The CVV is a three- or four-digit security code printed on your card, separate from your card number
The CVV (Card Verification Value) is a number your card issuer prints on the physical card itself — not embedded in the magnetic stripe or chip. It appears on the back of most cards as a three-digit code in or near the signature panel. American Express prints a four-digit code on the front, above the card number.
The CVV exists because it is not stored in the magnetic stripe or chip. When you use your card in person, the merchant reads your number from the stripe or chip and does not need the CVV. When you enter your card number online or over the phone, the merchant cannot read the stripe or chip, so they ask for the CVV to verify you have the physical card in your hand.
The code changes only if your card issuer reissues your card — a new expiration date, fraud replacement, or renewal will give you a different CVV. The number itself is not secret in the way your PIN is; merchants see it during online transactions. What matters is that someone cannot complete an online purchase using only your card number and expiration date.
Key Takeaways
- The CVV is a three- or four-digit code printed on the back (or front, for American Express) that proves you have the physical card.
- Online and phone merchants request the CVV because they cannot read your card's chip or stripe remotely.
- Never share your CVV with anyone who calls you or emails you claiming to be your bank or card issuer.
- The CVV changes each time your card is reissued, so a stolen old card number and CVV will not work once you receive a replacement.
- Merchants are not supposed to store your CVV after a transaction, though data breaches sometimes expose it.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually in the signature panel or just to the right of it. The digits are printed in a different color or font than the card number to make them stand out.
American Express cards have a four-digit code called the CID (Card Identification Data) printed on the front, above the card number on the right side. Some older American Express cards printed it on the back instead, but current cards use the front.
If your card is damaged or the CVV is worn away, you can call your card issuer to confirm the code. They will verify your identity and read it to you over the phone. You do not need to request a replacement card just to learn the CVV.
Why merchants ask for the CVV during online and phone purchases
When you swipe or insert your card at a store, the payment terminal reads the data from the magnetic stripe or chip. That data includes your card number and expiration date but not the CVV. The merchant does not need it because they have confirmed you have the card in your hand.
Online and phone transactions work differently. The merchant never sees the physical card. You type or speak your card number and expiration date, but the merchant has no way to confirm you actually have the card — only that you know two pieces of information that could have been stolen or guessed. The CVV is the third piece of information, and it is not stored anywhere the merchant can access it without you providing it directly.
When you enter the CVV during checkout, the payment processor sends it to your card issuer for verification. The issuer checks that the CVV matches the card number. If it does not match, the transaction is declined. This step takes less than a second and happens behind the scenes.
What happens if someone has your card number but not the CVV
A thief who has your card number and expiration date but not the CVV cannot complete most online purchases. The merchant's system will reject the transaction at checkout because the CVV will not match. The thief would have to guess the three-digit code, which has one in one thousand odds per attempt. Most payment systems lock the card after a few failed attempts.
In person, the CVV does not matter. A thief with a counterfeit card or your card number written down can use it at a store that does not check the CVV or at an older terminal that does not require it. This is why fraud monitoring and chip technology matter more than the CVV for in-person fraud.
If your card number is exposed in a data breach, your card issuer will usually send you a replacement card with a new CVV within 7 to 10 business days. The old card number and CVV will stop working once the new card is activated, even if the thief has both pieces of information.
Never give your CVV to someone who contacts you
Your card issuer, your bank, and legitimate merchants will never ask you for your CVV over the phone, in an email, or in a text message. If someone contacts you claiming to be from your bank or card company and asks for the CVV, it is a scam.
Scammers use urgency and fear to pressure you into sharing the code. They may claim there is fraud on your account, that your card is about to be closed, or that you need to "verify" your information. Legitimate issuers already have your CVV on file and do not need you to provide it to them.
If you receive such a call or message, hang up or delete it. Call your card issuer directly using the number on the back of your card or on your statement. Do not use a phone number from the suspicious message.
How data breaches expose the CVV and what it means for you
Merchants are not supposed to store your CVV after a transaction completes. Payment card industry rules (PCI DSS) forbid it. However, large data breaches sometimes expose CVVs along with card numbers because merchants or payment processors failed to follow the rules or because hackers found stored data that should have been deleted.
If a breach exposes your card number and CVV, the risk is real but time-limited. A thief can use both pieces of information to make online purchases until your card issuer catches the fraud or you report it. Once you report fraud, your issuer will cancel the card and issue a replacement with a new CVV, which makes the stolen code useless.
This is why monitoring your statements matters. Most card issuers offer free fraud monitoring and will reverse unauthorized charges. If you spot a purchase you did not make, contact your issuer immediately. The sooner you report it, the sooner you get a replacement card and the thief loses access.
The difference between CVV, CVC, CID, and other security codes
Different card networks use different names for the same thing. Visa calls it CVV (Card Verification Value). Mastercard calls it CVC (Card Verification Code). American Express calls it CID (Card Identification Data). Discover calls it CID as well. They all serve the same purpose: a three- or four-digit code printed on the card that is not stored in the chip or stripe.
When you are shopping online, the form will usually ask for "CVV" or "security code" regardless of which network your card uses. The merchant's system knows which network your card belongs to based on the card number and will validate the code accordingly. You do not need to know which name your card issuer uses.
Frequently Asked Questions
Can I use my card online without entering the CVV?
Most online merchants require the CVV at checkout. Some older or less secure websites may not ask for it, but reputable retailers always do. If a website does not ask for the CVV, that is often a sign it is not a secure checkout process.
What if I forgot my CVV?
Look at the back of your physical card. If the code is worn away or unreadable, call your card issuer's customer service number on the back of your card or on your statement. They will verify your identity and read the CVV to you. You do not need a replacement card.
Is the CVV the same as my PIN?
No. Your PIN is a four-digit code you create and use at ATMs and in-store terminals. Your CVV is a three- or four-digit code printed on the card by your issuer and used only for online and phone purchases. Never share your PIN with anyone, and never enter it online.
Can someone use my card if they only have the CVV?
Not without the card number and expiration date. The CVV alone is useless. A thief needs all three pieces of information — card number, expiration date, and CVV — to complete an online purchase.
Does the CVV protect me from in-person fraud?
No. The CVV only protects online and phone transactions. In person, the merchant does not ask for the CVV. Chip technology and fraud monitoring protect you from in-person fraud instead.