The 3-digit code is called the CVV or CVC, and it's a security feature that proves you physically have the card

The three-digit number on the back of your credit card is called the CVV (Card Verification Value) or CVC (Card Verification Code), depending on which card network issued it. Visa and Discover call it CVV; Mastercard calls it CVC; American Express calls it CID and puts a four-digit code on the front instead. They all do the same job: they prove you're holding the actual card, not just using a stolen card number.

When you enter this code during an online or phone purchase, the merchant sends it to the card network to verify. The network checks that the code matches what's on file for that card number. If it doesn't match, the transaction gets declined. This catches many fraudulent purchases because a thief who only has your card number — from a data breach or a skimmed ATM — won't have the physical card to read the code from.

The code is printed on the card itself but is not stored in the card's magnetic stripe or chip. That's intentional. It means a criminal who steals your card data through a hacked website still can't complete a purchase without the actual card in their hands.

Key Takeaways

  • CVV and CVC are the same thing — a three-digit security code on the back of your card that proves you physically possess it.
  • American Express uses a four-digit code on the front of the card instead, called the CID.
  • The code is not stored in your card's chip or magnetic stripe, so hackers who steal your card number alone cannot use it.
  • Never share your CVV with anyone, and never enter it on a website unless you initiated the transaction yourself.

Why merchants ask for it during online purchases

Online shopping is riskier for merchants than in-person purchases because they can't see your card or check your ID. The CVV is one of the few things that proves you have the physical card. When you type it in, you're essentially confirming that you're not just someone who found your card number in a data breach.

Merchants are required to ask for it by the card networks' rules. Visa, Mastercard, Discover, and American Express all mandate that online and phone transactions include CVV verification. If a merchant doesn't ask for it, that's actually a red flag — it may mean they're not following security standards.

The code also helps protect you. If someone uses your card number fraudulently, the failed CVV attempt creates a record that the transaction was unauthorized. This makes it easier to dispute the charge with your card issuer later.

Where to find your CVV and how to protect it

For Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. For American Express, it's a four-digit code printed on the front, above the card number on the right side.

Treat your CVV like you treat your PIN. Never write it down, never text it, never email it, and never give it to anyone who calls you claiming to be from your bank. Your bank already has this information on file — they will never ask you for it. If someone calls asking for your CVV, hang up and call your card issuer directly using the number on the back of your card.

The only time you should enter your CVV is when you're making a purchase on a website you trust or over the phone with a merchant you called yourself. If a website asks for your CVV before you've clicked "buy," or if a pop-up appears asking for it unexpectedly, leave that site immediately.

What happens if your card is compromised

If your card number is stolen but your physical card is not, the thief cannot use it online without your CVV. They may try to guess it — there are only 1,000 possible three-digit combinations — but most payment systems lock the card after a few failed attempts. This is why the CVV exists: to stop exactly this kind of fraud.

If you notice unauthorized charges on your statement, contact your card issuer right away. You are not responsible for fraudulent charges, and your issuer will investigate and reverse them. The CVV verification creates a record that helps prove the transaction was unauthorized.

If your physical card is stolen, call your issuer immediately to report it. They will cancel the card and issue a new one. The CVV on the old card becomes useless because the card itself is no longer active.

CVV is not the same as your card's security chip

The CVV and the EMV chip (the small metallic square on the front of your card) are two different security features that work in different situations. The chip protects in-person purchases at stores. When you insert or tap your card at a checkout terminal, the chip creates a unique code for that specific transaction that cannot be reused. A thief who steals your card number cannot use the chip code because it only works once.

The CVV protects online and phone purchases, where the merchant cannot read your chip. It's a static number printed on the card, not a dynamic code generated by the chip. This is why you need both: the chip for stores, the CVV for the internet.

Frequently Asked Questions

Can someone use my card if they only have the number and CVV?

They can try, but most online merchants also verify your billing address and zip code. Even with your card number and CVV, a thief would need to guess your address correctly. If they fail, the transaction is declined and a fraud alert is created.

Is it safe to enter my CVV on any website?

Only on websites you trust and that use secure checkout (look for "https://" in the address bar and a padlock icon). Never enter it on a site that looks suspicious, asks for it before you've selected items to buy, or pops it up unexpectedly. When in doubt, call the merchant directly using a phone number you find yourself.

What if I forget my CVV?

Look at the back of your card — it's printed right there. If you don't have your card with you, you can call your card issuer and they can read it to you over the phone after verifying your identity. Never ask someone else to read it for you or share it in a text or email.

Do I need to enter my CVV for in-person purchases?

No. When you swipe, insert, or tap your card at a store, the chip or magnetic stripe handles the verification. The CVV is only for online and phone purchases. If a store clerk asks for your CVV in person, that's unusual and you should decline.

Why does American Express use four digits instead of three?

American Express's four-digit code provides slightly more security than a three-digit code because there are 10,000 possible combinations instead of 1,000. The extra digit makes it harder to guess through brute-force attempts, though the difference is small because most systems lock after a few failed tries anyway.