The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back or front of your credit card that merchants use to confirm you have the physical card in your hand. It is not encoded in the magnetic stripe or chip — it is printed only on the card itself. When you make a purchase online or over the phone, the merchant asks for this code to verify that you are not using a stolen card number alone.
The CVV serves as a basic fraud check. A thief who has only your card number and expiration date cannot complete an online transaction without this code. Visa calls it CVV2, Mastercard calls it CVC2, American Express calls it CID, and Discover calls it CVV2 — they are all the same thing functionally.
You should never share your CVV with anyone except the merchant you are actively paying. It should not appear in your email, text message, or phone call. Legitimate companies will never ask you to provide it over the phone or email.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card that proves you physically possess it when making remote purchases.
- Visa, Mastercard, American Express, and Discover each use different names for the same security feature, but they work the same way.
- You should only enter your CVV directly into a secure payment form or tell it to a merchant you are actively paying in real time.
- If someone asks for your CVV by email, text, or unsolicited phone call, that is a fraud attempt — your bank will never ask for it this way.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express cards, it is a four-digit code printed on the front, above the card number on the right side.
The code is printed in raised or flat text, never embedded in the chip or magnetic stripe. This matters because it means the CVV cannot be read by a card reader or skimmer — a thief has to physically see or photograph your card to get it. That is the entire point of the security feature.
How merchants use the CVV during a transaction
When you enter your card details online, the merchant's payment system sends your card number, expiration date, and CVV to the payment processor. The processor checks that the CVV matches the card number on file with your bank. If it does not match, the transaction is declined.
The merchant never stores your CVV after the transaction completes. Payment Card Industry (PCI) rules forbid it. This means even if a merchant's database is breached, the thief cannot use the stolen card numbers to make online purchases because they do not have the CVV.
In-person transactions at a physical store do not require the CVV because you are handing the card to the cashier, proving you have it. Phone transactions sometimes require it, sometimes do not — it depends on the merchant's policies and the type of card.
Why the CVV does not fully prevent fraud
The CVV stops one specific type of fraud: someone using only your card number and expiration date to make an online purchase. It does not stop fraud that involves the physical card itself, such as a lost or stolen card used in a store.
It also does not stop account takeover fraud, where someone gains access to your online account through a password breach or phishing attack and changes the billing address or payment method. In that case, they do not need your CVV because they are already inside your account.
The CVV is one layer of fraud protection, not a complete shield. Your bank also monitors for unusual spending patterns, and you can set up transaction alerts to catch fraud quickly.
What to do if your CVV is compromised
If you believe someone has your CVV — for example, you gave it to a merchant who seemed suspicious, or you see a fraudulent charge on your statement — contact your card issuer immediately. You do not need to request a new card unless there is actual fraud on the account.
Your bank can issue a new card with a new CVV if you ask, but this is usually unnecessary. The CVV changes every time your card is reissued, so if your current card expires and you receive a replacement, you automatically get a new code. If fraud does occur, your bank will cancel the card and send you a replacement with a new CVV as part of the dispute process.
Do not share your CVV with customer service representatives unless you initiated the call and you are certain you are speaking to your bank. Scammers often pose as bank employees and ask for the CVV to "verify your account" or "confirm your identity."
CVV and account security online
When you shop online, look for a padlock icon in the browser address bar and a URL that begins with "https://" — the "s" means the connection is encrypted. This protects your CVV and other card details while they travel from your computer to the merchant's server.
Never enter your CVV on a website that does not have this encryption, and never save your CVV in your browser or in a note on your phone. If you use a password manager, most will not store CVV codes for this reason — they only store card numbers and expiration dates.
Autofill features on your browser or device should not include your CVV. If they do, disable that feature in your settings.
CVV versus other card security features
The CVV works alongside other protections. Your card's chip (if it has one) generates a unique code for each in-person transaction, making it harder to clone. Your magnetic stripe contains your card number and expiration date but not the CVV. Your bank's fraud monitoring system watches for unusual activity. Together, these layers make it harder for thieves to use your card.
If your card is lost or stolen, call your bank immediately to freeze or cancel it. The CVV on that card is now useless because the card itself is no longer valid. Your bank will issue a new card with a new number and new CVV.
Frequently Asked Questions
Is it safe to give my CVV to a company over the phone?
Only if you called them first and you are certain you are speaking to a legitimate business. Never give your CVV to someone who called you unsolicited, even if they claim to be from your bank. Your bank will never ask for your CVV by phone, email, or text.
Can someone use my card online with just the card number and expiration date?
Most legitimate merchants will decline the transaction if the CVV is missing or incorrect. Some older or less secure websites might accept it, but this is rare. The CVV requirement is now standard across major retailers and payment processors.
What happens if I enter the wrong CVV?
The transaction will be declined. You can try again with the correct code. Entering the wrong CVV multiple times may trigger a fraud alert on your account, so double-check the number before submitting.
Do I need to memorize my CVV?
No. You only need it when making a purchase. Do not write it down or store it anywhere. If you need it, look at your physical card.
Does the CVV change if I use my card?
No. The CVV stays the same for the life of the card. It only changes when your card expires and you receive a replacement, or when your bank reissues your card due to fraud or your request.