The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a short number on the back of your credit card — usually three digits, sometimes four on American Express cards. It sits separately from your card number, expiration date, and name. When you enter it during an online or phone purchase, you are telling the merchant "I have this card in my hands right now," which reduces the risk that a stolen card number is being used by someone who doesn't own the card.
The CVV is not stored in the magnetic stripe or chip on your card the way your card number is. This matters: even if a criminal copies your full card number from a store transaction, they cannot see your CVV unless they physically hold the card or you tell them. That separation is the whole point.
Merchants never store your CVV after the transaction is complete. Payment processors use it once to verify the purchase, then discard it. This is a legal requirement under payment card industry rules, not a choice merchants make. So if a store's database is hacked, your CVV should not be in there.
Key Takeaways
- The CVV is a three- or four-digit code on the back of your card that proves you physically possess it when making online or phone purchases.
- Your CVV is not stored in your card's chip or stripe, and merchants are required by law to delete it immediately after each transaction.
- Never give your CVV to anyone who calls you or emails you, even if they claim to represent your bank — your bank already has your card on file.
- The CVV protects you against card-not-present fraud, but it does not protect you if someone steals your physical card or if your card number is used in a store where the reader is compromised.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back, usually to the right of the signature strip. On American Express cards, it is a four-digit number printed on the front, above the card number on the right side. The location matters because it tells you where to look, but the function is the same.
The CVV is printed, not embedded in the card itself. This is intentional — it cannot be read by a card reader or copied by a skimmer. Someone would have to see your card or a photo of it to get the number.
Why merchants ask for it online and by phone
When you buy something in a store and swipe or insert your card, the merchant's reader can verify that your card is real and that you have it. Online and phone purchases are different — the merchant cannot see the card. Asking for the CVV is a way to confirm that the person giving the card number actually has the physical card.
This is called card-not-present fraud prevention. If a criminal has only your card number and expiration date (which they might find on a receipt or from a data breach), they cannot complete most online purchases without the CVV. It is a simple but effective barrier.
Some merchants, especially large retailers, may not ask for the CVV every time — their fraud detection systems might decide the purchase is low-risk based on the amount, your location, or your purchase history. But the option to ask is always there.
What the CVV does not protect you against
The CVV is not a complete security system. It does not protect you if someone steals your physical card, because they will have the CVV in hand. It does not protect you if a card reader at a gas pump or ATM is compromised — those devices can capture your card number and other information, but not the CVV, which is printed only on the card itself.
The CVV also does not protect you if you give it to a scammer. If someone calls claiming to be from your bank and asks for your CVV, that is a scam. Your bank already has your card on file and will never ask you for the CVV over the phone or by email. Scammers use urgency and authority to trick people into revealing this number.
If your card number is stolen but your CVV is not, you are in a better position than if both are compromised. But the CVV alone is not enough to stop fraud — it is one layer of protection among several, including your bank's fraud monitoring and your own vigilance.
How to protect your CVV
Treat your CVV like you treat your card number: do not write it down, do not photograph it, and do not share it except during a legitimate purchase you initiated. If you are buying from a website, make sure the page is secure — look for "https://" in the address bar and a lock icon. Secure pages encrypt your information as it travels to the merchant.
Never enter your CVV on a website that does not ask for it. If a site is asking for your CVV in an unusual way — for example, in a pop-up or on a page that does not look like a checkout — stop and verify that you are on the real merchant's website. Phishing sites often ask for more information than legitimate merchants do.
If you are shopping by phone, call the merchant directly using a number from their official website or a recent bill. Do not use a phone number from an email or text message, even if it looks official. Scammers can spoof phone numbers and email addresses.
What happens if your CVV is compromised
If your CVV has been seen by someone you do not trust — for example, you gave it to a scammer or you saw it on a phishing site — contact your card issuer right away. You do not need to wait for fraud to appear. Your bank can issue you a new card with a new CVV, usually within five to ten business days.
If fraudulent charges do appear on your account, report them to your bank immediately. Under federal law, your liability for unauthorized charges is limited to $50 if you report the fraud within 60 days of receiving your statement. Most banks offer zero-liability protection, meaning you will not be charged at all, but reporting quickly protects you either way.
Your bank will investigate the fraud and reverse the charges while they look into it. You may receive a temporary card number or a new physical card while the investigation is underway. Keep any documentation of the fraudulent charges — your bank will ask for it.
CVV versus other card security features
Your card has several security features working together. The chip (the small metallic square on the front) creates a unique code for each transaction, making it harder to counterfeit your card or reuse a transaction. The magnetic stripe on the back stores your card number and expiration date, but not your CVV. Your name and card number are printed on the front so merchants can identify the cardholder.
The CVV is the only piece of information that is printed but not stored in the card itself. This is what makes it useful for card-not-present transactions. The chip and magnetic stripe protect you in physical stores; the CVV protects you online and by phone.
Newer security methods are emerging, like tokenization (where your card number is replaced with a random code for online purchases) and biometric verification (using your fingerprint or face to confirm a purchase). But the CVV remains the standard for now, especially for older websites and phone orders.
Frequently Asked Questions
Is it safe to give my CVV to a website?
Yes, if the website is legitimate and secure. Look for "https://" in the address bar and a lock icon. Never enter your CVV on a site that does not have these signs of security. If you are unsure whether a site is real, go to the company's official website directly instead of clicking a link from an email.
Can someone use my card number without the CVV?
They can try, but most online merchants will decline the transaction if the CVV is missing or wrong. In a physical store, they cannot use your card at all without having it in hand. The CVV is a barrier, not an absolute block — determined criminals may find other ways, but it stops most casual fraud.
What should I do if I accidentally shared my CVV?
Call your card issuer immediately and ask them to issue a new card. Do not wait to see if fraud happens. A new card with a new CVV usually arrives within five to ten business days. Your bank may also monitor your account more closely for suspicious activity in the meantime.
Does my bank ever need my CVV?
No. Your bank already has your card on file and does not need the CVV to verify your identity or access your account. If someone claiming to be from your bank asks for your CVV by phone, email, or text, it is a scam. Hang up or delete the message and call your bank directly using the number on your card.
Can the CVV be stolen from a data breach?
Merchants are required by law to delete your CVV immediately after each transaction, so it should not be stored in their systems. If a breach happens, your CVV should not be in the stolen data. However, if you entered your CVV on a phishing website or gave it to a scammer, they will have it. This is why it is important to verify that you are on a real, secure website before entering it.