The CVV is a three- or four-digit security code printed on your card

The CVV (Card Verification Value) is a short number on your credit card that exists only to prove you physically hold the card. It is not encoded in the card's magnetic stripe or chip — it is printed on the surface. Visa and Mastercard call it the CVV2; American Express calls it the CID. The number sits on the back of most cards, in the signature panel. American Express prints it on the front, above the account number.

The CVV serves one purpose: when you make a purchase online or over the phone, you give the merchant this number along with your card number, expiration date, and billing address. The merchant sends it to the card network or bank to verify that you own the physical card. If someone has stolen your card number but not the card itself, they cannot complete the transaction without the CVV.

This is why merchants ask for it during online checkout and why you should never write it down, photograph it, or email it. The CVV is the last line of defense between your card number and unauthorized use.

Key Takeaways

  • The CVV is a three- or four-digit number printed on the back (or front, for American Express) of your card that proves you physically hold it.
  • Merchants request the CVV during online and phone purchases to verify the card is in your possession before processing the transaction.
  • The CVV is not stored in the card's magnetic stripe or chip, so thieves who steal your card number alone cannot use it without the CVV.
  • You should treat the CVV as sensitive as your card number and never share it via email, text, or phone unless you initiated the transaction.
  • Legitimate companies will never ask you to provide your CVV via email or unsolicited phone call — that is a sign of fraud.

Where to find your CVV and what it looks like

On Visa, Mastercard, and Discover cards, the CVV appears on the back of the card in the white signature panel, usually to the right of the signature line. It is a three-digit number. On American Express cards, the CVV (called the CID) is a four-digit number printed on the front of the card, above and to the right of the main account number.

The number is printed directly onto the card surface; it is not embossed like the account number. This matters because it means the CVV cannot be read by a card reader or skimmer — only by someone who can see or photograph the physical card. That is the entire design: the CVV proves you have the card in hand.

If you cannot find your CVV, check both the front and back of your card. If your card is damaged or the number is worn away, contact your card issuer and request a replacement card. They will mail you a new one with a new CVV printed on it.

Why merchants ask for the CVV during online purchases

When you shop online, the merchant never sees your physical card. They have no way to verify you own it except by asking for information only the cardholder would have. The CVV fills that gap. By requiring it, the merchant confirms that you have the card in your possession at the moment of purchase.

This reduces the merchant's fraud risk and protects you. If someone obtained your card number through a data breach or by skimming, they would have the number, expiration date, and possibly your name and billing address — but not the CVV. Without it, they cannot complete an online purchase at most retailers.

The CVV is also used in recurring billing situations, such as subscription services or automatic bill payments. When you set up autopay, you provide the CVV once, and the merchant stores it (though they should not store it long-term under payment card industry rules). On each billing cycle, they use it to verify the transaction.

What happens if someone gets your CVV

If your CVV is exposed — through a data breach, a phishing email, or because you shared it with a scammer — your card is at immediate risk of unauthorized charges. Someone with your card number, expiration date, and CVV can make online and phone purchases without your knowledge.

The good news is that CVV theft is usually caught quickly. Most card issuers monitor for unusual activity and will contact you or block the card if they see suspicious charges. If you notice unauthorized transactions, contact your card issuer immediately. Federal law limits your liability for fraudulent charges to $50, and most issuers waive that fee entirely if you report the fraud promptly.

If you believe your CVV has been compromised, call your card issuer and request a new card. They will cancel the old one and mail you a replacement with a new CVV. There is no charge for this, and the new card usually arrives within 7 to 10 business days. Until it arrives, your old card may still work for in-person purchases (where the CVV is not required), but online and phone transactions will be blocked.

CVV versus other card security features

The CVV is one layer of fraud protection, but it is not the only one. Your card also has a magnetic stripe and (on newer cards) an EMV chip. These encode your account number and expiration date, but not the CVV. When you swipe or insert your card in person, the merchant reads the stripe or chip but does not need the CVV because they can see the card itself.

Online, the situation reverses. The merchant cannot read your stripe or chip — they can only read what you type. So they ask for the CVV instead. This is why in-person fraud (card skimming, counterfeit cards) and online fraud (stolen card numbers) require different security measures.

Newer security tools like 3D Secure (Verified by Visa, Mastercard SecureCode) add another layer by requiring you to enter a password or receive a one-time code during checkout. But the CVV remains the baseline check for online and phone transactions.

Never give your CVV to someone who contacts you first

Scammers often call or email pretending to be from your bank or card issuer, claiming there is suspicious activity on your account. They ask you to "verify" your information by providing your card number, expiration date, and CVV. This is always a scam. Legitimate banks and card issuers will never ask you to provide your CVV via email, text, or unsolicited phone call.

If you receive such a request, hang up or delete the message. If you are concerned about your account, hang up and call the number on the back of your card or on your statement — the number you know is legitimate. The representative can look up your account without asking for your CVV.

The same rule applies to online shopping. If a website asks for your CVV in an email or through a pop-up, do not provide it. Legitimate merchants only ask for the CVV during checkout on their secure payment page. If you are unsure whether a request is real, contact the company directly using a phone number or website you know is theirs, not one provided in the suspicious message.

Storing and protecting your CVV

You should never write your CVV down, photograph it, or store it anywhere — not in your phone, not in a password manager, not in an email draft. The only time you should see or use your CVV is when you are actively making a purchase and you have the physical card in your hand.

If you use a digital wallet (Apple Pay, Google Pay, Samsung Pay), the wallet stores your card information in an encrypted format, but it does not store the CVV. When you make a purchase through the wallet, the CVV is not transmitted — the wallet uses a different security token instead. This is actually safer than entering your CVV manually.

For recurring charges (subscriptions, autopay), provide the CVV only to the merchant you trust, and only through their secure website or app — never via email or phone. Once the merchant has processed your first payment, they should not ask for the CVV again unless you are updating your payment method.

Frequently Asked Questions

Can someone use my card number without the CVV?

In person, yes — they can swipe or insert the card and the merchant will not ask for the CVV. Online or over the phone, no — most merchants require the CVV before processing the transaction. This is why card-present fraud (stolen physical cards) and card-not-present fraud (stolen numbers) are different problems.

Is it safe to give my CVV to online retailers?

Yes, if the website is secure and you initiated the transaction. Look for "https://" in the address bar and a padlock icon. Never provide your CVV to a website you reached through a link in an email or text — type the website address directly into your browser instead. Legitimate retailers use your CVV only to process that single transaction.

What if I give my CVV to a scammer?

Contact your card issuer immediately. They will cancel your card and mail you a replacement with a new CVV. Monitor your account for unauthorized charges over the next 30 to 60 days. Federal law limits your liability for fraud to $50, and most issuers waive that fee if you report it quickly.

Why does American Express put the CVV on the front of the card?

American Express uses a four-digit CVV (CID) and prints it on the front because their cards are primarily used by business customers who are accustomed to handling sensitive information carefully. The placement does not make it less secure — the CVV still proves you have the physical card.

Do I need to memorize my CVV?

No. You should have your physical card in hand whenever you need the CVV. If you memorize it and then lose the card, someone who finds it will have both the card and the number you memorized. Keep the CVV visible only on the card itself.