The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number your card issuer prints on the card itself — not encoded in the magnetic stripe or chip. On Visa and Mastercard, it is three digits printed on the back, usually to the right of the signature panel. On American Express, it is four digits printed on the front, above the account number. Discover cards also use three digits on the back.
The purpose is simple: when you enter your card number online or over the phone, the merchant asks for the CVV to confirm you actually have the physical card in your hands. Someone who has stolen your card number alone cannot complete the transaction without this code. The issuer does not store the CVV in their system the way they store your account number, so even if a merchant's database is breached, the CVV typically cannot be extracted.
The CVV is different from your PIN, which you use at an ATM or in-person at a store. The PIN is encrypted and stored by your bank. The CVV is not stored by the merchant or the bank in a way that lets them verify it later — it is meant to be checked only at the moment of the transaction.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card that merchants request during online and phone purchases to confirm you hold the physical card.
- Visa and Mastercard print the CVV on the back of the card; American Express prints it on the front; Discover prints it on the back.
- Never share your CVV with anyone who calls you or emails you claiming to be from your bank, as legitimate issuers never ask for it this way.
- The CVV is not stored in the same way as your account number, so it offers protection even if a merchant's database is compromised.
Where the CVV appears on different card brands
The location and length of the CVV varies by card type. Visa, Mastercard, and Discover all print a three-digit code on the back of the card, positioned to the right of the signature strip. This three-digit code is sometimes called the CVC (Card Verification Code) or CSC (Card Security Code), but the function is identical.
American Express uses a different format. The four-digit code appears on the front of the card, above and to the right of the account number. Because American Express cards have a different physical layout, their security code is longer and in a different location than other major card brands.
If you cannot find the CVV on your card, check both the front and back. If your card is damaged or the number is worn away, contact your issuer and request a replacement card. You cannot use the card for online or phone transactions without a readable CVV.
When merchants ask for your CVV and when they should not
Legitimate merchants request the CVV during online checkout, in the payment section where you enter your card details. You will see a field labeled "CVV," "Security Code," "Card Verification Value," or similar language. This is normal and expected for any online purchase.
Phone merchants — companies taking your order over the phone — may also ask for the CVV. This is standard practice and protects both you and the merchant by confirming you authorized the charge.
Your bank or card issuer will never call you or email you asking for your CVV. If someone claiming to represent your bank requests this code, it is a scam. Hang up or delete the email immediately and call your bank directly using the number on the back of your card. Legitimate issuers already have your account information and do not need you to provide the CVV to verify your identity.
How the CVV protects you in online and phone transactions
The CVV adds a layer of fraud protection by requiring proof that you hold the physical card. If a criminal has only your card number — obtained through a data breach, a skimmed ATM, or a lost receipt — they cannot complete an online or phone purchase without the CVV. They would need to have the card itself or know the three- or four-digit code.
When you enter the CVV during checkout, the merchant sends it to the payment processor, which checks it against the card issuer's records. If the CVV does not match, the transaction is declined. This check happens in real time, before your charge is approved.
However, the CVV does not protect you against in-person fraud at a physical store. When you swipe or insert your card at a checkout terminal, the merchant does not ask for the CVV — the card reader captures the information from the chip or magnetic stripe. This is why card skimming and counterfeit cards remain a risk at gas pumps and ATMs, even though your CVV is not involved.
What happens if your CVV is compromised
If you believe your CVV has been compromised — for example, if you used it on a website that was later breached — contact your card issuer immediately. You do not need to wait for fraudulent charges to appear. Your issuer can issue a replacement card with a new CVV at no cost to you.
The replacement card will arrive within 7 to 10 business days in most cases. Until it arrives, you can still use your current card for in-person purchases, but you should not use it for online or phone transactions if you suspect the CVV has been exposed. Ask your issuer whether they can issue a temporary card number or virtual card number for online shopping while you wait.
If fraudulent charges do appear on your account, report them to your issuer as soon as you notice them. Under federal law, your liability for unauthorized charges is limited to $50 if you report them promptly, and most issuers waive this fee entirely. The issuer will investigate the charge and typically reverse it within one to two billing cycles.
CVV versus other card security features
The CVV is one of several security features designed to protect your card. Your card also has a chip (EMV), which encrypts transaction data and makes the card harder to counterfeit than older magnetic-stripe-only cards. The chip is used at in-person terminals and offers stronger protection than the magnetic stripe alone.
Your card also has an expiration date, which limits how long a stolen card number can be used. Once your card expires, the number becomes invalid, even if someone has it. This is why issuers send replacement cards before expiration.
Some issuers also offer virtual card numbers or single-use card numbers for online shopping. These are temporary numbers linked to your account that work for one transaction or one merchant only. If the temporary number is compromised, it cannot be used elsewhere, limiting the damage from a breach.
Protecting your CVV from theft
Treat your CVV like you treat your PIN: do not write it down, do not store it in your phone or email, and do not share it with anyone except a merchant during a legitimate transaction. If you must keep a record of your card details, store only the last four digits of your account number, never the full number or the CVV.
When entering your CVV online, make sure you are on a secure website. Look for "https://" in the address bar and a padlock icon in your browser. Do not enter your CVV on a website that does not use encryption, even if it looks legitimate.
Be cautious with receipts. Many merchants now omit the CVV from printed receipts for this reason, but if your receipt shows the full card number or CVV, shred it or destroy it before throwing it away. Do not leave receipts in your car, wallet, or trash where someone could find them.
Frequently Asked Questions
Can someone use my card if they have my card number but not my CVV?
Not for online or phone purchases — the CVV is required to complete those transactions. However, they could potentially use your card number for in-person fraud if they create a counterfeit card or if a merchant does not ask for additional verification. This is why monitoring your account regularly is important.
Is it safe to save my CVV on a website for faster checkout?
No. Do not allow websites to store your CVV. Legitimate payment processors (like PayPal or Apple Pay) do not store the CVV; they store a token instead. If a website asks you to save your CVV, that is a red flag. Use a digital wallet or a one-time checkout option instead.
What should I do if I accidentally shared my CVV with someone?
Contact your card issuer immediately and request a replacement card. Your issuer will cancel the current card and issue a new one with a different CVV. Monitor your account closely for the next 30 to 60 days for any unauthorized charges.
Does my debit card have a CVV?
Yes. Debit cards have a CVV in the same location and format as credit cards. The CVV works the same way — it is required for online and phone purchases but not for in-person transactions. Protect your debit card CVV the same way you protect your credit card CVV.
Can I use my card online if the CVV is worn off or illegible?
No. If the CVV is not readable, you cannot complete online or phone transactions. Contact your issuer and request a replacement card. In the meantime, you can use the card for in-person purchases at physical stores.