The verification code is a three- or four-digit number printed on your card itself, separate from your account number
The Card Verification Value (CVV), also called the Card Security Code or CVC, is a short number that proves you physically have the card in your hand. It is not stored in the card's magnetic stripe or chip, and it does not appear on your statement or billing address. The card issuer uses it to confirm that you — not someone who has stolen your account number — are making the purchase.
Where it sits depends on which network issued your card. On Visa, Mastercard, and Discover cards, the code is a three-digit number printed on the back of the card, to the right of the signature panel. On American Express cards, it is a four-digit number printed on the front, above and to the right of your account number. Neither location is random; the issuer prints it in the same spot on every card they produce.
This code serves one purpose: online and phone purchases where the merchant cannot physically swipe or insert your card. When you enter it during checkout, the merchant sends it to the payment processor, who checks it against the code on file. If it matches, the transaction proceeds. If it does not, the purchase is declined.
Key Takeaways
- The CVV is a three-digit code on the back of Visa, Mastercard, and Discover cards, or a four-digit code on the front of American Express cards.
- You should never store or share your CVV with anyone except during an active purchase with a merchant you trust.
- The code does not appear on your monthly statement, and your card issuer will never ask you to provide it over the phone or email.
- If your card is lost or stolen, the CVV on the back of the replacement card will be different, which is why thieves cannot use a stolen card number alone for online purchases.
Why the verification code is not the same as your account number
Your account number — the 16 digits (or 15 on American Express) printed on the front of your card — is what identifies your account to the card network and your bank. Merchants, payment processors, and billing systems store this number routinely. If a data breach occurs, your account number is often what gets stolen.
The CVV is deliberately kept separate. It is printed on the card but not encoded in the magnetic stripe or chip. This means that even if a thief steals your account number from a retailer's database or intercepts it during a transaction, they cannot use it for online or phone purchases without the CVV. They would need physical access to your card to read the code off the back.
When you make a purchase in person — swiping, inserting, or tapping your card at a store — the merchant does not need the CVV. The card reader communicates directly with your bank through the chip or stripe. The CVV is only required when the merchant cannot read the card itself, which is why it matters for online shopping, mail orders, and phone purchases.
Where to find your verification code on different card types
| Card Network | Code Length | Location |
|---|---|---|
| Visa | 3 digits | Back of card, right of signature panel |
| Mastercard | 3 digits | Back of card, right of signature panel |
| Discover | 3 digits | Back of card, right of signature panel |
| American Express | 4 digits | Front of card, above account number |
If you cannot find the code on your card, check that you are looking in the correct location for your card type. The code is always printed directly on the plastic; it is never embossed or raised like your account number. On the back of most cards, you will see the full account number printed once more, followed by the signature panel, and then the three-digit CVV to the right.
If your card is damaged and the CVV is worn away or illegible, you can still use the card in person at a store. For online purchases, you will need to contact your card issuer and request a replacement card. The new card will have a different CVV printed on it, which is a security feature — it means the old CVV becomes useless if the card is compromised.
What to do if you have shared your verification code with someone
If you have entered your CVV on a website that looked suspicious, or if you gave it to someone over the phone who called claiming to be from your bank, contact your card issuer immediately. Do not wait to see if fraudulent charges appear. Call the number on the back of your card or your statement — never use a number from an email or text message, as those could be from a scammer.
Tell the issuer that you may have shared your CVV with an unauthorized person. They will likely cancel your card and issue a replacement with a new CVV. This stops anyone who has your old account number and CVV from making online purchases. Your account number may still be at risk, but the new CVV makes it much harder to use without physical access to the new card.
Charges that appear on your account after you report the compromise are typically covered by your card issuer's fraud protection. Most issuers have zero-liability policies, meaning you are not responsible for unauthorized charges once you have reported them. The issuer will investigate and reverse the charges while they send you a replacement card.
Why merchants should never ask you to store your CVV
Legitimate merchants do not ask you to save your CVV for future purchases. When you set up a payment method on a website — for recurring subscriptions or one-click checkout — the merchant stores your account number and expiration date, but not the CVV. Each time you make a purchase, you either enter the CVV again or the merchant uses a token, a unique identifier that represents your card without exposing the actual number.
If a website or phone representative asks you to write down your CVV or save it in a file, that is a sign of fraud. Scammers often pose as customer service representatives and ask for the CVV under the pretense of "updating your account" or "verifying your identity." Your card issuer already has your CVV on file — they do not need you to provide it over the phone or email.
The same rule applies to text messages and emails. Your bank will never ask for your CVV, account number, or PIN through email, text, or an unsolicited phone call. If you receive a message claiming to be from your card issuer and asking for this information, do not respond. Instead, hang up or delete the message and call the number on the back of your card to report it.
How the verification code protects you in a data breach
When a retailer's database is hacked and thousands of account numbers are stolen, the CVV is not usually part of what the thieves get. Payment Card Industry Data Security Standard (PCI DSS) rules forbid merchants from storing CVVs after a transaction is complete. This means that even if a hacker accesses the retailer's payment system, the CVV is not there to steal.
Without the CVV, a thief who has your account number can still make in-person purchases at stores that do not check for it, or they can attempt mail orders or phone purchases by guessing the CVV. However, most payment processors now decline transactions when the CVV does not match, making this much harder. The thief would need to guess a three-digit code correctly, and most systems lock the account after a few failed attempts.
This is why replacing your card after a breach is important. The new card has a different CVV, which invalidates any stolen CVV from the old card. Even if the thief has your account number, they cannot use the old CVV for online purchases anymore.
Frequently Asked Questions
Can I use my card online without entering the CVV?
Some merchants do not require it, especially if you have made purchases with them before or if you are using a digital wallet like Apple Pay or Google Pay. However, most online retailers require the CVV as a security check. If a website does not ask for it, that does not mean it is unsafe — it means the merchant has decided the risk is acceptable or they are using another verification method.
What if I forget my CVV?
Look at the back of your physical card. The CVV is printed there and does not change unless you get a replacement card. If your card is not with you, you can call your card issuer and they can read it to you over the phone, though most issuers will ask security questions first to confirm your identity. Never ask someone else to read it to you or look it up online.
Is the CVV the same as my PIN?
No. Your PIN is a four-digit code you create and use at ATMs and in-store card readers. Your CVV is a three- or four-digit code printed on the card by the issuer and used only for online and phone purchases. They serve different purposes and are not interchangeable.
Will my new card have the same CVV as my old one?
No. Each card is printed with its own unique CVV. When you receive a replacement card — whether because the old one expired, was lost, or was compromised — the new card will have a different CVV. This is intentional and improves security.
Can someone use my account number without the CVV?
For online purchases, it is much harder without the CVV, because most merchants require it. For in-person purchases, a thief with only your account number can sometimes make a purchase if the store's system does not verify the CVV or if they use an older payment method. This is why monitoring your statement regularly and reporting unauthorized charges quickly is important.