The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a number on the back of your credit card, separate from your card number. On Visa, Mastercard, and Discover cards, it is three digits printed to the right of the signature strip. On American Express, it is four digits printed on the front, above the card number on the right side.
The CVV exists to reduce fraud in card-not-present transactions — online purchases, phone orders, and mail orders where the merchant never physically sees your card. When you enter your CVV during checkout, the merchant sends it to the card network (Visa, Mastercard, etc.) to verify that you actually hold the physical card. The network checks the code against what they have on file but does not return the actual number to the merchant, so the merchant cannot store it.
This is different from your card number. Your card number identifies your account; your CVV proves you have the card in your hand right now. A thief who steals your card number from a data breach cannot complete an online purchase without the CVV.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card that merchants request during online and phone purchases to confirm you physically possess the card.
- Visa, Mastercard, and Discover print the CVV on the back of the card; American Express prints it on the front.
- Merchants cannot legally store your CVV after a transaction, so it does not appear on receipts or in your account history.
- Never share your CVV with anyone who calls or emails you claiming to be your bank or card issuer — legitimate companies already have this information on file.
Where the CVV appears on different card types
The location and length of the CVV depend on which card network issued your card. Visa, Mastercard, and Discover all place a three-digit code on the back of the card, usually printed to the right of the signature panel. American Express is the exception: it prints a four-digit code on the front of the card, positioned above the card number on the right side.
Some cards issued outside the United States may have different formats, but the three-digit back-of-card code is standard for most U.S. credit and debit cards. If you cannot find the CVV on your card, check both the front and back, or contact your card issuer to confirm the location.
Why merchants ask for the CVV during checkout
When you buy something online or over the phone, the merchant asks for your CVV to verify that you have the card. The merchant submits your card number, expiration date, and CVV to the payment processor, which forwards the CVV to your card network for verification. The network checks the code against its records and returns a pass or fail — but crucially, it does not tell the merchant what the actual CVV is.
This design means a merchant's database breach exposes your card number and expiration date but not your CVV. A thief with only your card number cannot complete a card-not-present transaction without the CVV. The code is also useless for in-person purchases, where the merchant swipes or inserts your card and the terminal reads the chip or magnetic stripe directly.
What merchants are not allowed to do with your CVV
By law and by card network rules, merchants cannot store your CVV after a transaction completes. Visa, Mastercard, American Express, and Discover all prohibit merchants from keeping the code in their systems, on receipts, or in any permanent record. This rule exists specifically to limit the damage if a merchant's database is breached.
You should never see your CVV on an emailed receipt, a printed receipt, or in your online account history with the merchant. If you do, that merchant is violating card network rules and you should report it to your card issuer. Your card issuer can investigate and may take action against the merchant.
CVV scams and how to protect yourself
Scammers sometimes call or email claiming to be your bank or card issuer and ask for your CVV. This is always a scam. Your bank already has your CVV on file — they do not need you to provide it over the phone or email. Legitimate card issuers will never ask for your CVV in an unsolicited call or message.
The same rule applies to text messages and pop-up windows. If you receive an unexpected request for your CVV, do not provide it. Instead, hang up or close the message, then call your card issuer directly using the number on the back of your card to report the contact.
When shopping online, only enter your CVV on a secure checkout page — look for a padlock icon in the address bar and a URL that begins with "https://" rather than "http://". Never enter your CVV on a website you do not recognize or trust, and never use public Wi-Fi to make purchases that require your CVV.
CVV versus other card security features
The CVV is one of several security layers on your card. Your card number identifies your account but can be exposed in a breach without compromising your CVV. Your expiration date is printed on the front and visible to anyone who sees your card. Your chip (on newer cards) creates a unique encrypted code for each in-person transaction, making it harder to clone your card at a physical store.
Together, these features make it harder for a thief to use a stolen card number. For online purchases, the CVV is the main barrier. For in-person purchases, the chip is the main barrier. For phone orders, the merchant may ask for the CVV, expiration date, and the last four digits of your card number to confirm your identity.
What happens if your CVV is compromised
If you believe your CVV has been exposed — for example, through a merchant breach or a phishing scam — contact your card issuer immediately. You do not need to wait for fraud to appear on your account. Your issuer can cancel your current card and issue a replacement with a new CVV, usually within 7 to 10 business days.
While you wait for the replacement, your old card remains active unless you ask the issuer to deactivate it. If you need to make online purchases before the new card arrives, ask your issuer whether they offer a temporary card number or virtual card number for online use. Many issuers provide this feature at no cost.
Frequently Asked Questions
Can someone use my card number without the CVV?
For online and phone purchases, no — most merchants require the CVV to process the transaction. For in-person purchases, the CVV is not needed because the merchant reads your card directly. A thief with only your card number can attempt in-person fraud but cannot complete most card-not-present transactions.
Is it safe to text my CVV to a merchant?
No. Never send your CVV by text, email, or any unencrypted method. Text messages and emails are not secure. If a merchant asks you to text your CVV, that is a red flag — use a different merchant or call them directly to complete the purchase through a secure phone line.
Why does my receipt show the last four digits of my card but not the CVV?
Merchants are required to hide most of your card number on receipts for security, but they are forbidden from storing or printing your CVV at all. The last four digits help you identify which card you used; the CVV is never shown because it should not be recorded anywhere.
Do I need to memorize my CVV?
No. You only need your CVV when making a purchase. Keep your card in a safe place and refer to it when you shop online or by phone. Do not write your CVV down or store it in your phone or computer.