The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a number on the back of your credit card — usually three digits for Visa, Mastercard, and Discover, or four digits for American Express (which calls it the CID). It sits separate from your card number and expiration date. When you enter it during an online or phone purchase, you are telling the merchant you have the physical card in your hand, not just the number.
The CVV is not stored in the magnetic stripe or chip on your card. It exists only on the card itself and in the card issuer's records. This design means a thief who steals your card number from a data breach cannot use that number alone to make online purchases — they would also need the CVV, which they do not have unless they physically possess the card.
Merchants are not allowed to store your CVV after a transaction completes. Payment processors and banks use it to verify the transaction in real time, then discard it. This is why you have to enter it every time you shop online, even with a card you have used before.
Key Takeaways
- The CVV is a three- or four-digit code on the back of your card that proves you physically possess it when making online or phone purchases.
- Merchants cannot legally store your CVV after a transaction, so you must enter it each time you shop online.
- A stolen card number alone cannot be used for online purchases without the CVV, which is why the code adds a layer of security.
- The CVV is different from your PIN — your PIN is for in-person ATM and debit transactions, while the CVV is for credit card purchases.
Where the CVV appears on different card types
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. It is the last three digits of a longer number that appears there.
On American Express cards, the four-digit code appears on the front of the card, above the card number on the right side. American Express calls this the CID instead of CVV, but it serves the same purpose.
Some older or specialty cards may not have a visible CVV printed on them. In those cases, you may need to contact your card issuer to obtain the code before making an online purchase.
Why merchants ask for the CVV
When you shop online or over the phone, the merchant cannot see your card or verify your identity in person. Asking for the CVV is a way to confirm that the person entering the card number actually has the card. A fraudster with only a stolen card number — obtained from a data breach or a skimmed ATM — would not have the CVV.
The CVV check happens in seconds during payment processing. The merchant sends the CVV to the card issuer, who verifies it matches their records. If it does not match, the transaction is declined. If it matches, the transaction moves forward.
This check is not foolproof. If a thief steals your physical card, they have both the number and the CVV. But for online fraud involving only a card number, the CVV requirement stops most attempts.
CVV versus PIN: what is the difference
Your PIN (Personal Identification Number) is a four-digit code you create when you open a debit account or activate a debit card. You enter it at an ATM or at a store when you pay with debit. Your PIN is known only to you and the bank.
Your CVV is printed on the card by the issuer and is not something you choose. You use it for credit card purchases online or by phone, not for debit transactions. A debit card has both a PIN and a CVV — the PIN protects debit transactions, and the CVV protects credit card transactions made with that debit card online.
If someone steals your debit card and knows your PIN, they can drain your account at an ATM. If they have only the card number and CVV, they cannot access your PIN-protected debit account, but they could make online purchases as if the card were a credit card.
What to do if your CVV is compromised
If you believe your card number and CVV have both been exposed — for example, through a data breach at a retailer where you shopped — contact your card issuer immediately. You can find the customer service number on the back of your card or on your monthly statement.
Your issuer can cancel the card and issue a replacement with a new number and a new CVV. This process usually takes five to ten business days. In the meantime, ask the issuer to monitor your account for fraudulent charges and to place a fraud alert on your credit file if needed.
You do not need to change your CVV if only your card number was exposed. The CVV is tied to the physical card, so a new card automatically comes with a new CVV. Entering a new CVV online does nothing — the system checks it against the issuer's records, and only the issuer can update those records when they issue a new card.
CVV and data breaches: why merchants cannot protect it
Large retailers and payment processors are required by law to meet security standards called PCI DSS (Payment Card Industry Data Security Standard). One of those standards is that merchants must not store CVV data after a transaction is complete.
This rule exists precisely because CVV data is so sensitive. If a merchant stores it, a breach at that merchant could expose both your card number and your CVV, making you vulnerable to online fraud. By requiring merchants to discard the CVV immediately, the industry limits the damage a single breach can cause.
If you see a website asking you to save your CVV for future purchases, that is a red flag. Legitimate merchants do not ask for this and are not allowed to store it. Some sites offer "one-click checkout" by storing your card number and expiration date but not the CVV — you still have to enter the CVV each time.
When you might not need to enter a CVV
If you are making a purchase in person at a physical store, you do not enter a CVV. The cashier swipes or inserts your card, and the payment processor verifies the transaction using the chip or magnetic stripe on the card itself.
If you are setting up a recurring payment — such as a subscription or monthly bill — with a merchant you trust, you may enter the CVV once during setup. The merchant stores your card number and expiration date but not the CVV. For each recurring charge, the system uses the stored card number without asking for the CVV again.
Some merchants that you have a long-standing relationship with may not ask for a CVV on repeat purchases, especially if you are logged into your account on their website. The merchant has already verified you once, so they may skip the CVV check on subsequent orders. This is less secure but is a choice the merchant makes.
Frequently Asked Questions
Is my CVV the same as my card security code?
Yes. CVV, CVC, CVV2, CID, and card security code all refer to the same three- or four-digit number on your card. Different card networks use different names, but they all serve the same purpose: to verify you have the physical card.
Can someone use my card number without the CVV?
For online and phone purchases, no — most merchants require the CVV. In person, a thief with only your card number cannot complete a transaction because they do not have the physical card. However, a thief with your physical card has both the number and the CVV and can use it anywhere.
What if I enter the wrong CVV?
The transaction will be declined. The payment processor checks your CVV against the issuer's records in real time. If it does not match, the merchant is notified and the sale does not go through. You can try again with the correct CVV.
Do I need to memorize my CVV?
No. You only need to know where to find it on your card when you are making an online or phone purchase. Do not write it down or store it anywhere — keep it only on the physical card itself.
Why does my card issuer ask for my CVV when I call customer service?
When you call your card issuer's customer service line, they may ask for your CVV as a security check to confirm you have the card. This is different from a merchant asking for it — the issuer is verifying your identity before discussing your account or making changes.