Your CVV is a three- or four-digit security code printed on your card that proves you physically hold it

The CVV (Card Verification Value) is a number on the back of your credit card — or sometimes the front, depending on the card type — that exists only to verify you own the physical card. It is not encoded in the magnetic stripe or chip. When you enter it during an online or phone purchase, the merchant sends it to your card issuer, who checks whether the number matches their records. If it does not match, the transaction is declined.

The CVV serves one purpose: to reduce fraud on transactions where the merchant cannot read your card directly. It is a friction point that makes it harder for someone who has only your card number to complete a purchase. It does not protect you from all fraud, and it does not may provide a transaction will go through, but it is a standard security step that most online retailers and phone merchants require.

Key Takeaways

  • Your CVV is a three- or four-digit code on the back of your card (or front, for American Express) that only you should know or share.
  • The CVV is checked during online and phone purchases to confirm you physically possess the card, but it is not stored in the card's chip or stripe.
  • You should never write your CVV on a receipt, email it, or share it over the phone unless you initiated the call to a merchant you trust.
  • A CVV mismatch will cause a transaction to be declined, but a matching CVV does not may provide the transaction is legitimate or that fraud has not occurred elsewhere.
  • Thieves who have only your card number cannot complete most online purchases without the CVV, which is why protecting it matters more than protecting the number itself.

Where to find your CVV on different card types

For Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually in or near the signature panel. Look for a small group of numbers to the right of the signature line — that is your CVV.

American Express cards are different. The CVV on an Amex card is a four-digit number printed on the front of the card, above the card number on the right side. Some older Amex cards may have it on the back, but the front is standard for current cards.

If you cannot find the number on your physical card, log into your online account with your card issuer. Most banks and credit card companies display the CVV in your account dashboard, though some will only show it after you verify your identity through a security question or code sent to your phone.

Why merchants ask for your CVV and what they do with it

A merchant requests your CVV because they cannot physically swipe or insert your card. When you shop online or order by phone, the merchant has your card number but no way to confirm you are the person holding the card. The CVV is that confirmation.

The merchant sends your CVV to the card network (Visa, Mastercard, Discover, or American Express) or directly to your card issuer. The issuer checks the CVV against the one they have on file. If it matches, the transaction moves forward. If it does not match, the transaction is blocked and you will see a decline message.

Legitimate merchants do not store your CVV after the transaction. Payment Card Industry (PCI) rules forbid it. If a merchant asks you to email your CVV, write it on a receipt, or provide it over an unsecured channel, that is a red flag — do not do it. A legitimate business will only ask for it during a secure checkout or over a phone line you initiated to a number you know is correct.

What happens if your CVV does not match

If you enter an incorrect CVV during checkout, the transaction will be declined immediately. You will see an error message, usually something like "CVV verification failed" or "Card verification unsuccessful." The decline happens before any money leaves your account.

If this happens, check that you entered the number correctly — it is easy to misread a digit or two. Make sure you are looking at the right location on your card (back for Visa, Mastercard, and Discover; front for Amex). If you entered it correctly and it still does not match, contact your card issuer. A mismatch can mean the card issuer's records are out of sync with the physical card, which is rare but does happen.

A declined CVV does not hurt your credit score or create a fraud flag on your account. It is simply a failed transaction. You can try again immediately with the correct number.

How to protect your CVV from theft

Treat your CVV like you would treat the PIN for your debit card — do not share it unless you are the one who initiated the transaction. Never write it down, photograph it, or email it. Never give it to someone who called you, even if they claim to be from your bank. Your bank will never ask for your CVV over the phone.

When you shop online, make sure the website is secure. Look for "https://" at the start of the URL and a padlock icon in the address bar. These indicate the connection is encrypted. Avoid entering your CVV on public Wi-Fi networks or shared computers.

If you believe your CVV has been compromised — for example, you gave it to a website that turned out to be fraudulent — contact your card issuer immediately. You can request a new card with a new CVV. There is no charge for this, and the new card usually arrives within 7 to 10 business days. In the meantime, your issuer can flag your account and monitor it for unauthorized charges.

CVV versus other card security features

Your card has several security layers, and the CVV is just one. The card number itself is a 16-digit identifier (15 for American Express) that is encoded in the chip and magnetic stripe. The expiration date tells merchants when the card stops being valid. The cardholder name is printed on the front. Together, these make up the information a merchant needs to process a transaction.

The CVV is different because it is not encoded anywhere on the card's chip or stripe. It exists only as a printed number. This means a thief who steals your card number through a data breach cannot use that number alone to shop online — they also need the CVV, which they do not have. A thief who physically steals your card has the CVV but may be caught by other fraud detection tools, like address verification or transaction limits.

Chip technology and fraud monitoring by your card issuer provide additional protection. Your issuer watches for unusual spending patterns and can block transactions that look suspicious. If fraud does occur, you are protected by federal law — you are not liable for unauthorized charges if you report them promptly.

What to do if you see charges you did not make

If you spot a charge on your statement that you did not authorize, contact your card issuer right away. Most issuers have a fraud department that operates 24/7. You can find the number on the back of your card or in your online account.

Report the specific transaction — the date, amount, and merchant name. Your issuer will investigate and may issue a temporary credit to your account while they look into it. Under the Fair Credit Billing Act, you have up to 60 days from the date the charge appeared on your statement to dispute it. After you report it, your issuer has 30 days to investigate and respond.

Your issuer will likely cancel your current card and send you a new one with a new card number and CVV. They may also place a fraud alert on your credit file to make it harder for someone to open new accounts in your name. Keep an eye on your statements for the next few months to make sure no other unauthorized charges appear.

Frequently Asked Questions

Can someone use my card number without the CVV?

In person, yes — a thief with your card number can swipe or insert the card at a store. Online or by phone, no — most merchants require the CVV, and without it the transaction will be declined. This is why protecting your CVV is more important than protecting your card number alone.

Is it safe to give my CVV to a website I have never used before?

Only if the website is secure (look for https:// and a padlock icon) and the merchant is legitimate. If you are unsure about a website, search for reviews or contact the company through a phone number on their official website, not a number from the site you are shopping on. Never give your CVV to a website that does not have a secure checkout.

What if I forgot my CVV?

Log into your card issuer's website or app — most display your CVV in your account dashboard after you verify your identity. You can also call the number on the back of your card and speak to a representative who can read it to you. You can also look at your physical card; the CVV is printed right on it.

Does the CVV change if I get a new card?

Yes. Every time your card issuer sends you a new card — whether because yours expired, was lost, was stolen, or you requested a replacement — the new card will have a different CVV. The old CVV becomes invalid and cannot be used.

Can a CVV mismatch mean someone is trying to use my card fraudulently?

It can, but not always. A mismatch might mean someone entered the wrong number, or it might mean your card issuer's records are out of sync. If you see a declined transaction you did not attempt, contact your issuer. If you see multiple declines from merchants you did not contact, that is a stronger sign of fraud — report it immediately.