The CVV is a three- or four-digit security code printed on your card that proves you physically hold it

The CVV (Card Verification Value) is a short number on the back of your credit card — three digits for Visa, Mastercard, and Discover, or four digits for American Express (which calls it the CID). It sits separate from your card number, expiration date, and name. When you enter it during an online or phone purchase, you are telling the merchant "I have this card in my hands right now," which reduces the risk that a stolen card number alone can be used.

The CVV is not stored in the magnetic stripe or chip on your card. It is printed on the surface only. This design means that if someone steals your card number from a database or intercepts it online, they still cannot complete most transactions without also knowing this printed number — which they cannot get without physically seeing the card.

You should never share your CVV with anyone except during a legitimate purchase. No bank, credit card company, or government agency will ask for it by phone, email, or text. If someone asks for it outside of a checkout, that is a scam.

Key Takeaways

  • The CVV is a three- or four-digit number printed on your card that proves you physically possess it during a purchase.
  • Merchants use the CVV to verify that the person making the purchase has the actual card, not just the card number.
  • The CVV is never stored in your card's chip or magnetic stripe, so thieves who steal your card number alone cannot use it.
  • You should only enter your CVV during a legitimate checkout; no legitimate company will ask for it by phone, email, or text message.

Where to find your CVV and what it looks like

For Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. For American Express, the four-digit code appears on the front of the card, above the card number on the right side.

The CVV is always printed in a different color or style than the rest of the card to make it stand out. It is never embossed (raised) like your card number — it is only printed on the surface. This is intentional: the fact that it cannot be read by a card reader or copied from a database makes it useful as a security check.

Why merchants ask for it during online and phone purchases

When you buy something in a physical store and hand your card to the cashier, they can see that the card is real and that you have it. Online and over the phone, the merchant cannot see the card. The CVV is their way of confirming that you (or someone who physically has your card) are the one making the purchase.

The merchant sends your CVV to the card network (Visa, Mastercard, etc.) along with your purchase. The network checks whether the CVV matches the one on file for your card number. If it does not match, the transaction is declined. This check happens in seconds and you never see it.

The CVV does not may provide that a purchase is legitimate — a thief who has both your card number and your CVV can still make a purchase. But it does add a layer of friction. It means the thief needs more information than just a card number, which they might have stolen from a store database or a data breach.

What CVV fraud looks like and how to protect yourself

CVV fraud happens when someone has your card number and CVV and uses them to make purchases without your permission. This usually occurs after a data breach at a retailer or website, or when someone physically sees your card. Unlike card-present fraud (where someone uses a stolen physical card), CVV fraud happens entirely online or over the phone.

To protect your CVV: do not write it down or store it anywhere. Do not photograph it. Do not give it to anyone who calls you or emails you, even if they claim to be from your bank. Do not enter it on websites that do not have a secure checkout (look for "https://" and a lock icon in your browser). Do not use the same CVV across multiple cards — each card has its own.

If you notice charges on your card that you did not make, contact your card issuer right away. Most credit card companies limit your liability for unauthorized charges to $50, and many waive that entirely. The sooner you report it, the sooner they can freeze the card and investigate.

CVV versus other card security features

Your credit card has several security layers, and the CVV is just one. Your card number itself is a 16-digit code (15 for American Express) that identifies your account. Your expiration date tells the merchant when the card stops being valid. Your name matches the cardholder. Together, these pieces of information are called the "card data."

Modern cards also have a chip (also called an EMV chip) that creates a unique code for each transaction. When you insert your card into a chip reader at a store, the chip generates a one-time code that cannot be reused. This is more secure than the magnetic stripe, which stores the same data every time and can be copied. Online, you cannot use the chip, so merchants fall back on the CVV as a secondary check.

Some cards also offer virtual card numbers — temporary card numbers that work only once or for a specific merchant. If you use a virtual number for an online purchase, a thief who intercepts that number cannot use it anywhere else. Not all banks offer this feature, but it is worth asking about if you make frequent online purchases.

What happens if your CVV is compromised

If you believe your CVV has been compromised — for example, because you entered it on a website that was later hacked, or because someone saw your card — you do not need to panic. Your card issuer can issue you a new card with a new CVV at no cost. The old CVV will no longer work, even if someone has your card number.

You do not have to wait for fraud to happen. If you are worried that your CVV is in the wild, call your card issuer and ask for a replacement card. They can usually send one within 7 to 10 business days. In the meantime, monitor your account for unauthorized charges and set up account alerts if your issuer offers them.

If you have already been charged fraudulently, report it to your card issuer and file a dispute. You will likely receive a provisional credit while they investigate, and you will not be responsible for the unauthorized charge once they confirm it was fraud.

Frequently Asked Questions

Can someone use my card number without the CVV?

In some cases, yes. In-store purchases do not require a CVV because the card is physically present. Some older online merchants or subscription services may not ask for it. However, most major retailers and payment processors now require the CVV for online and phone purchases, so it does add real protection.

Is it safe to save my CVV on a website for faster checkout?

No. Never save your CVV on any website, even if the site offers to do so. Legitimate payment processors do not store CVVs — they store only your card number, expiration date, and name. If a website asks to save your CVV, that is a red flag that it may not be secure.

What if I give my CVV to a scammer?

Contact your card issuer immediately and report the fraud. Ask them to cancel your card and issue a new one. Monitor your account closely for the next 30 to 60 days. Most card issuers will not hold you responsible for fraudulent charges if you report them promptly.

Do I need to memorize my CVV?

No. You only need to know it when you are making a purchase. Keep your card in a safe place and look at it when you need the number. Do not write it down or store it in your phone, email, or anywhere else.

Why does American Express put the CVV on the front of the card?

American Express designed their cards differently for historical reasons. The four-digit code on the front serves the same purpose as the three-digit code on the back of other cards — it proves you have the card. The placement does not make it less secure.