The CVV is a three- or four-digit security code printed on your card that proves you physically hold it

The CVV (Card Verification Value) is a number on the back of your credit card — or the front, depending on your card type — that exists only to verify you have the physical card in your hand. When you enter it during an online or phone purchase, you are telling the merchant and your bank that you are not just using a card number you found somewhere; you actually possess the card itself.

The CVV is not stored in the magnetic stripe or chip on your card. It is printed on the card surface only. This design means that a thief who steals your card number from a database cannot use it online without also having the card in front of them to read the code.

Your bank does not ask you for your CVV when you call to make a payment or check your balance. Legitimate companies do not store your CVV after a transaction. If someone asks for it via email or text, that is a fraud attempt.

Key Takeaways

  • The CVV is a three- or four-digit code printed on your card that proves you physically hold it; Visa, Mastercard, and Discover use three digits on the back, while American Express uses four digits on the front.
  • Merchants and payment processors use the CVV to reduce fraud on card-not-present transactions like online and phone purchases.
  • Your bank and legitimate merchants do not store your CVV after the transaction is complete, so it should never appear in your email receipts or account statements.
  • You should never give your CVV to anyone who contacts you unsolicited, and no legitimate company will ask for it via email, text, or phone call.

Where the CVV appears on different card types

Most cards — Visa, Mastercard, and Discover — print the CVV on the back of the card, to the right of the signature strip. It is the last three digits of a longer number. American Express prints its four-digit code on the front of the card, above the account number on the right side. Some American Express cards also print a three-digit code on the back.

The exact position and format can vary slightly between banks, but the location is always the same for each card brand. If you cannot find your CVV, check your card issuer's website or call the number on the back of your card.

How merchants use the CVV during a transaction

When you enter your card number, expiration date, and CVV on a website or over the phone, that information travels to the payment processor. The processor sends the CVV to your bank in a separate message from the card number itself. Your bank checks whether the CVV matches the one on file for that card.

If the CVV is correct, the transaction moves forward. If it is wrong or missing, the transaction is declined. This check happens in seconds and is invisible to you unless the transaction fails.

The CVV check catches many fraudulent transactions because someone using a stolen card number alone — from a data breach or a discarded receipt — cannot complete the purchase without the physical card in front of them.

What happens to your CVV after you use it

By law, merchants and payment processors must not store your CVV after the transaction is complete. Your receipt should never show the full CVV. Your bank statement will not include it. If you see your CVV in an email confirmation or on a website, that is a sign of a security failure or a scam.

This rule exists because the CVV is meant to be a one-time proof that you held the card. Storing it would defeat the entire purpose. If a merchant's database is breached, the CVV cannot be stolen because it was never saved there.

CVV fraud and when thieves cannot use it

A thief who has only your card number and expiration date cannot complete most online purchases without the CVV. This is why card-not-present fraud — theft of card numbers from databases — is less damaging than it would be without the CVV requirement.

However, the CVV does not protect you against in-person fraud. If someone steals your physical card, they have the CVV and can use it at any store or ATM. It also does not protect you if you give your full card details (including CVV) to a scammer over the phone or email.

The CVV is one layer of security, not a complete shield. Monitoring your statements and reporting unauthorized charges quickly is still essential.

Keeping your CVV safe

Never write your CVV down or store it anywhere. Do not take a photo of your card that shows the CVV. Do not give it to anyone who calls or emails you unsolicited — your bank will never ask for it this way.

When you shop online, only enter your CVV on secure websites. Look for the padlock icon in your browser's address bar and make sure the URL begins with "https://" rather than "http://". If a website seems suspicious or asks for your CVV in an unusual way, do not complete the purchase.

If your card is lost or stolen, call your bank immediately. Your bank will cancel the card and issue a new one with a new CVV. You do not need to worry about someone using the old CVV because it will no longer be valid once the card is deactivated.

CVV requirements across different payment methods

Most online retailers require the CVV for credit and debit card purchases. Some merchants make it optional, though this is less common. Subscription services, digital wallets, and recurring payment setups may store your card information but still verify the CVV on the first transaction.

If you are making a purchase in person at a store or restaurant, you do not enter a CVV — the card reader reads the chip or magnetic stripe instead. The CVV is specifically for card-not-present transactions where the merchant cannot physically inspect your card.

Frequently Asked Questions

Is my CVV the same as my PIN?

No. Your PIN is a four-digit number you create and use at ATMs and in-store card readers. Your CVV is printed on the card and cannot be changed. The PIN protects your account when you use the card in person; the CVV protects it when you use the card online or by phone.

What should I do if I see my CVV on a receipt or email?

Contact the merchant or your bank immediately. A receipt or email showing your full CVV means the company is not following payment security rules. Ask them to confirm they did not store the CVV, and consider whether you want to continue using that merchant.

Can I use my card online without entering a CVV?

Some websites allow it, but most require the CVV. If a site does not ask for it, the transaction may still be processed, but it carries higher fraud risk for the merchant. You cannot force a website to skip the CVV requirement.

What if I forget my CVV?

Look at the back (or front, for American Express) of your physical card. If you do not have the card with you, you can call your bank and they can read it to you over the phone — they have it on file. Do not ask a merchant or website to tell you what your CVV is.

Does the CVV protect me if my card number is stolen?

It protects you against online and phone fraud, because a thief needs the CVV to complete those transactions. It does not protect you against in-person fraud if your physical card is stolen, or against fraud if you give your full card details (including CVV) to a scammer.