The CVV is the three- or four-digit security code on the back of your card

The CVV (Card Verification Value) is a short number printed on your credit card that proves you physically have the card in your hand. It is not encoded in the magnetic stripe or chip — it is printed only on the card itself. For most cards, it is a three-digit number on the back, near your signature. American Express cards have a four-digit code on the front, above the card number.

The CVV exists because online and phone transactions cannot read your chip or swipe your card. When you enter your card number, expiration date, and CVV into a website or give them to a customer service representative, that CVV tells the payment processor you have the physical card. It is one layer of fraud protection, though not a complete one.

You should never share your CVV with anyone except the merchant you are paying directly. It should not appear in receipts, emails, or text messages. If someone calls you and asks for your CVV, hang up — legitimate companies will never ask for it by phone.

Key Takeaways

  • The CVV is a three-digit code on the back of most credit cards, or a four-digit code on the front of American Express cards.
  • You need the CVV to complete online purchases and phone orders, but you should never store it or share it outside of an active transaction.
  • The CVV is printed on the card only and is not stored in the chip or magnetic stripe, which is why merchants ask for it separately.
  • Legitimate companies will never ask for your CVV by phone, email, or text — only enter it directly into a payment form you initiate yourself.

How to locate your CVV on different card types

On a Visa, Mastercard, or Discover card, flip the card over and look at the back. On the right side of the signature panel, you will see a three-digit number printed after the words "CVV," "CVC," "CID," or sometimes just a blank space where the number sits. This is your CVV. It is always three digits for these card types.

On an American Express card, the CVV is different. Look at the front of the card, above the card number on the right side. You will see a four-digit number. This is your CVV. American Express calls it the "4-digit security code," but it serves the same purpose as the three-digit codes on other cards.

Some older cards or specialty cards may have the code in a slightly different location, but the back-right position (for Visa, Mastercard, Discover) or front-right position (for American Express) covers the vast majority of cards in circulation.

When you need to provide your CVV

You will need your CVV whenever you make a purchase without physically handing your card to someone. This includes online shopping, phone orders, and mail orders. When you enter your card details into a website checkout form, there is always a field for the CVV. When you call a company to place an order, the representative will ask for it.

You do not need to provide your CVV when you swipe or insert your card in person at a store, gas station, or restaurant. The card reader can access the security information from the chip or magnetic stripe. The CVV is only for situations where the merchant cannot read the physical card.

Some merchants also ask for your CVV when you are making a payment to an existing account — for example, paying a utility bill or credit card bill online. This is normal and expected. The CVV is a standard part of card verification for any remote transaction.

Why merchants ask for the CVV

The CVV is a basic fraud check. If someone has stolen your card number but does not have the physical card, they cannot know the CVV. When a merchant verifies the CVV against the card number and expiration date, it confirms that the person making the purchase has the card itself, not just the number.

This is not foolproof. A thief who has your card in hand has the CVV. A data breach that exposes your card number might also expose your CVV if the merchant stored it (though legitimate merchants are not supposed to store CVVs). But for everyday online shopping, the CVV catches many fraudulent transactions where only the card number was compromised.

Payment processors and card networks require merchants to ask for the CVV on card-not-present transactions. It is part of the standard security protocol, not optional. If a website does not ask for a CVV, that is a red flag that the site may not be secure.

What not to do with your CVV

Never write your CVV down or store it anywhere — not in your phone, not in a password manager, not in an email draft. The whole point of the CVV is that it is on the physical card only. If you memorize it, that is fine, but do not create a record of it.

Never give your CVV to anyone who contacts you first — not by phone, email, text, or social media. Legitimate companies will never ask for it this way. If your bank calls you about a transaction, they already have your card information and will not ask for the CVV. If a website asks you to enter your CVV in an email link, do not click it. Go directly to the website yourself and enter your information there.

Never use the same CVV twice if you can avoid it. Each time you enter it, there is a small risk that it is being recorded by a compromised website or intercepted in transit. This is why some payment systems offer one-time card numbers or digital wallet options — they reduce the number of times your actual CVV is exposed.

Digital wallets and CVV alternatives

If you use Apple Pay, Google Pay, Samsung Pay, or your bank's digital wallet, you do not enter your CVV for most transactions. You authenticate with your fingerprint, face, or PIN instead. The wallet sends an encrypted token to the merchant, not your actual card number or CVV. This is more secure than typing your CVV into a website.

Some merchants also offer "save my card" options that let you store your card on file without storing the CVV. When you check out, you select the saved card and the CVV field is blank — the merchant already has your number on file and does not need the CVV again. This is safe only if you trust the merchant's security practices.

For one-time purchases from merchants you do not plan to return to, entering the CVV each time is actually safer than saving your card. You are not creating a stored record that could be breached later.

What to do if your CVV is compromised

If you believe your CVV has been exposed — for example, through a data breach at a merchant where you shopped — you do not need to do anything special. Your CVV is only useful to someone who also has your card number and expiration date. If all three pieces of information are compromised, contact your card issuer and report unauthorized transactions.

Your card issuer can issue you a new card with a new CVV. The old CVV becomes useless because it is tied to the old card. This is one reason why card issuers replace cards after a breach — the new card has a new CVV, making the old one worthless to a thief.

You cannot change just the CVV on an existing card. The CVV is printed at the time the card is manufactured. If you want a new CVV, you need a new card. Most issuers will replace a card for free if there has been a breach or if you report fraud.

Frequently Asked Questions

Is the CVV the same as the card security code?

Yes. CVV, CVC, CID, and "security code" all refer to the same three- or four-digit number. Different card networks use different names — Visa calls it CVV, Mastercard calls it CVC, American Express calls it CID — but they all serve the same purpose and are located in the same place on the card.

Can someone use my card if they only have the CVV?

No. A thief needs your card number, expiration date, and CVV to make an online purchase. Having only the CVV is useless. This is why the CVV is a useful security feature — it proves you have the physical card, not just the number.

Why does my receipt not show my full CVV?

Merchants are not allowed to store or print your full CVV. Payment card industry rules require that receipts and stored records show only the last four digits of your card number and nothing of the CVV. This protects you if a receipt is lost or stolen.

Do debit cards have a CVV?

Yes. Debit cards issued by Visa, Mastercard, or Discover have a CVV in the same location as credit cards. The CVV works the same way — you need it for online and phone purchases. American Express debit cards also have a four-digit code on the front.

What if I enter the wrong CVV?

The transaction will be declined. The payment processor will reject it because the CVV does not match the card number. You can try again with the correct CVV. Entering the wrong CVV multiple times in a row may temporarily lock your card as a fraud prevention measure, but one or two mistakes will not cause a problem.