The CVV is a three- or four-digit security code printed on your credit card that proves you physically have the card when you make an online or phone purchase

The CVV (Card Verification Value) or CVC (Card Verification Code) is not part of your account number. It is a separate code that card networks — Visa, Mastercard, American Express, Discover — add to the card itself as a fraud check. When you buy something online or over the phone, the merchant asks for this number to confirm you are not just using a stolen account number from a data breach. If someone has only your card number and expiration date but not the CVV, they cannot complete most online transactions.

The code sits in a different place depending on your card type. On Visa, Mastercard, and Discover cards, it is a three-digit number on the back of the card, usually to the right of the signature strip. American Express prints a four-digit code on the front, above the account number on the right side. Some cards also print it on the front in smaller text.

Key Takeaways

  • The CVV is a three- or four-digit number that proves you have the physical card, separate from your account number.
  • Visa, Mastercard, and Discover use a three-digit CVV on the back; American Express uses a four-digit code on the front.
  • Never share your CVV with anyone by phone, email, or text, and never enter it on a website unless you are making a purchase.
  • The CVV protects you against fraud when you shop online, but it does not protect you if someone steals your physical card.
  • Legitimate merchants always ask for the CVV during checkout; if they ask for it outside that context, it is a scam.

Why the CVV exists and what it stops

A stolen credit card number alone is not enough to make an online purchase at most retailers. The CVV requirement forces a criminal to have physical access to the card or to have stolen both the number and the security code from a data breach. This stops many fraud attempts that start with a single piece of stolen data.

The CVV does not protect you if someone steals your physical card and uses it in a store, because they have the card in hand. It also does not protect you if a data breach exposes both your account number and your CVV at the same time — which happens. But it does raise the bar for someone who only has your number from a website or a phone call.

Where to find your CVV and how to read it

Look at the back of your card first. Most cards have a white or light-colored strip where you sign your name. To the right of that strip, you will see a three-digit number printed in a different style or color than the rest of the card. That is your CVV. If you have an American Express card, flip it over and look at the front instead. You will see a four-digit number printed above your account number on the right side of the card.

The CVV is always printed, never embossed or raised like your account number. This makes it harder to read from a photocopy or a photo, which is part of why it works as a security feature. If you cannot find it, call the customer service number on the back of your card and ask where the CVV is located on your specific card.

When merchants ask for your CVV and when they should not

A legitimate merchant asks for your CVV only during checkout when you are making a purchase online or over the phone. They ask for it at the moment you are entering your card information to pay. This is normal and expected.

Never give your CVV to anyone who calls you, texts you, or emails you — even if they claim to be from your bank or the card company. Your bank already has your account number and does not need the CVV to verify your identity. If someone asks for your CVV outside of a purchase, it is a scam. Hang up, do not respond to the text or email, and call your card issuer directly using the number on the back of your card.

What happens if your CVV is stolen

If your CVV is exposed in a data breach or you suspect someone has it, contact your card issuer right away. You do not have to wait for fraud to appear on your statement. The card company can cancel your current card and send you a new one with a new CVV. This is free and usually takes five to ten business days.

Once you have a new card, your old CVV is useless. Even if a criminal has it, they cannot use it because it no longer matches any active card. This is why replacing your card is the fastest way to stop fraud if you think your security code has been compromised.

CVV versus other card security features

The CVV is one layer of fraud protection, but not the only one. Your card also has an expiration date, which changes every few years. It has an account number, which is unique to you. It may have a chip (EMV), which creates a one-time code for each in-person transaction so the same code cannot be reused. Some cards also have a contactless symbol, which lets you tap instead of swiping.

Together, these features make it harder for a criminal to use a stolen card number. The CVV stops online fraud. The chip stops in-person fraud. The expiration date forces you to get a new card periodically, which automatically invalidates old stolen numbers. No single feature stops all fraud, but they work together to raise the cost and difficulty of stealing from you.

How to protect your CVV

Treat your CVV like you treat your PIN at an ATM. Do not write it down. Do not take a photo of it. Do not text it or email it. Do not say it out loud where others can hear. Only enter it on a website you trust, and only when you are making a purchase.

Before you enter your CVV online, check that the website address starts with "https://" (not just "http://") and that there is a padlock icon in the address bar. These signs mean the website is using encryption to protect your information as it travels. They do not may provide the site is legitimate, but they do mean your CVV is harder to intercept in transit.

Frequently Asked Questions

Can someone use my card number without the CVV?

Most online retailers require the CVV, so a criminal with only your account number cannot complete a purchase at those sites. However, some older or less secure websites may not ask for it. In-person transactions do not require the CVV at all. If your card number is stolen, contact your issuer to cancel the card and get a replacement.

Is it safe to give my CVV to a website?

Yes, if you are making a purchase on a website you trust and the address starts with "https://" with a padlock icon. Never enter your CVV on a website you reached by clicking a link in an email or text message. Type the website address directly into your browser instead, or call the company to verify the link is real.

What if I forgot my CVV?

Look at the back of your card. If you cannot see it clearly, call the customer service number on the back of your card and ask. The representative can read it to you over the phone. Never share your CVV with anyone except during an actual purchase with a merchant you trust.

Does the CVV change?

Your CVV stays the same for the life of that card. When you get a new card — whether because yours expired, was lost, or was compromised — the new card will have a different CVV. The old CVV becomes useless once the old card is deactivated.

Can I use my card online without a CVV?

Most major retailers require it, but some do not. Older websites, subscription services, and some international merchants may skip the CVV check. If a site does not ask for it, that does not mean it is unsafe — it just means they are using a different fraud prevention method or have a different risk tolerance.