The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back of your credit card — three digits for Visa, Mastercard, and Discover, four digits for American Express. It sits separate from your card number and expiration date. When you enter it during an online or phone purchase, the merchant sends it to your card issuer to verify that you have the physical card in your hand, not just a stolen card number.
The CVV is not stored in the magnetic stripe or chip on your card. It exists only on the card itself and in your card issuer's records. This design means that if someone steals your card number from a data breach, they cannot complete an online purchase without also knowing the CVV — which they would not have unless they also stole the physical card or a photo of it.
Different card networks call it different names: Visa and Discover call it CVV2, Mastercard calls it CVC2, and American Express calls it CID. The function is the same across all of them.
Key Takeaways
- The CVV is a three- or four-digit code on your card that merchants request to confirm you physically possess the card during online or phone transactions.
- Your CVV is never stored in your card's chip or magnetic stripe, and legitimate merchants do not save it after a transaction completes.
- If you enter your CVV on a website that does not use HTTPS encryption (shown by a padlock icon in your browser), the number can be intercepted during transmission.
- You should never share your CVV with anyone who contacts you by phone or email, even if they claim to represent your bank or card issuer.
Where the CVV appears on different card types
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, to the right of the signature panel. It is the last three digits of a longer number that appears on the back.
On American Express cards, the CVV is a four-digit number printed on the front of the card, above the card number on the right side. This placement is different from other card networks.
The CVV is always printed in a different color or font than the rest of the card to make it visually distinct. It is never embossed or raised like the card number — it is flat printed only.
Why merchants ask for it during online purchases
When you shop online, the merchant's payment system asks for your CVV to send to your card issuer for verification. The issuer checks that the CVV matches their records for that card number. If it does not match, the transaction is declined. This step takes a few seconds and happens behind the scenes.
The CVV protects both you and the merchant. For you, it means someone who has only your card number (from a stolen receipt or a data breach) cannot complete a purchase without the physical card. For the merchant, it means they have evidence that you authorized the transaction — the card issuer verified the CVV, so the merchant has some protection against chargebacks if you later dispute the charge.
Phone and mail orders also request the CVV for the same reason. When you call a company to place an order, they ask for the CVV to verify you have the card. Mail orders sometimes print a line for it on the order form.
What happens to your CVV after you enter it
Legitimate merchants and payment processors do not store your CVV after the transaction is complete. Payment Card Industry Data Security Standard (PCI DSS) rules forbid them from saving it. This means that even if a merchant's database is hacked, the CVV cannot be stolen because it was never stored there.
The CVV is transmitted to your card issuer for verification, checked against their records, and then discarded. Only your card issuer keeps a record of your CVV — they need it to verify future transactions.
If a company tells you they need to store your CVV for future charges (like a subscription or recurring payment), that is a red flag. Legitimate recurring billing systems use a different method called tokenization, where the merchant stores a token that represents your card but does not contain the CVV or full card number.
How to protect your CVV from theft
Never share your CVV over the phone unless you initiated the call to a merchant you know and trust. If someone calls you claiming to be from your bank or card issuer and asks for your CVV, hang up. Your actual bank will never ask for it by phone or email.
When entering your CVV online, check that the website uses HTTPS encryption — you will see a padlock icon in your browser's address bar. If the padlock is missing or the site shows "Not Secure," do not enter your CVV. Unencrypted websites transmit your data in plain text, where it can be intercepted.
Do not photograph your card or store photos of it on your phone or computer. Do not write your CVV down or store it anywhere. The only place your CVV should exist is on the physical card itself.
If your card is lost or stolen, contact your card issuer immediately. They will cancel the card and issue a replacement with a new CVV. Most card issuers offer fraud protection, so unauthorized charges made with your card are usually reversed, but reporting the loss quickly limits your liability.
CVV versus other card security features
Your card has multiple security layers. The card number itself identifies your account but does not prove you have the card. The expiration date shows when the card expires but is printed on the front where anyone can see it. The CVV proves you have the physical card because it is printed only on the card itself and not stored anywhere else.
Chip technology (EMV) adds another layer for in-person purchases. When you insert your card into a chip reader, the chip generates a unique code for that specific transaction. This code cannot be reused, so even if someone steals the code, they cannot use it again. Online purchases do not use the chip — they rely on the CVV instead.
Some cards also include a hologram or other visual security feature to make them harder to counterfeit, but these do not replace the CVV. They are just additional anti-counterfeiting measures.
What to do if your CVV is compromised
If you believe someone has your CVV — for example, you entered it on a suspicious website or shared it accidentally — contact your card issuer right away. Tell them you may have exposed your CVV and ask them to monitor your account for unauthorized charges.
Most card issuers will not automatically cancel your card just because the CVV may be known. However, they can flag your account for extra monitoring or issue you a new card with a new CVV if you request it. A new card means a new CVV, so even if someone has the old one, it will no longer work.
Check your card statements regularly for charges you do not recognize. If you find unauthorized charges, report them to your card issuer. Under federal law, your liability for fraudulent charges is limited — usually zero if you report it promptly, though this varies by card issuer and the type of fraud.
Frequently Asked Questions
Can someone use my card number without the CVV?
They can attempt to, but most online merchants will decline the transaction if the CVV is missing or incorrect. In-person purchases at physical stores do not require a CVV because the chip or magnetic stripe on your card is read directly. However, online and phone purchases almost always require it.
Is it safe to text my CVV to a merchant?
No. Text messages are not encrypted, so your CVV can be intercepted. Never send your CVV by text, email, or any unencrypted method. Only enter it on a secure website (HTTPS) or read it aloud during a phone call you initiated to a trusted merchant.
Why does American Express put the CVV on the front instead of the back?
American Express designed their cards differently from Visa and Mastercard. The four-digit CVV on the front of an Amex card serves the same purpose as the three-digit CVV on the back of other cards — it verifies you have the physical card. The placement does not make it more or less secure.
Do I need to memorize my CVV?
No. You should not memorize it or write it down. The CVV is meant to be used only when you have the physical card in front of you. If you memorize it and someone learns it, they could use it without having your card. Keep it visible only on the card itself.
What if a website asks me to save my CVV for future purchases?
Do not do it. Legitimate websites do not save CVVs. If a site asks you to save it, either the site is not secure or it is not following payment industry rules. Use a different payment method or shop elsewhere. For recurring charges, reputable merchants use tokenization instead, which does not require storing your CVV.