The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a short number on the back of your credit card — three digits for Visa, Mastercard, and Discover, or four digits for American Express (which prints it on the front). When you enter it during an online or phone purchase, you are telling the merchant and the card company that you have the physical card in your hand right now. It is not stored in the card's magnetic stripe or chip, which is why a thief who steals your card number alone cannot use it online without also guessing or obtaining the CVV.
The CVV exists because online and phone transactions cannot use the same verification methods as in-person swipes. At a store, the card reader checks the chip or stripe and confirms the card is real. Online, the merchant never sees the card, so the CVV acts as a stand-in proof that you own it. It is one layer of fraud protection, not the only one — but it is a meaningful one.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card that you must enter for online and phone purchases to prove you have the physical card.
- Never share your CVV with anyone by email, phone, or text — legitimate companies will never ask for it outside of a secure checkout page.
- The CVV is different from your PIN; your PIN is for ATM withdrawals and in-person debit transactions, while the CVV is for remote purchases.
- Merchants are not allowed to store your CVV after a transaction, so if your card number is breached, the CVV cannot be stolen along with it.
Where to find your CVV and what it looks like
For Visa, Mastercard, and Discover cards, flip the card over and look at the back. On the right side of the signature strip, you will see a three-digit number printed in a small box or directly on the strip itself. That is your CVV. For American Express, the four-digit code is on the front of the card, above the card number on the right side.
The CVV is always printed, never embossed like the card number. It will not feel raised when you run your finger over it. This is intentional — it makes the code harder to read if someone photographs your card from a distance or glances at it briefly.
Why merchants ask for it during online checkout
When you buy something online, the merchant's payment system asks for three pieces of information: your card number, your expiration date, and your CVV. The card number and expiration date alone are not enough because both of those appear on the front of the card and could be read by someone standing near you or viewing a photo. The CVV, by contrast, only appears on the physical card itself and only in one place.
By requiring the CVV, the merchant confirms that you have the card in your possession at that moment. This does not prevent all fraud — a thief who steals your physical card can use it online just as easily as you can — but it does stop someone who has only your card number from making purchases without the card itself.
The difference between CVV and PIN
Many people confuse the CVV with a PIN (Personal Identification Number), but they serve different purposes. Your PIN is a four-digit code you create and memorize. You use it at ATMs to withdraw cash and at store checkout terminals when you pay with a debit card. The PIN is never printed on the card and should never be written down.
Your CVV is printed on the card and is used only for online and phone purchases. You do not create it — the card company does. You do not memorize it — you read it off the card each time you need it. A credit card does not have a PIN at all; only debit cards do. If someone asks you for your PIN during an online purchase, that is a red flag — no legitimate merchant will ever ask for it.
What happens if someone gets your CVV
If a thief obtains your CVV along with your card number and expiration date, they can make online purchases in your name. However, merchants are legally prohibited from storing your CVV after a transaction is complete. This means that if a retailer's database is hacked and your card number is stolen, the CVV should not be in that database — it should have been deleted immediately after the purchase went through.
In practice, this protection works most of the time but not always. The safest approach is to treat your CVV like you treat your card number: do not share it with anyone except during a secure checkout on a website you trust. Never give your CVV over email, text, or phone unless you initiated the call to a company you know is legitimate. Scammers often pose as your bank or a retailer and ask for your CVV to "verify your account" — this is always a scam.
How to protect your CVV
The simplest protection is to keep your card in your wallet and only pull it out when you need to make a purchase. Do not leave it lying on a desk or table where someone could photograph it. Do not take pictures of your card and store them on your phone or email them to yourself — if your phone is lost or hacked, your card details are compromised.
When shopping online, only enter your CVV on a checkout page that begins with "https://" (the "s" means the connection is encrypted). Look for a small padlock icon in the address bar. If you are on a website that does not use encryption, do not enter your card information at all. If a website or email asks you to provide your CVV outside of a checkout page — for example, in a reply email or a pop-up window — that is a scam. Hang up or close the window.
What to do if your card is lost or stolen
If your physical card goes missing, call your card company immediately. Most card companies have a 24-hour fraud line number on the back of your statement or on their website. Tell them your card is lost or stolen, and they will cancel it and send you a replacement with a new CVV.
Once the card is cancelled, the old CVV is useless — even if a thief has it, they cannot use it because the card itself no longer works. The new card will arrive in the mail within 7 to 10 business days, and you can use it as soon as it arrives. In the meantime, you can still use your account to make online purchases if you have a digital wallet set up (like Apple Pay or Google Pay), or you can call the merchant directly and provide your new card number once it arrives.
Frequently Asked Questions
Can someone use my card online if they have my card number but not my CVV?
Most online retailers will not process a purchase without the CVV, so having only the card number is not enough. However, some merchants — particularly subscription services or those you have shopped with before — may have your CVV on file from a previous purchase, which means they could charge you without asking for it again. This is why it is important to monitor your statements regularly.
Is it safe to give my CVV to a company over the phone?
Only if you called them first and you are certain they are legitimate. Never give your CVV to someone who called you, even if they claim to be from your bank or a retailer. Legitimate companies will never ask for your CVV over the phone. If you need to make a payment by phone, ask the company for their official phone number from their website or your statement, hang up, and call that number yourself.
What if I accidentally shared my CVV with a scammer?
Contact your card company immediately. Tell them you believe your card information has been compromised and ask them to cancel the card and issue a replacement. They will monitor your account for fraudulent charges and can reverse any unauthorized purchases. You are not responsible for fraud if you report it promptly.
Do I need to memorize my CVV?
No. You should read it from your card each time you need it. Memorizing it is actually riskier because you might accidentally say it out loud or type it somewhere it could be seen. Keep your card secure and only look at the CVV when you are about to use it for a purchase.
Why do some websites ask for my CVV but others don't?
Larger retailers and well-established websites often have agreements with card companies that allow them to process payments with less verification if they have a history of low fraud rates. Smaller merchants or those with higher fraud risk are required to ask for the CVV every time. Either way, the CVV is an optional security measure for the merchant — they can choose to require it even if they are not required to.