The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a number on the back of your credit card — usually three digits, sometimes four on American Express cards. It sits separately from your card number and expiration date. When you enter it during an online or phone purchase, you are telling the merchant you have the physical card in your hand, not just someone who knows your number.
The CVV is not stored in the magnetic stripe or chip on your card. It only appears printed on the card itself. This means a merchant who processes your card in person cannot see it (they do not need it), but an online merchant can ask for it as proof you own the card. If someone has your card number and expiration date but not the CVV, they cannot complete most online transactions.
Visa, Mastercard, and Discover all call this code CVV. American Express calls it the CID (Card Identification Number) or CVC (Card Verification Code), but it works the same way — a three- or four-digit number that proves possession.
Key Takeaways
- The CVV is a three- or four-digit code printed on the back of your card (or front, on American Express) that only you can see without holding the physical card.
- Online and phone merchants ask for your CVV to confirm you have the card; in-person merchants do not need it because they can see the card.
- Never share your CVV with anyone who calls you or emails you, even if they claim to be from your bank — your bank already has this information.
- If your card is lost or stolen, contact your card issuer immediately; the CVV alone cannot be used to make purchases without the card number and expiration date.
- Legitimate websites show a small padlock icon in the address bar and use "https://" in the URL when asking for your CVV.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is printed on the back, usually in the signature strip area or just to the right of it. It is the last three digits of a longer number. On American Express cards, the four-digit code appears on the front, above the card number on the right side.
The CVV is never embossed or raised like your card number — it is always printed flat on the surface. This matters because it proves the code came from the physical card, not from a database or a stolen card number.
Why merchants ask for it online but not in stores
When you swipe, insert, or tap your card at a physical store, the merchant can see you have the card. They can also check the signature on the back (though many do not anymore). The CVV is unnecessary because possession is already proven.
Online and phone purchases are different. The merchant never sees the card. They only have information you typed or spoke aloud. Asking for the CVV adds a layer of verification: you must have the physical card to know this number. It does not prevent fraud entirely, but it stops someone who only stole your card number from using it online.
Some online merchants do not ask for the CVV, especially if you have an account with them and have made purchases before. Others require it every time. The presence or absence of a CVV request does not tell you whether a website is safe — that depends on whether the site itself is secure and legitimate.
What the CVV does and does not protect against
The CVV protects against card-not-present fraud — someone using your card number online or by phone without having the physical card. If a thief has your card number and expiration date but not the CVV, they cannot complete most online purchases. This is why the CVV is useful.
The CVV does not protect against someone who has stolen your physical card. Once they have the card, they have the CVV too. It also does not protect against in-person fraud at a store or restaurant — the CVV is not checked there. And it does not protect against data breaches at merchants or banks, where the CVV might be stored (though legitimate merchants are not supposed to store it).
If your card number is compromised but your physical card is safe, your CVV is still safe. If your physical card is lost or stolen, treat the CVV as compromised along with everything else on the card.
How to keep your CVV safe
Never share your CVV with anyone who contacts you by phone, email, or text — not even if they claim to be from your bank. Your bank already has your CVV on file. They will never ask you for it. If someone calls claiming to verify your account and asks for the CVV, hang up and call your bank directly using the number on the back of your card.
When entering your CVV online, check that the website is legitimate and secure. Look for a small padlock icon in the address bar and make sure the URL begins with "https://" rather than "http://". These signs indicate the connection is encrypted. If you are unsure about a website, do not enter your CVV there.
Do not write your CVV on receipts, take photos of it, or store it in your phone or email. The only place your CVV should be written is on the back of your card itself. If you are shopping online and a website offers to save your CVV for future purchases, decline — legitimate payment processors do not store CVVs.
What to do if your CVV is compromised
If you believe someone has your CVV (for example, after a data breach at a merchant), contact your card issuer immediately. You can find the number on the back of your card or on your statement. Tell them you want to report potential fraud and request a new card.
Your issuer will cancel the old card and send you a new one with a new CVV. This usually takes five to ten business days. In the meantime, you can still use your account online if your issuer provides a temporary card number, or you can use a different payment method.
You do not need to file a police report for a compromised CVV alone, but if fraudulent charges appear on your account, report those to your card issuer and keep records of the dispute. Your issuer is responsible for investigating unauthorized charges.
CVV versus other card security features
The CVV is one of several security features on your card. Your card number itself identifies your account. Your expiration date shows when the card expires. Your name appears on the front. Together, these pieces of information can be used to make a purchase, but the CVV adds friction — it requires possession of the physical card.
Newer cards also have a chip (EMV) that generates a unique code for each in-person transaction, making it harder to clone the card. Some cards offer virtual card numbers through your bank's app, which generate a one-time number for online shopping. These are separate from the CVV but work alongside it to reduce fraud.
No single feature stops all fraud. The CVV is most useful for online purchases. The chip is most useful for in-person purchases. Virtual numbers are most useful if you want to hide your real card number from merchants. Together, they create multiple barriers.
Frequently Asked Questions
Can someone use my card number without the CVV?
At most online retailers, no — they require the CVV to complete the purchase. Some older or less secure websites might not ask for it, which is a red flag about their security practices. In person, the CVV is not needed at all. If your card is lost or stolen, the thief has both the number and the CVV, so contact your issuer immediately.
Is it safe to give my CVV to a website?
It is safe if the website is legitimate and secure. Check for "https://" in the address bar and a padlock icon. Avoid entering your CVV on public Wi-Fi networks. If you are unsure whether a website is real, do not enter your CVV — call the company directly using a phone number from their official website instead.
What if I forget my CVV?
Look at the back of your physical card — it is printed there. If you do not have your card with you, you cannot complete the transaction without it. You can call your card issuer, but they will not tell you the CVV over the phone for security reasons. You will need to retrieve your card or wait until you can access it.
Do I need to memorize my CVV?
No. You only need to know it when you are making an online or phone purchase and have your card in front of you. Do not memorize it or write it down separately from the card. The whole point of the CVV is that it proves you have the physical card at that moment.
Why do some websites not ask for a CVV?
Websites you have used before and have an account with often skip the CVV if you are logged in — they already verified you once. Some very old or poorly designed websites do not ask for it at all, which is a security weakness on their end. A missing CVV request does not mean the site is unsafe, but it is less secure than asking for one.