Your CVV is a three- or four-digit security code printed on your card, separate from your card number

The CVV (Card Verification Value) is a short code that lives on the back of your credit card, usually in the signature strip area. On Visa and Mastercard, it is three digits. On American Express, it is four digits and sits on the front. This code is not encoded in the magnetic stripe or chip — it is printed only on the physical card itself.

The CVV exists for one reason: to prove you actually have the card in your hand. When you buy something online or over the phone, the merchant asks for it because they cannot swipe or insert your card. Asking for the CVV is their way of checking that you are not just someone who memorized your card number from a receipt or a data breach.

Your bank and the card network (Visa, Mastercard, etc.) never store your CVV after the transaction clears. That is by design. If a hacker steals your card number from a store database, they cannot use it online without the CVV — and they cannot get the CVV from a database because it was never saved there.

Key Takeaways

  • Your CVV is a three- or four-digit code printed on your card that proves you physically possess it when you shop online or by phone.
  • Never share your CVV with anyone who calls you or emails you, even if they claim to be from your bank — your bank already has your account information and will never ask for it.
  • Merchants are not supposed to store your CVV after a transaction, so if your card number leaks from a store, the CVV cannot be used without the physical card.
  • If someone asks for your CVV in person at a store or gas pump, that is a sign of fraud — legitimate in-person payments do not require it.

Where the CVV appears on different card types

The location and length of your CVV depends on which card network issued it. Visa and Mastercard print a three-digit code on the back of the card, usually to the right of the signature strip. American Express prints a four-digit code on the front, above the card number on the right side. Discover cards also use a three-digit CVV on the back.

Some older cards or specialty cards may have the code in a slightly different spot, but the principle is the same: it is printed on the card itself and not stored in the chip or magnetic stripe. If you cannot find it, call the customer service number on the back of your card and ask where to look.

When you should and should not give out your CVV

You should provide your CVV when you shop online, order by phone from a merchant you trust, or use a payment app. These are situations where the merchant cannot physically see or swipe your card, so they ask for the CVV to confirm you have it. This is normal and expected.

You should never give your CVV to someone who calls you, texts you, or emails you claiming to be from your bank or credit card company. Your bank already knows your account number and has no reason to ask for it. If someone calls and asks for your CVV, hang up and call your bank directly using the number on the back of your card. This is one of the most common fraud tactics.

You should also never enter your CVV at a gas pump, ATM, or in-person store checkout. Legitimate card readers at these locations do not ask for it — they read it from the chip or magnetic stripe. If a machine asks for your CVV in person, do not use it and report it to the store or bank.

Why merchants ask for it but cannot keep it

Payment processors and card networks have strict rules about CVV storage. A merchant is allowed to ask for your CVV during a transaction to verify you have the card, but they are not allowed to store it in their system after the sale is complete. This rule exists because the CVV is your last line of defense if your card number leaks.

If a hacker breaks into a store's database and steals thousands of card numbers, those numbers alone are not enough to make online purchases — the thief would also need the CVV. Since the store never saved it, the thief cannot get it from the database. This is why the CVV is considered more sensitive than your card number itself.

Some merchants do try to break this rule, which is why data breaches sometimes include CVV codes. When that happens, those cards are at higher risk of fraud. If your card number is ever compromised in a breach, your bank will usually issue you a new card with a new CVV, which makes the old CVV useless to anyone who stole it.

What happens if someone gets your CVV

If someone obtains your CVV along with your card number, they can make online and phone purchases without having your physical card. This is why CVV theft is serious — it removes one of the protections that online shopping is supposed to have.

However, your liability is limited. Under federal law, if you report unauthorized charges within 60 days of seeing them on your statement, you are not responsible for them. Most credit card companies offer even stronger fraud protection and will reverse charges immediately once you report them. Call the number on the back of your card as soon as you notice something wrong.

If you believe your CVV has been compromised, contact your bank and ask for a new card. A new card will have a new CVV, which makes the old one worthless to anyone who stole it. You do not need to wait for fraudulent charges to appear — you can request a replacement card anytime you feel your security is at risk.

CVV versus other card security features

Your card has several layers of security, and the CVV is just one of them. Your card number itself is one layer. The chip (if your card has one) is another — it creates a unique code for each transaction that cannot be reused, which makes it much harder to counterfeit than the old magnetic stripe. The CVV is the layer that protects online and phone purchases specifically.

Together, these features make it harder for thieves to use a stolen card number in every situation. In person, they need the physical card or a chip reader. Online, they need the CVV. Over the phone, they need the CVV. No single piece of information is enough to commit fraud in every context, which is the whole point.

Frequently Asked Questions

Can someone use my card number without the CVV?

In person, yes — they can use a skimmed card number at a store or gas pump that only reads the magnetic stripe. Online or by phone, no — most merchants require the CVV. Some older or less secure websites might not ask for it, but reputable merchants do.

Is it safe to save my CVV in my browser or password manager?

No. Never save your CVV anywhere, even in a password manager. Your card number and expiration date can be saved if you want faster checkout, but the CVV should be entered fresh each time. If your password manager is hacked, your CVV stays protected because it was never stored there.

What should I do if I accidentally gave my CVV to someone suspicious?

Call your bank immediately using the number on the back of your card. Tell them you may have shared your CVV with an untrusted source. They can monitor your account for fraud and issue you a new card with a new CVV if they think it is necessary. Do not wait to see if charges appear.

Why does my bank's website ask for my CVV when I log in?

It should not. Your bank's login page should only ask for your username and password, or a PIN. If a website claiming to be your bank asks for your CVV during login, it is a phishing scam. Close the page and go directly to your bank's official website by typing the address yourself or calling the number on your card.

Do I need to memorize my CVV?

No. You only need to know where to find it on your card when you shop online. There is no reason to memorize it, and memorizing it does not make you safer. Keep your physical card secure, and you will keep your CVV secure.