The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a short number on the back of your credit card — usually three digits, sometimes four on American Express. When you enter it during an online or phone purchase, you're telling the merchant "I have this card in my hands right now." It's not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also knowing this code.
The CVV exists because online and phone transactions are riskier than in-person ones. When you swipe or insert your card at a store, the cashier can see your face and check your signature. Online, the merchant has no way to verify you're the real cardholder — so the CVV adds a second layer of proof. It's one of several tools that reduce fraud, but it's not foolproof.
Key Takeaways
- The CVV is a three- or four-digit code on the back of your card (or front, for American Express) that you enter during online or phone purchases.
- It proves you physically possess the card, since the code is not stored in the card's magnetic stripe or chip and cannot be read by a card reader.
- Merchants are required to ask for the CVV on card-not-present transactions, and refusing to provide it will block your purchase.
- Never share your CVV with anyone by email, text, or phone call — legitimate companies will never ask for it that way.
- The CVV protects you against fraud only if your card number is stolen; it does not protect you if someone steals the physical card itself.
Where to find your CVV on different card types
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. Look for a small group of numbers at the end of a longer sequence — the CVV is the last three digits of that sequence.
On American Express cards, the CVV is a four-digit code printed on the front of the card, above the card number on the right side. American Express calls it the CID (Card Identification Number), but it serves the same purpose as the CVV on other cards.
Why merchants ask for it during online purchases
When you buy something in a store, the card reader captures your card number and processes the payment in seconds. The merchant can see you, and your bank can verify the transaction happened at a real location. Online purchases are different — the merchant never sees you, and your card number travels across the internet to reach them.
A criminal who steals your card number from a data breach or a skimmed ATM can try to use it online without your permission. But they cannot complete the purchase without the CVV, because they don't have the physical card. By asking for the CVV, the merchant adds a check that reduces the risk of fraud. Your bank may also decline the transaction if the CVV doesn't match the card number you provided, which is another layer of protection.
What the CVV does and does not protect you against
The CVV protects you if someone steals your card number but not your physical card. If a hacker breaches a retailer's database and downloads thousands of card numbers, they can attempt online purchases — but the CVV requirement will stop most of those attempts. This is why the CVV is sometimes called a "security code."
The CVV does not protect you if someone steals your physical card. If a thief takes your wallet, they have both the card number and the CVV printed on it, so they can use it in person or online. It also does not protect you if you willingly give your card number and CVV to a scammer — there is no system that can tell the difference between you and someone pretending to be you if you hand over all the information yourself.
Never share your CVV by email, text, or phone
Legitimate companies — your bank, a retailer, a utility company — will never ask for your CVV by email, text message, or phone call. If someone contacts you claiming to be from your bank and asks for your CVV, it is a scam. Hang up or delete the message immediately.
The only time you should enter your CVV is on a secure website (look for "https://" in the address bar and a padlock icon) or by reading it aloud to a merchant during a phone purchase you initiated yourself. If you are unsure whether a phone call is legitimate, hang up and call the company's official customer service number from your statement or their website.
How the CVV is different from your PIN
Your PIN (Personal Identification Number) is a four-digit code you create and memorize. You enter it at an ATM or when you use your debit card at a store to prove you are the cardholder. Your PIN is never printed on your card, and you should never write it down or share it.
The CVV is printed on your card and is the same for every transaction — you do not choose it, and you cannot change it. The CVV is used for online and phone purchases; the PIN is used for in-person debit transactions and ATM withdrawals. If someone steals your PIN, they can drain your bank account at an ATM. If someone steals your CVV alone, they cannot do much without also having your card number.
What happens if your card is compromised
If you notice fraudulent charges on your statement or suspect your card number has been stolen, contact your card issuer immediately. Most banks have a fraud department that works 24/7, and you can find the number on the back of your card or your statement.
Your bank will cancel your card and issue a replacement with a new number and a new CVV. You are not responsible for fraudulent charges if you report them promptly — federal law limits your liability to $50, and most banks waive that entirely. The replacement card usually arrives within 7 to 10 business days. Until then, ask your bank if they can issue a temporary card number for online purchases, or use a different payment method.
Frequently Asked Questions
Can someone use my card online if they have my card number but not my CVV?
Most online retailers will not complete the purchase without the CVV. However, some smaller merchants or international sites may not require it, so the CVV is a helpful safeguard but not a complete barrier. If your card number is stolen, monitor your statement and contact your bank if you see unauthorized charges.
Is it safe to save my CVV on a website for faster checkout?
No. Reputable retailers will not store your CVV — payment processors are required by law not to keep it. If a website offers to save your CVV, that is a red flag. You can safely save your card number for repeat purchases, but you should enter the CVV fresh each time.
What if I accidentally shared my CVV with a scammer?
Contact your card issuer immediately and report the fraud. They will cancel your card and issue a replacement. If the scammer has already made charges, your bank will investigate and remove them from your account. Act quickly — the sooner you report it, the faster your bank can protect you.
Do I need to memorize my CVV?
No. You only need to know where to find it when you make an online or phone purchase. Do not write it down or store it in your phone. The CVV is meant to be read from the physical card each time you use it.
Why do some websites ask for my CVV but others don't?
Larger retailers and payment processors are more likely to require the CVV because they have stricter fraud prevention systems. Smaller merchants or subscription services may skip it. The CVV requirement is not universal, but it is a best practice that reduces fraud risk.