What the CVV Is and Why Merchants Ask for It

The CVV is a three- or four-digit security code printed on your card that proves you physically hold it

The CVV (Card Verification Value) is a short number on the back of your credit card, usually in the signature strip area. On Visa, Mastercard, and Discover cards, it is three digits. On American Express, it is four digits and sits on the front, above your account number.

The code exists so merchants can verify you actually have the card in your hand. When you shop online or over the phone, you cannot hand over the physical card, so the CVV acts as proof. A thief who knows your card number but not the CVV cannot complete most online purchases.

The CVV is not the same as your PIN (the number you enter at an ATM or payment terminal). Your PIN is secret and changes only if you request it. Your CVV is fixed for the life of the card and is visible to anyone who sees the card itself.

Key Takeaways

• The CVV is a three- or four-digit code on the back (or front, for American Express) of your card that merchants use to verify you own the card.
• You should provide your CVV only to merchants you trust, and never to someone who calls you claiming to be from your bank.
• The CVV changes when you get a new card, even if your account number stays the same.
• Online retailers require the CVV for card-not-present transactions, but in-person purchases at a store do not.

Why merchants ask for the CVV during checkout

When you buy something online or over the phone, the merchant cannot see your physical card. The CVV is their way of confirming you have it. If someone stole your card number from a data breach or a receipt, they would still need the CVV to complete a purchase without the card present.

Merchants send the CVV to the card network (Visa, Mastercard, Discover, or American Express) during the transaction. The network checks it against the code on file. If it matches, the transaction moves forward. If it does not match, the purchase is declined.

This check happens in seconds and is invisible to you. You will not see a message saying "CVV verified" — you will only notice if the transaction fails.

Where to find your CVV and how to protect it

For Visa, Mastercard, and Discover, flip the card over and look at the back. The CVV is the last three digits printed to the right of the signature strip. For American Express, look at the front of the card, above the account number on the right side. The four-digit code there is your CVV.

Treat your CVV like you treat your card number. Do not write it down or store it in an email or text message. Do not give it to anyone who calls you, even if they claim to be from your bank. Your bank already has your CVV on file and will never ask you for it over the phone.

When you shop online, only enter your CVV on a secure checkout page. Look for "https://" at the start of the web address and a padlock icon in the browser. Never type your CVV into a pop-up window or a link sent to you by email or text.

What happens if someone has your CVV

If a thief has your CVV and your card number, they can make online purchases without having the physical card. However, they still cannot use the card in a store, at an ATM, or at a gas pump — those require the physical card or a PIN.

If you notice fraudulent charges on your statement, contact your card issuer right away. Most card issuers have zero-liability policies, meaning you are not responsible for unauthorized charges if you report them quickly. The issuer will cancel your card and send you a new one with a new CVV.

You do not need to change your PIN or password just because someone has your CVV. The CVV is only useful for card-not-present transactions. Once you get a new card, the old CVV becomes useless.

CVV versus other card security features

Your card has multiple security layers. The CVV is one of them, but not the only one. Your card number itself is a security feature — it is unique to you and is checked against the card network's database. Your expiration date is another — it tells the merchant when the card stops being valid.

Newer cards also have a chip (the small metal square on the front). When you insert a chip card into a terminal, the chip creates a unique code for that specific transaction. This code cannot be reused, so even if a thief intercepts it, they cannot use it again. The CVV, by contrast, stays the same for every transaction.

Online, the CVV is often the only additional security check beyond your card number and expiration date. Some merchants also use address verification (checking that the billing address matches their records) or 3D Secure (a password system run by your bank). But the CVV is the most common.

The CVV changes when you get a new card

If your card is lost, stolen, or simply expired, your bank will send you a replacement. The new card will have a different CVV, even though your account number might stay the same. This is intentional — it makes the old card useless if someone finds it.

If you have recurring charges set up (like a subscription or automatic bill payment), you will need to update the CVV with those merchants when your new card arrives. Many will prompt you to do this automatically, but some will not. Check your subscriptions and billing settings to make sure nothing is interrupted.

Frequently Asked Questions

Can I use my card online without giving the CVV?

Most online retailers require it, but some do not. Larger merchants and payment platforms like PayPal or Apple Pay sometimes skip the CVV if they have other ways to verify you (like a saved address or phone number). Smaller retailers almost always ask for it. If a site does not ask for your CVV, that does not mean it is unsafe — it just means they are using a different verification method.

Is it safe to give my CVV to a website?

It is safe if the website is legitimate and uses encryption. Look for "https://" in the address bar and a padlock icon. Never enter your CVV on a site that does not have these. If you are unsure whether a site is real, go directly to the company's official website instead of clicking a link in an email.

What if I forgot my CVV?

Look at the back of your physical card — it is printed right there. If you do not have the card with you, you can call your card issuer and they can read it to you over the phone. Do not ask someone else to read it to you, and do not search for it in old emails or photos.

Do I need to memorize my CVV?

No. You only need it when you are making a purchase and the card is in front of you. You should never memorize it or write it down. The whole point of the CVV is that it is only useful if you have the physical card.

Can my bank see my CVV when I use my card in a store?

No. When you swipe or insert your card at a store, the CVV is not transmitted to the bank or the merchant. It only gets sent during card-not-present transactions like online or phone purchases. This is one reason chip cards are more secure than older magnetic stripe cards.