The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a short number on the back or front of your credit card that exists for one reason: to reduce fraud when you can't hand the card to someone in person. When you buy something online, over the phone, or by mail, the merchant asks for this code to confirm you actually possess the physical card — not just the card number.
The CVV is not stored in the card's magnetic stripe or chip. It's printed on the card itself. This means a thief who steals your card number from a data breach still cannot complete an online purchase without also knowing this printed code. That separation is the whole point.
You'll find the CVV in different places depending on your card type. On Visa, Mastercard, and Discover cards, it's a three-digit number on the back, usually in the signature strip area. On American Express cards, it's a four-digit code printed on the front, above the card number.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card that you must provide for online, phone, and mail purchases to prove you have the physical card.
- The CVV is never stored in your card's chip or magnetic stripe, so a stolen card number alone cannot be used to make online purchases without it.
- You should never share your CVV with anyone except the merchant you are actively buying from, and legitimate companies will never ask for it via email or phone.
- Merchants are not allowed to store your CVV after the transaction completes, so if you see it saved in your account, that is a sign of a security problem.
Why merchants ask for the CVV instead of just using your card number
A card number alone is not enough proof that you own the card. Criminals can obtain card numbers through data breaches, phishing, or by skimming a card reader. But the CVV is printed only on the physical card — it never travels through the card reader, never gets stored in a database, and never appears in your email receipts.
When you enter your CVV during an online purchase, you are telling the merchant: "I have this card in my hands right now." This extra step stops most fraudulent purchases because a thief with only a stolen card number cannot complete the transaction without the code.
The CVV also protects you. If someone uses your card number fraudulently and you report it, your card issuer can see that the fraudulent transaction was missing the CVV or had the wrong one. That evidence helps prove you did not make the purchase.
Where you will be asked to enter your CVV
You'll enter your CVV during checkout on any website that accepts credit cards — online retailers, subscription services, travel booking sites, and digital payment platforms all ask for it. You'll also provide it when you give your card number over the phone to a business, and sometimes when you mail in an order form.
The CVV field is usually labeled "CVV," "CVC," "Card Security Code," or "Security Code." It's always near the other card information fields (card number, expiration date, cardholder name). Most checkout pages will not let you complete your purchase without entering it.
You should never need to provide your CVV for in-person purchases. If you hand your card to a cashier or insert it into a chip reader at a store, the CVV is not part of that transaction. If someone asks for your CVV in person, that is a red flag for fraud.
The difference between CVV, CVC, and other security code names
Different card companies use different names for the same thing. Visa calls it the CVV2, Mastercard calls it the CVC (Card Verification Code), Discover calls it the CID (Card Identification), and American Express calls it the CID as well. Visa and Mastercard also sometimes use the generic term "security code."
Despite the different names, they all work the same way: a printed code that proves you have the physical card. When a website asks for your "security code" or "CVV," they are asking for this same number. You do not need to know which company's term applies to your card — just look for the short code printed on the back (or front, for American Express).
What you should never do with your CVV
Never share your CVV with anyone except during an active purchase with a merchant you trust. Do not give it to your bank, a government agency, or a customer service representative who calls you. Legitimate companies will never ask for your CVV via email, text, or unsolicited phone call.
Do not write your CVV down or store it anywhere — not in your phone, not in a note, not in your email. The whole security benefit of the CVV is that it exists only on the physical card. If you write it down, you have defeated that protection.
Do not enter your CVV on a website unless you are certain the site is legitimate and secure. Look for "https://" in the address bar and a padlock icon. If a website seems suspicious or you are unsure, do not complete the purchase. A legitimate merchant will never pressure you to enter payment information on an unsafe connection.
Why merchants cannot keep your CVV after the transaction
Payment card networks have strict rules: merchants are not allowed to store your CVV after your purchase is complete. This rule exists specifically to reduce fraud. If a merchant's database is breached, the thief gets your card number but not the CVV, so they still cannot make online purchases with it.
If you see your CVV saved in your account on a website — for example, in a saved payment method — that is a sign the merchant is breaking the rules. You should contact them to report the problem and consider whether you want to continue using that service. You can also report it to your card issuer.
This rule is one reason why subscription services and repeat-purchase sites ask you to save your card but do not ask you to save your CVV. They store the card number so they can charge you each month, but they cannot legally store the code.
What happens if someone has your card number but not your CVV
A thief with only your card number can still cause damage — they can attempt in-person fraud or try to use the number at merchants who do not ask for a CVV. But they cannot complete most online purchases, which is where the majority of card fraud happens today.
If you notice unauthorized charges on your statement, report them to your card issuer right away. Most card companies offer fraud protection that limits your liability for unauthorized purchases. You will likely not be charged for the fraudulent transaction, though the process can take a few weeks.
The best protection is to monitor your statements regularly and set up account alerts with your card issuer. Many banks will text or email you when a charge over a certain amount is made, which lets you catch fraud quickly.
Frequently Asked Questions
Can someone use my credit card number online without the CVV?
Most major retailers require the CVV for online purchases, so a thief with only your card number will be blocked at checkout. However, some smaller merchants or international sites may not ask for it, so it is still possible but less common. This is why monitoring your statements matters.
Is it safe to give my CVV to a website I have never used before?
Only if the website is secure (look for "https://" and a padlock icon) and you trust the company. If you are unsure about a site, do not enter your payment information. You can always call the company directly to confirm their website address before entering sensitive data.
What should I do if I accidentally shared my CVV with someone?
Contact your card issuer immediately and ask them to cancel your card and issue a new one. They may also place a fraud alert on your account. Do not wait — the sooner you report it, the sooner you can stop unauthorized charges.
Why do some websites ask for my CVV even for saved payment methods?
Some merchants ask for the CVV again as an extra security step, even if you have saved your card. This is actually a good sign — it means they are taking fraud prevention seriously. You can enter it safely because they will not store it after the transaction.
Is the CVV the same as my PIN?
No. Your PIN is a number you create and use at ATMs and chip readers in stores. Your CVV is printed on the card and used only for online, phone, and mail purchases. They protect different types of transactions and should never be shared with anyone.