The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a number on the back of your credit card — or the front, depending on American Express — that merchants use to confirm you own the card. It is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also knowing this code.
Visa and Mastercard cards have a three-digit CVV printed on the back, usually in the signature panel. American Express prints a four-digit code on the front, above the card number. Discover cards also use three digits on the back. The code changes only if you request a replacement card; it does not rotate or expire on its own.
When you enter your card details for an online purchase, the merchant sends the CVV to the card network (Visa, Mastercard, etc.) for verification. The network checks that the code matches the card number without revealing the actual code to the merchant. If the codes do not match, the transaction is declined.
Key Takeaways
- The CVV is a three- or four-digit code on your physical card that proves you have it in your possession when making online purchases.
- Visa and Mastercard use three digits on the back; American Express uses four digits on the front.
- Merchants never see your actual CVV — the card network verifies it behind the scenes and only tells the merchant whether it matched.
- You should never share your CVV with anyone over the phone, email, or text, even if they claim to represent your bank.
- A stolen card number without the CVV is much harder to use for online fraud, which is why the code exists.
Why merchants ask for the CVV
The CVV exists because online purchases are card-not-present transactions — the merchant cannot see or swipe your physical card. Without the CVV, a thief who obtained your card number through a data breach could immediately use it to buy things online. The CVV adds a second piece of information that is not stored anywhere digitally, making it much harder to commit fraud.
In-person purchases at a store or gas pump do not require a CVV because the card is physically present. The merchant can see the card and verify your signature or PIN. Online, phone, and mail-order purchases all ask for the CVV because the merchant has no way to confirm you have the card.
Some merchants also ask for the CVV when you save a card for future purchases — for example, when you set up a subscription or save your card to your account on a shopping website. This is a standard security practice, though you should always check that you are on the merchant's real website before entering it.
Where to find your CVV
For Visa, Mastercard, and Discover, look at the back of your card in the signature panel (the white or gray box on the back). The CVV is a three-digit number, usually printed to the right of the signature line or below it. Some cards print it above the signature line instead.
For American Express, the CVV is a four-digit number printed on the front of the card, above and to the right of the main card number. It is not on the back. This is one of the few ways American Express cards look different from other major cards.
If you cannot find the CVV on your physical card, you can also view it in your online banking portal or mobile app. Most banks and card issuers display the CVV in your account under card details, though some hide it for security and only show it when you are about to make a purchase.
How to protect your CVV
Never share your CVV over the phone, email, or text message, even if someone claims to represent your bank or card issuer. Banks and legitimate merchants will never ask you to provide your CVV this way. If someone calls asking for it, hang up and call your bank directly using the number on the back of your card.
When you enter your CVV online, make sure you are on a secure website — the URL should start with "https://" and there should be a padlock icon in the address bar. Do not enter your CVV on a website that does not use encryption, and do not use public Wi-Fi networks when entering sensitive card information.
If your card is lost or stolen, contact your card issuer immediately. They will cancel the card and issue a replacement with a new CVV. You are not responsible for fraudulent charges made after you report the card missing, as long as you report it promptly.
CVV versus other card security features
The CVV is one of several security features on your card, but it is not the only one. Your card also has a chip (the small metallic square), which creates a unique code for each transaction when you insert it into a chip reader. The chip is more secure than the magnetic stripe because it cannot be cloned as easily. The CVV protects online purchases; the chip protects in-person purchases.
Your card also has an expiration date, which is printed on the front. Some merchants ask for this along with the CVV as an additional check. The expiration date is less sensitive than the CVV because it is visible on the card and does not prove you have the card in your possession.
If you use a digital wallet like Apple Pay, Google Pay, or Samsung Pay, your actual card number and CVV are not shared with the merchant at all. Instead, the wallet creates a one-time token for each transaction. This is why digital wallets are considered more secure than entering your card details manually.
What happens if you enter the wrong CVV
If you enter an incorrect CVV, the transaction will be declined. The card network will reject it before the merchant ever sees your card number. You can try again with the correct code, and there is no penalty for entering it wrong — it simply does not go through.
If you enter the wrong CVV multiple times in a row, some merchants or banks may flag your account for suspicious activity and temporarily lock it. This is a fraud prevention measure. If this happens, contact your bank to confirm the activity was legitimate and to unlock your account.
Entering the wrong CVV is different from a declined card due to insufficient funds or a fraud block. A wrong CVV means the code itself did not match; other declines have different causes. If your card is being declined for reasons other than a wrong CVV, your bank can tell you why.
CVV and data breaches
When a retailer's database is hacked and customer card information is stolen, the CVV is usually not included in the breach. This is because merchants are not supposed to store the CVV after a transaction is complete — they only use it to verify the transaction and then delete it. This rule is part of the Payment Card Industry Data Security Standard (PCI DSS), which all merchants who accept cards must follow.
If a merchant stores your CVV and their system is breached, that is a violation of PCI DSS rules and a serious security failure. You should report it to your card issuer and monitor your account for fraud. However, this is rare because the rules are strict and merchants face heavy penalties for storing CVVs.
Even if your card number is stolen in a breach, a thief cannot use it for online purchases without the CVV. This is why the CVV exists — to add a layer of protection that is not stored anywhere digitally. If you discover your card number was compromised, contact your bank to cancel the card and request a replacement.
Frequently Asked Questions
Can someone use my card number without the CVV?
Not for online purchases. A thief with only your card number cannot complete an online transaction without the CVV. They could potentially use it in person if they had a physical card, but they cannot order online or over the phone without the code. This is the main reason the CVV exists.
Is it safe to save my CVV in my browser or password manager?
No. Do not save your CVV anywhere, including your browser's autofill, password managers, or notes. The CVV is meant to be entered manually each time to prove you have the card. If your browser or device is compromised, saving the CVV puts it at risk. Enter it fresh every time.
What if I forgot my CVV?
Look at the back of your physical card — it is printed there. If you do not have your card with you, check your bank's website or mobile app; most banks display the CVV in your account details. If you still cannot find it, contact your bank and they can tell you what it is.
Do I need the CVV for in-person purchases?
No. When you swipe, insert, or tap your card in person, the merchant does not ask for the CVV. The chip or magnetic stripe handles the verification. The CVV is only for online, phone, and mail-order purchases where the merchant cannot see your physical card.
Can a merchant refuse to process my card if I will not give them the CVV?
For online purchases, yes — the CVV is required for card-not-present transactions. For in-person purchases, no — they should never ask for it. If a store clerk asks for your CVV at the register, that is unusual and you should decline and use a different payment method or store.