The CVC is a three- or four-digit security code printed on your card that proves you physically have it
The CVC (Card Verification Code) is a number on the back of your credit card — usually three digits, sometimes four on American Express — that exists for one reason: to reduce fraud when you can't hand your card to someone in person. When you buy something online, over the phone, or by mail, the merchant asks for this code to confirm you actually possess the physical card.
It is not the same as your PIN, which you use at ATMs and chip readers. It is not stored in the card's magnetic stripe or chip. It is printed on the card only, which means a thief who steals your card number alone — say, from a data breach — cannot use it without also seeing the card itself.
Visa calls it CVV2, Mastercard calls it CVC, American Express calls it CID, and Discover calls it CID as well. The function is identical across all of them.
Key Takeaways
- The CVC is a three- or four-digit code printed on the back of your card (or front, for American Express) that you must provide for online, phone, and mail purchases.
- The code is not stored in your card's chip or magnetic stripe, so a stolen card number alone cannot be used without it.
- Never share your CVC with anyone except the merchant you are actively paying — not your bank, not customer service, not a friend.
- If your card is lost or stolen, call your card issuer immediately; the CVC does not protect you if someone has the physical card.
Where the CVC appears on your card
For Visa, Mastercard, and Discover, the CVC is a three-digit number printed on the back of the card, usually in the signature strip area on the right side. For American Express, it is a four-digit code printed on the front of the card, above the account number on the right.
The location matters because it tells you something about security: the code is printed, not embedded. This means it cannot be read from a chip or stripe — only by someone looking at the physical card. That is the entire point.
Why merchants ask for it and what it protects against
A merchant who asks for your CVC is checking that you have the card in your hands right now. If someone stole your card number from a website breach or a skimmed ATM, they would have the 16-digit account number but not the CVC unless they also had the physical card.
This protects the merchant more than it protects you. If a fraudster uses your card number online and the merchant did not ask for the CVC, the merchant bears the loss. If the merchant did ask for the CVC and the fraudster somehow provided it, the merchant is usually protected from liability — the assumption is that you authorized the charge.
For you, the real protection is your card issuer's fraud monitoring and your right to dispute unauthorized charges. The CVC is one layer, not the whole wall.
What the CVC does not protect against
If someone steals your physical card, the CVC does not stop them. They have both the card number and the code, so they can use it online, by phone, or in person at a chip reader. This is why calling your card issuer immediately after losing your card is critical — they can freeze it before the thief uses it.
The CVC also does not protect you if you give it to a scammer. If someone calls you claiming to be from your bank and asks for your CVC, they are lying. Your bank already has your CVC on file and will never ask you for it. Giving it to a scammer is the same as handing them your card.
In-person fraud at a physical store also bypasses the CVC. A cashier can see your card, read the number and code, and write them down. This is why chip readers and contactless payments exist — they do not expose your full card number to the cashier at all.
How to protect your CVC
Treat your CVC the way you treat your PIN: do not write it down, do not text it, do not email it, and do not say it out loud where others can hear. The only time you should enter it is when you are actively making a purchase from a merchant you trust.
Never provide your CVC to anyone who calls you, emails you, or messages you — not even if they claim to be from your bank. Your card issuer has your CVC already and will never ask for it. If someone asks, hang up or delete the message and call your card issuer directly using the number on the back of your card.
When you shop online, make sure the website is secure. Look for "https://" at the start of the URL and a padlock icon in the address bar. These mean your information is encrypted in transit. They do not mean the website is trustworthy, but they do mean your CVC is not being sent in plain text.
What happens if your CVC is compromised
If you believe your CVC has been seen by someone who should not have it — you gave it to a scammer, you typed it on a website that looked suspicious, or you saw a fraudulent charge — call your card issuer right away. They can issue you a new card with a new CVC.
The old CVC becomes useless once the new card arrives. The merchant who has your old number and code cannot use it because the card itself is now inactive. This is one of the few situations where replacing your card is the right move, because the CVC is the one piece of card information that actually changes when you get a new card.
If you see unauthorized charges on your statement, report them to your card issuer. You have the right to dispute them, and your issuer is required to investigate. In most cases, you will not be held liable for fraudulent charges, even if the fraudster somehow had your CVC.
CVC versus other card security features
Your card has several security features, and they work in different ways. The chip (the small metallic square on the front) creates a unique code for each transaction, so a stolen transaction record cannot be replayed. The magnetic stripe (the black band on the back) stores your account number and is easily cloned, which is why chip readers are safer. The CVC is a static number that proves you have the card, but only for remote purchases.
None of these alone is enough. Together, they make it harder for a fraudster to use your card without the physical card in hand. But the strongest protection is still your card issuer's fraud monitoring — they watch for unusual spending patterns and will contact you if something looks wrong.
Frequently Asked Questions
Can I use my card online without providing the CVC?
Some merchants do not ask for it, and some websites will let you skip it, but most require it. If a website does not ask for a CVC, it is either very old or not using standard security. Reputable merchants ask for it because it reduces their fraud liability.
Is it safe to save my CVC on a website for faster checkout?
No. Never let a website store your CVC. Legitimate payment processors (like PayPal or Apple Pay) do not store it — they store your card number and other details, but not the CVC. If a site asks you to save it, that is a red flag.
What if I forgot my CVC and need to make a purchase?
You can look at the back of your card — it is printed there. If you do not have your card with you, you cannot complete an online purchase that requires the CVC. This is intentional; it is meant to prevent someone from using your card number alone.
Does the CVC change if I get a new card?
Yes. Every time your card issuer sends you a replacement card — whether because yours expired, was lost, or was compromised — the new card has a different CVC. This is why replacing your card is effective if you believe your CVC has been exposed.
Can a scammer use my CVC if they only have my card number?
Not for online purchases, which is the whole point of the CVC. They would need to see the physical card or know the code separately. However, if they have your card number and other details like your name and expiration date, they can still try to commit fraud in other ways, so monitor your statements closely.