CVV is the three- or four-digit security code on the back of your card
CVV stands for Card Verification Value. It's a number printed on your credit card — usually on the back, near your signature — that exists only to prove you physically have the card in your hand. When you buy something online or over the phone, the merchant asks for this code to confirm you're not just using a stolen card number.
The CVV is not stored in the magnetic stripe or chip on your card. It's printed on the card itself. This matters because someone who steals your card number from a database or intercepts it online won't have the CVV unless they also have the physical card. It's a simple check: if you can read the code off the card, you probably own it.
American Express calls theirs the CID (Card Identification Number) and prints it on the front. Visa, Mastercard, and Discover print theirs on the back. The length is always three digits for Visa, Mastercard, and Discover, and four digits for American Express.
Key Takeaways
- CVV is a three- or four-digit code printed on your card that proves you physically have it when you shop online or by phone.
- The code is not stored in your card's chip or magnetic stripe, so a thief with only your card number cannot use it without the physical card.
- You should never share your CVV in person, by email, or by text — legitimate businesses will never ask for it that way.
- Merchants cannot store your CVV after a transaction, so if a company asks you to give it to them to keep on file, that is a red flag.
Why merchants ask for the CVV during checkout
When you enter your card number, expiration date, and CVV into a website, the merchant sends that information to their payment processor. The processor checks the CVV against the card issuer's records to confirm the code matches. If it does, the transaction is more likely to be legitimate. If it doesn't, the transaction is declined.
This check happens in seconds and is invisible to you. The merchant never sees your actual CVV — the payment processor handles the verification and only tells the merchant whether the code was correct or not. This is why you have to enter it every time you shop online, even if the merchant has your card number saved.
For in-person purchases, you don't need to provide the CVV because the cashier can see you have the physical card. The chip or magnetic stripe on the card itself proves you have it.
What happens if you give your CVV to the wrong person
If someone has your card number, expiration date, and CVV, they can make online purchases as if they were you. They cannot use the card in a store because they don't have the physical card, but they can shop on websites, over the phone, or through apps.
This is why you should never share your CVV by email, text, or phone call — not even if someone claims to be from your bank or the merchant. Your bank will never ask for your CVV. Legitimate merchants will never ask you to email or text it. If someone asks, it is a scam.
If you believe your CVV has been compromised, contact your card issuer immediately. They can cancel your card and issue a new one. You are not responsible for fraudulent charges made with your card, but reporting them quickly protects you and helps your bank investigate.
CVV is not the same as your PIN
Your PIN (Personal Identification Number) is a four-digit code you create and use at ATMs and in-store card readers. Your CVV is printed on the card and you do not choose it. They serve different purposes: your PIN proves you know a secret only you should know, while your CVV proves you have the physical card.
You should never share your PIN with anyone, including bank employees or merchants. You should also never share your CVV, but for a different reason — the CVV is meant to be read off the card, so it is less secret than your PIN. Still, you should only enter it when you are the one initiating the transaction.
Why merchants cannot store your CVV
Payment card networks — Visa, Mastercard, American Express, and Discover — have rules that prevent merchants from storing your CVV after a transaction is complete. The rule exists because the CVV is supposed to prove you have the card in your hand at that moment. If a merchant stored it, the code would lose its purpose.
If a company asks you to give them your CVV so they can keep it on file for future charges, that is a warning sign. Legitimate merchants use a different system called tokenization, where they store a token — a substitute code — instead of your actual card number or CVV. When you authorize a recurring charge, the merchant uses the token, not your CVV.
Some older or smaller merchants may not understand this rule and ask for your CVV anyway. If they do, you can decline and ask if they have another way to set up recurring payments. If they insist, consider using a different merchant.
How to protect your CVV
Treat your CVV like you would treat the card itself. Do not write it down or store it in your phone. Do not take a photo of your card. Do not share it by email, text, or phone. Only enter it on secure websites — look for the padlock icon in your browser and a URL that starts with "https://" rather than "http://".
When you shop in person, shield the card reader with your hand so no one can see you enter your PIN. Online, make sure you are on the merchant's real website, not a fake one designed to steal your information. If you are unsure, type the website address directly into your browser rather than clicking a link in an email.
If you lose your card or suspect it has been stolen, call your card issuer right away. They will cancel the card and send you a new one with a new CVV. The old CVV will no longer work.
Frequently Asked Questions
Can someone use my card if they only have my card number and CVV?
Yes, they can make online purchases, over the phone, or through apps. They cannot use it in a store because they do not have the physical card. If this happens, contact your card issuer immediately to report fraud and request a new card.
Is it safe to enter my CVV on a website?
It is safe on legitimate, secure websites. Look for a padlock icon in your browser and a URL starting with "https://". Never enter your CVV on a website you reached through a suspicious email or text, and never enter it if the website looks fake or asks for information that seems unusual.
What should I do if I accidentally shared my CVV?
Call your card issuer right away and tell them what happened. They can monitor your account for fraud and issue a new card if needed. You are not responsible for fraudulent charges, but reporting quickly helps protect you and your account.
Why do I have to enter my CVV every time I shop online if the merchant has my card number?
Because the CVV proves you have the physical card at that moment. Merchants cannot store it, so you must enter it each time. This protects you by making it harder for someone with only your card number to make purchases.
Do I need to memorize my CVV?
No. You only need to read it off the back of your card when you are making a purchase. Do not write it down or store it anywhere. Keeping it only on the physical card is what makes it secure.