The CVV or CVC is a three- or four-digit security code printed on your card that proves you physically have it when you make an online or phone purchase

The CVV (Card Verification Value) or CVC (Card Verification Code) is a number separate from your card number that sits on the back or front of your physical card. Visa and Mastercard call it CVV; American Express calls it CVC. It exists for one reason: to confirm you actually hold the card in your hand when you're buying something without showing it to a clerk in person.

When you enter your card number, expiration date, and CVV into a website or give them to a phone operator, that CVV gets sent to the card network (Visa, Mastercard, etc.) to verify. The merchant never stores it. If someone has stolen only your card number but not the physical card, they won't have this code and the transaction will be declined.

This is why the CVV matters: a thief with your card number alone cannot complete most online purchases. They need the three or four digits on the back of the actual card. It's a speed bump, not a wall, but it stops the majority of card-not-present fraud.

Key Takeaways

  • The CVV is a three- or four-digit code on your card that you must provide for online and phone purchases, but never for in-person swipes.
  • Visa and Mastercard print the CVV on the back of the card below the signature line; American Express prints it on the front above the card number.
  • The merchant's website or phone system sends the CVV to the card network to verify, but the merchant is not supposed to store it in their system.
  • Never give your CVV to anyone who calls you or emails you claiming to be from your bank or card company — your bank already has your card on file.
  • If your card is lost or stolen, contact your card issuer immediately; the CVV alone cannot be used without the card number and expiration date.

Where the CVV appears on different card types

Visa and Mastercard cards have the CVV printed in the signature panel on the back, usually as the last three digits after a longer number. You'll see it to the right of the blank line where you sign. American Express is different: the four-digit CVC appears on the front of the card, above and to the right of the main card number.

Discover cards follow the Visa/Mastercard format — three digits on the back in the signature area. If you're looking at your card and can't find it, check the back first. The code is always printed, never embossed, so it won't be raised like the card number itself.

Why merchants ask for it but shouldn't store it

When you buy something online, the website asks for your CVV as part of the payment form. The merchant's payment processor sends that code to Visa, Mastercard, or American Express to verify the transaction. If the CVV matches what the card network has on file, the purchase goes through. If it doesn't, the transaction is blocked.

Here's the critical part: the merchant is not supposed to keep the CVV in their database. Payment Card Industry (PCI) rules forbid it. If a hacker breaks into a store's system and steals customer card data, they should find card numbers and expiration dates but not CVVs. That's the whole point of the rule — even if a merchant's database is compromised, the CVV stays out of the thief's hands.

In practice, some smaller merchants or older systems may not follow this rule perfectly, which is why the CVV is not a complete solution to fraud. But it does stop most automated card-testing attacks, where thieves run through thousands of stolen card numbers to see which ones work.

When you should and shouldn't give your CVV

Give your CVV when you're making a legitimate purchase online, over the phone with a company you called yourself, or through an app. These are card-not-present situations where the merchant has no way to verify you own the card except through the CVV.

Never give your CVV if someone calls you or emails you asking for it. Your bank, your card company, and legitimate merchants will never ask for your CVV unsolicited. If you receive a call claiming to be from your bank asking for your CVV, hang up and call the number on the back of your card directly. This is a common phishing tactic.

Do not give your CVV for in-person purchases at a store or restaurant. When you hand your card to a clerk or insert it into a chip reader, no CVV is needed. If someone asks for it in person, that's a red flag.

What happens if your CVV is compromised

If you believe your CVV has been exposed — for example, through a data breach at a merchant where you shopped — contact your card issuer right away. You don't need to wait for fraud to appear on your statement. Your issuer can issue you a new card with a new CVV, which takes about 7 to 10 business days in most cases.

A CVV alone, without your card number and expiration date, is nearly useless to a thief. They cannot make a purchase with just those three digits. However, if your full card details (number, expiration date, and CVV) have all been stolen, your card issuer will want to know immediately so they can monitor for fraud or reissue your card.

If fraudulent charges do appear on your statement, report them to your card issuer. Most card companies offer zero-liability protection for unauthorized charges, meaning you won't pay for fraud. The issuer will investigate and typically issue a credit within 10 business days while they look into it.

How CVV verification actually works behind the scenes

When you enter your card details into a checkout form, the website sends your card number, expiration date, and CVV to a payment processor. The processor forwards the CVV to the card network (Visa, Mastercard, American Express, or Discover) for verification. The network checks the CVV against the one they have on file for that card.

The network returns a response code: match, no match, or unable to verify. A match means the transaction can proceed (though it may still be declined for other reasons, like insufficient funds or a fraud alert). A no-match usually means the transaction is declined immediately. The merchant never sees your actual CVV — only the response code.

This verification happens in seconds. The entire point is speed and security: the merchant gets confirmation that you have the physical card without ever needing to store the proof.

CVV is not the same as security

The CVV reduces one specific type of fraud — someone using a stolen card number without the physical card. It does not protect you from other risks: a data breach at a merchant, a phishing email that tricks you into entering your details on a fake website, or a skimmer device on an ATM that captures your card information.

The CVV is one layer in a larger security system. Other protections include your card issuer's fraud monitoring, your bank's zero-liability policy, and your own vigilance about where you enter your card details. Use the CVV as intended, but don't assume it's a complete shield.

Frequently Asked Questions

Can someone use my card with just the CVV?

No. A thief needs your full card number, expiration date, and CVV to make an online purchase. The CVV alone is useless without the other information. If only your CVV has been exposed, your card is still safe as long as your card number remains private.

Why does American Express put the CVC on the front instead of the back?

American Express designed their cards differently and chose to print the four-digit CVC on the front. The reason is historical — it was part of their original card design. The function is identical: it verifies you have the physical card. Amex's four-digit code is slightly longer than Visa and Mastercard's three digits, but both serve the same purpose.

If I lose my card, can someone use it with the CVV?

If someone finds your card, they have both the card number and the CVV, so yes, they could attempt to use it online. This is why you should contact your card issuer immediately if your card is lost or stolen. They will cancel the card and issue a new one with a new CVV. Most card companies also monitor for suspicious activity and will contact you if they spot fraud.

Do I need to give my CVV for recurring charges like subscriptions?

Yes, you typically provide your CVV when you set up a subscription or recurring payment. The merchant's system stores your card number and expiration date but not the CVV. For future charges, the merchant uses the stored card number without asking for the CVV again. If you change your card, you'll need to enter the new CVV.

What if a website doesn't ask for a CVV?

Some websites, especially smaller ones or older systems, may not request the CVV. This is less secure because it means the merchant is not verifying you have the physical card. You can still use the site, but be extra cautious — make sure the website is legitimate and uses a secure connection (look for "https" in the address bar). If you're uncomfortable, use a different payment method or contact the merchant directly.