The CVV and CVC are the same thing: a three- or four-digit security code on your credit card

CVV stands for Card Verification Value. CVC stands for Card Verification Code. They are two names for the same number. Visa, Discover, and Mastercard call it CVV. American Express calls it CVC (though some people call theirs CVV2). The number serves one purpose: to confirm that you physically have the card when you make a purchase online or over the phone.

This code is not stored in the magnetic stripe or chip on your card, and it is not printed on receipts. That separation is intentional — it makes the number harder for a thief to use if they steal your card number alone.

The code is three digits on most cards. American Express uses four digits. You will see it printed on the back of your card, except on American Express cards, where it appears on the front.

Key Takeaways

  • CVV and CVC are the same security code; the name depends on which card network issued your card.
  • The code is three digits on Visa, Mastercard, and Discover cards, and four digits on American Express cards.
  • You should never enter your CVV on a website that does not have a secure checkout page, and never give it to someone who calls you.
  • Merchants are not allowed to store your CVV after a transaction, so if you see it saved in your account, that is a sign of a security problem.
  • A CVV mismatch will decline your transaction, even if your card number and expiration date are correct.

Where the CVV appears on your card

On Visa, Mastercard, and Discover cards, the CVV is printed on the back of the card, usually in the signature strip area on the right side. It is the last three digits of a longer number printed there.

On American Express cards, the four-digit code appears on the front of the card, above the card number on the right side. American Express calls this the CID (Card Identification Number), though most people still refer to it as the CVV.

If your card is damaged and the CVV is not visible, you can call your card issuer to confirm the number. Do not rely on a website or app that claims to retrieve it for you — your issuer is the only source you should trust.

Why merchants ask for it during online and phone purchases

When you buy something online or by phone, the merchant cannot see your card in person. The CVV is a way to verify that you have the physical card. If someone has only stolen your card number and expiration date, they will not have the CVV and the transaction will be declined.

The merchant sends your CVV to the payment processor, which checks it against the card issuer's records. The processor does not tell the merchant whether the code matched — it only tells them whether to approve or decline the transaction. This keeps the CVV hidden from the merchant's system.

In-person purchases at a store or gas pump do not require a CVV because the card is physically present and can be verified by the chip or magnetic stripe.

What happens if you enter the wrong CVV

If you mistype the CVV, the transaction will be declined. The payment processor will flag it as a CVV mismatch and reject the charge, even if your card number and expiration date are correct.

If you enter the wrong CVV multiple times in a short period, your card issuer may temporarily block online purchases as a fraud prevention measure. You can call them to unlock the card or try again later.

A declined transaction because of a CVV mismatch does not hurt your credit score. It is simply a failed transaction that never reaches your account.

Security rules about who can store your CVV

By law, merchants and payment processors are not allowed to store your CVV after a transaction is complete. If you see your CVV saved in your account on a website, that is a violation of payment card industry rules and a sign that the merchant's security is not trustworthy.

Legitimate websites will ask for your CVV every time you make a purchase, even if they have your card number on file. If a site remembers your CVV between purchases, do not use that card with that merchant again.

Your card issuer stores the CVV in their own secure system, but they will never ask you to provide it over the phone or in an email. If someone claiming to be from your bank asks for your CVV, hang up — that is a scam.

CVV versus other card security features

The CVV is one layer of security, but it is not the only one. Your card also has an expiration date, a chip (on newer cards), and a magnetic stripe (on older cards). Together, these features make it harder for a thief to use a stolen card number.

The chip and magnetic stripe are encrypted and change with each transaction. The CVV does not change, which is why it is kept separate from the card data that gets stored in merchant systems. A thief who steals your card number from a data breach will not have your CVV unless they also have physical access to your card.

If your card is lost or stolen, call your issuer immediately. They will cancel the card and issue a new one with a new CVV. Any fraudulent charges made after you report the card missing are typically covered by your issuer's fraud protection.

What to do if your CVV is compromised

If you believe your CVV has been exposed — for example, because you entered it on a website that was later hacked — contact your card issuer right away. They can issue you a new card with a new CVV.

You do not need to wait for fraudulent charges to appear. Issuers will replace a card if you report that the CVV may have been compromised, even if no charges have been made yet.

In the meantime, monitor your account for unauthorized transactions. Most card issuers offer free fraud monitoring and will alert you to suspicious activity. If you see charges you did not make, report them to your issuer within 60 days to dispute them.

Frequently Asked Questions

Is the CVV the same as the card number?

No. The card number is the 16-digit number on the front of your card (15 digits on American Express). The CVV is a separate three- or four-digit code on the back or front. A thief who has only your card number cannot use it online without the CVV.

Can I use my card online without entering the CVV?

Most online merchants require the CVV for security reasons, but some may not ask for it depending on the payment method or the merchant's system. If a site does not ask for your CVV, that does not mean it is unsafe — it means the merchant has chosen a different security method.

What if I forgot my CVV and need to make a purchase?

Call your card issuer and they will tell you the CVV over the phone. You can then enter it on the website. Do not search for your CVV online or use a tool that claims to retrieve it — your issuer is the only reliable source.

Does the CVV change if I get a replacement card?

Yes. Each card has its own unique CVV. If your card is replaced because it expired, was damaged, or was reported lost, the new card will have a different CVV. Any websites where you saved your old card number will need to be updated with the new CVV.

Can a merchant refuse a transaction if the CVV does not match?

The payment processor makes that decision, not the merchant. If the CVV does not match the card issuer's records, the transaction is automatically declined. The merchant cannot override this — they can only ask you to re-enter the code or try a different payment method.