absence is a red flag.

If you receive an email or text asking for your CVV, it is a scam. Your card issuer will never ask for your CVV by email or text. If you are worried about your account, call the number on the back of your card.

What happens if your CVV is compromised

If your CVV has been exposed in a data breach or you suspect someone has it, contact your card issuer right away. You do not need to cancel your card unless fraudulent charges appear. Your issuer can monitor your account for suspicious activity and issue you a new card with a new CVV if needed.

If fraudulent charges do appear on your statement, report them to your card issuer. Under federal law, your liability for unauthorized charges is capped at $50, and most card issuers waive this entirely. The issuer will investigate the charge and typically remove it from your account within one to two billing cycles.

Changing your CVV is not something you can do yourself — the code is tied to your physical card. If you want a new CVV, you need a new card. Your issuer can send you a replacement card with a new number and a new CVV, usually within five to ten business days.

CVV versus other security features on your card

Your card has several security features, and they serve different purposes. The magnetic stripe on the back stores your card number, expiration date, and sometimes your name. It does not store the CVV. The chip (the small metallic square on the front) stores encrypted data and is harder to counterfeit than the stripe. The chip also does not store the CVV.

Your PIN is a four-digit number you create or receive from your issuer. It is used at ATMs and in-store terminals to prove you authorized the transaction. It is not used online and is not the same as the CVV.

Your card number is the 15- or 16-digit number on the front of your card. It identifies your account. The CVV is a separate verification that you hold the card. Together, they make it harder for someone with only your card number to use it fraudulently.

Frequently Asked Questions

Can someone use my card if they have my card number but not my CVV?

They can use it in person at a store or ATM, but not online or by phone. Most online merchants require the CVV before they will process the transaction. Some older merchants or subscription services may not ask for it, but most do.

Is it safe to save my CVV on a website?

No. Do not save your CVV anywhere — not in your browser, not in a note, not in a password manager. Merchants are not supposed to store it, and you should not either. Enter it fresh each time you make a purchase.

What if I enter the wrong CVV?

The transaction will be declined. You can try again with the correct code. Entering the wrong CVV a few times will not hurt your credit or lock your account, but some merchants may flag repeated failed attempts as suspicious.

Do I need to memorize my CVV?

No. You only need to read it when you are making a purchase. Memorizing it is actually less secure because you might accidentally share it or enter it on a phishing website.

Can the CVV be used to steal my identity?

The CVV alone cannot be used to steal your identity. A thief would need your full name, address, Social Security number, and other personal information to open accounts in your name. The CVV is only useful for making purchases with your card number.