The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back of your credit or debit card, separate from your card number. On Visa, Mastercard, and Discover cards, it is a three-digit code printed in the signature panel on the back. On American Express cards, it is a four-digit code printed on the front, above your card number.
The CVV exists to reduce fraud when you use your card without the card physically present — online, by phone, or by mail. When you enter your card number, expiration date, and CVV together, the merchant or payment processor can verify that you have the physical card in your hand. Without the CVV, someone who only knows your card number and expiration date cannot complete most online transactions.
The CVV is not stored in the magnetic stripe or chip on your card, and it is not encoded in your card number. It is printed only on the surface. This design means that a thief who steals your card number from a data breach cannot use it online without also having the CVV — which they do not have unless they also have a photo of your card or the card itself.
Key Takeaways
- The CVV is a three-digit code on the back of Visa, Mastercard, and Discover cards, or a four-digit code on the front of American Express cards.
- You enter the CVV when making online purchases, over the phone, or by mail to prove you have the physical card.
- The CVV is not stored in your card's chip or magnetic stripe, so thieves who steal your card number cannot use it online without the CVV.
- Never share your CVV with anyone except the merchant or payment processor you are paying directly.
- The CVV changes only if you request a replacement card; it does not rotate or expire on its own.
Where to find your CVV on different card types
The location and format of the CVV depends on your card brand. On the back of Visa, Mastercard, and Discover cards, the CVV appears as a three-digit number in or near the signature panel — the white or light-colored strip where you sign your name. It is usually printed to the right of the signature line.
American Express cards display the CVV differently. The four-digit code appears on the front of the card, above and to the right of your main card number. This placement is one of the few visual differences between American Express and other major card brands.
If your card is very old or worn, the CVV may be faded or hard to read. If you cannot see it clearly, contact your card issuer and request a replacement card. Do not attempt to write in or guess the CVV — merchants will reject an incorrect code, and repeated failed attempts may trigger a fraud alert on your account.
How merchants use the CVV during a transaction
When you enter your card details online or over the phone, the merchant sends your card number, expiration date, and CVV to a payment processor. The processor forwards this information to your card issuer (your bank or credit card company) for verification. Your issuer checks that the card number is valid, that the expiration date matches their records, and that the CVV is correct.
The issuer does not tell the merchant what your CVV is. Instead, they simply respond with "approved" or "declined." If the CVV does not match, the transaction is declined. This design protects you because the merchant never learns your actual CVV — they only learn whether the one you provided was correct.
In-person transactions at a physical store do not require a CVV. When you swipe or insert your card, the merchant reads the data from the chip or magnetic stripe, which does not include the CVV. This is why a thief who steals your physical card can still use it in stores without knowing the CVV.
Why the CVV does not protect you in every situation
The CVV reduces fraud for online and phone transactions, but it has limits. If a thief has your physical card, they can use it in stores without the CVV. If they have a photo of your card that shows the CVV, they can make online purchases. If your card number and CVV are both stolen in a data breach, a thief can attempt online transactions until your card issuer detects the fraud and blocks the card.
The CVV also does not protect you if you give it to a scammer. If someone calls you claiming to be from your bank and asks for your CVV, they are committing fraud — your real bank will never ask for it. Similarly, if a website asks for your CVV before you have entered any other payment information, or if it asks you to text or email your CVV, that is a scam.
For these reasons, the CVV is one layer of fraud protection, not a complete shield. Your card issuer also monitors your account for unusual activity, and you have the right to dispute fraudulent charges. If your card is lost or stolen, contact your issuer immediately to have it blocked.
What happens to your CVV if your card is replaced
If your card issuer sends you a replacement card — because yours was lost, stolen, or expired — your new card will have a different CVV. The CVV is unique to each physical card, even if the card number remains the same. This is why merchants cannot store your CVV for future transactions; it becomes invalid as soon as you receive a new card.
When you receive a replacement card, you will need to update your CVV in any online accounts where you have saved your card for recurring payments. For example, if you have a subscription service that charges your card monthly, you will need to log into that service and enter your new CVV. If you do not update it, the next charge will fail.
Your CVV does not change on its own and does not expire. It remains the same for the life of the card. The only time it changes is when you receive a new physical card.
Protecting your CVV from theft and fraud
Never write your CVV down or store it anywhere except in your memory or a secure password manager. Do not photograph your card or email a photo of it to anyone. Do not share your CVV over the phone unless you initiated the call to a merchant or your card issuer — never give it to someone who called you first.
When entering your CVV online, make sure you are on a secure website. Look for "https://" at the beginning of the URL and a padlock icon in your browser's address bar. These indicate that your connection is encrypted. Do not enter your CVV on a website that does not use encryption, and do not use public Wi-Fi to make purchases.
If you suspect your CVV has been compromised — for example, if you see fraudulent charges on your account or if you accidentally shared it with someone — contact your card issuer immediately. They can issue a replacement card with a new CVV. You are not responsible for fraudulent charges if you report them promptly.
CVV versus other card security features
The CVV works alongside other security measures to protect your card. Your card number identifies your account but is not enough on its own to make a purchase online. Your expiration date confirms that your card is still valid, but it is printed on the front of the card and visible to anyone who sees it. Your PIN (Personal Identification Number) protects your card at ATMs and in stores, but it is not used for online transactions.
Newer cards also include a chip (EMV technology) that creates a unique code for each in-person transaction, making it harder for thieves to clone your card. Some cards offer virtual card numbers or one-time use numbers for online shopping, which are temporary numbers linked to your account that expire after one use or one transaction.
Together, these features create multiple layers of protection. No single feature stops all fraud, but the combination makes it much harder for a thief to use your card without your knowledge.
Frequently Asked Questions
Can I use my card online if I do not remember my CVV?
No. Most online merchants require the CVV to process your transaction. If you cannot remember it, check the back of your physical card. If your card is not available or the CVV is illegible, contact your card issuer and request a replacement card with a new CVV.
Is it safe to save my CVV in my browser or password manager?
Most password managers can store your CVV securely, but it is safer not to. Since your CVV changes every time you receive a new card, storing it creates extra work when you need to update it. For most online purchases, entering the CVV manually takes only a few seconds and is the more secure choice.
What should I do if I accidentally shared my CVV with someone?
Contact your card issuer immediately and explain what happened. They can monitor your account for fraudulent activity and issue a replacement card with a new CVV if necessary. You are not liable for fraudulent charges if you report them promptly.
Do all credit cards have a CVV?
All major credit and debit cards issued by Visa, Mastercard, American Express, and Discover have a CVV. Some prepaid cards and store cards may not have one, but most do. If your card does not have a CVV printed on it, contact your card issuer to confirm whether it is required for online purchases.
Can a merchant refuse a transaction if the CVV does not match?
Yes. If the CVV you enter does not match the one on file with your card issuer, the transaction will be declined. This is a security feature designed to prevent fraud. If your transaction is declined, double-check that you entered the correct CVV and try again. If it is declined a second time, contact your card issuer to confirm your card is active.