The CVV is a three- or four-digit code that proves you physically hold the card
The CVV (Card Verification Value) is a security code printed on your credit card that merchants use to confirm you have the physical card in your hand. It is not stored in the card's magnetic stripe or chip, which means a thief who steals your card number alone cannot use it online without also knowing this code.
The code sits in a different location depending on your card type. On Visa, Mastercard, and Discover cards, it is a three-digit number on the back, usually printed to the right of the signature panel. American Express prints a four-digit code on the front, above the card number on the right side.
Different card networks call this code by different names — Visa calls it CVV2, Mastercard calls it CVC2, Discover calls it CID, and American Express calls it CID as well — but they all serve the same purpose: to verify that the person making the purchase has the card itself.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card that you must provide for online and phone purchases, but never for in-person transactions.
- Visa, Mastercard, and Discover print the CVV on the back of the card; American Express prints it on the front.
- You should never share your CVV with anyone except the merchant you are actively paying, and legitimate companies will never ask for it via email or phone.
- Merchants are not allowed to store your CVV after a transaction completes, which limits the damage if their database is breached.
- A CVV protects you against fraud when someone has your card number but not the physical card, though it does not protect against in-person theft.
When you need to provide your CVV
You provide your CVV whenever you make a purchase without physically handing your card to the merchant. This includes online shopping, phone orders, and mail orders. The merchant's payment processor checks the CVV against the card issuer's records to confirm the code matches — if it does not, the transaction is declined.
You do not provide your CVV at a physical store, gas pump, or ATM. When you insert or tap your card in person, the terminal reads the chip or magnetic stripe, which contains different security information. Asking for a CVV in person is a sign of fraud.
Some merchants also ask for your CVV when you save your card on file for future purchases. This varies by company and by payment processor. If you are uncomfortable storing your card with a merchant, you can usually pay with a different method instead.
Why merchants cannot keep your CVV
Payment Card Industry Data Security Standard (PCI DSS) rules forbid merchants from storing your CVV after a transaction is complete. This is one of the few pieces of card information that companies are legally required to delete immediately.
The reason is straightforward: if a merchant's database is hacked, a thief who steals your card number still cannot use it online without the CVV. By not storing the code, companies limit the damage a breach can cause. If a merchant asks you to provide your CVV again for a repeat purchase, that is normal — they genuinely do not have it on file.
This rule applies to all merchants, regardless of size. A small business and a major retailer face the same requirement. If you discover that a company has stored your CVV, you can report it to your card issuer, and the issuer can take action against the merchant.
How to protect your CVV from fraud
Treat your CVV the same way you treat your card number: share it only with merchants you trust and only when you are actively making a purchase. Never provide it via email, text, or phone call, even if someone claims to represent your bank or a company you do business with.
Legitimate companies will never ask for your CVV by email or unsolicited phone call. If someone contacts you asking for this code, hang up or delete the message and call the company directly using a number from your statement or their official website. This protects you against phishing scams, where a fraudster impersonates a real company.
When shopping online, only enter your CVV on a secure payment page — look for a URL that starts with "https://" and a padlock icon in your browser. Avoid entering card details on public Wi-Fi networks, and consider using a virtual card number if your bank offers one. Virtual card numbers are temporary numbers tied to your real account that expire after one use or one merchant, adding a layer of protection.
What happens if your CVV is compromised
If someone obtains your CVV along with your card number, they can attempt online purchases. However, most online merchants also verify the billing address and zip code you provide, which adds another barrier. If the address does not match the card issuer's records, the transaction fails.
If you notice unauthorized charges on your statement, contact your card issuer immediately. You are not responsible for fraudulent charges under federal law, and your issuer will investigate and issue a refund. The issuer may also issue you a new card with a new number and new CVV.
If your card is physically lost or stolen, the CVV does not protect you — a thief with the physical card can use it in stores. Call your issuer right away to report the loss, and they will cancel the card and send a replacement.
CVV versus other card security features
The CVV is one layer of fraud protection, but it works alongside other security measures. The chip embedded in modern cards creates a unique code for each transaction, which is why chip readers are more secure than magnetic stripe readers. The chip code cannot be reused, so stealing it from one transaction does not help a fraudster make another purchase.
Your billing address and zip code are also verified during online purchases. Some merchants and card issuers use additional tools like 3D Secure (a protocol that adds a password step to online checkout) or machine learning systems that flag suspicious patterns. None of these tools are perfect, but together they make it much harder for a fraudster to use a stolen card number.
The CVV specifically protects against card-not-present fraud — situations where someone has your number but not your physical card. It does not protect against in-person theft, data breaches at merchants, or phishing scams where you voluntarily give your information to a fraudster.
Frequently Asked Questions
Can someone use my card number without the CVV?
Not for online purchases — most merchants require the CVV before processing. However, in-person fraud and phone orders sometimes succeed without it, depending on the merchant's security practices. If your card number is stolen, contact your issuer immediately rather than waiting to see if charges appear.
Is it safe to give my CVV to a website I have never used before?
Only if the website is secure (look for "https://" and a padlock icon) and the company is legitimate. Check reviews and verify the website address matches the company's official site — fraudsters create fake websites that look nearly identical to real ones. When in doubt, use a different payment method or shop elsewhere.
What should I do if a company asks for my CVV via email?
Do not provide it. Legitimate companies never ask for sensitive card information by email or unsolicited phone call. If you are unsure whether the request is real, hang up or ignore the message and call the company directly using a number from your statement or their official website.
Does the CVV protect me if my card is stolen in person?
No. A thief with your physical card can use it in stores and online without needing the CVV, since they have the card itself. Report the theft to your card issuer immediately so they can cancel the card and issue a replacement.
Why do some merchants ask for the CVV when I save my card on file?
They are verifying that you have the physical card before storing your card number for future use. This is a security step to prevent someone from saving a stolen card number. Once the transaction completes, the merchant deletes the CVV and keeps only the card number.