CVV is the three- or four-digit security code on your credit card
CVV stands for Card Verification Value. It is a number printed on your card — not embedded in the chip or magnetic stripe — that exists only to prove you physically hold the card when you make a purchase online or over the phone. Visa and Mastercard call it CVV2. American Express calls it CID and prints four digits instead of three. Discover calls it CID as well.
The CVV is not your PIN. Your PIN is what you enter at an ATM or a payment terminal in a store. The CVV is what you type into a website checkout form or give to a customer service representative on a phone call. A merchant who takes your CVV is checking that you have the physical card in front of you at that moment.
The code is printed on the card but not stored in any database that merchants can access. When you give a merchant your CVV, they send it to your card issuer (your bank) to verify. The issuer checks that the number matches what they have on file for your card, then tells the merchant yes or no. The merchant never sees your actual CVV — they only get a yes or no answer.
Key Takeaways
- CVV is a three- or four-digit code printed on the back of your card (or front, for American Express) that proves you physically hold the card.
- You enter your CVV when you buy something online or over the phone, but not when you swipe or insert your card in person at a store.
- Your card issuer verifies the CVV but merchants never see the actual number — they only get a yes or no response.
- Never give your CVV to someone who calls you or emails you claiming to be from your bank; your bank already has this number on file.
Where to find your CVV on your card
For Visa, Mastercard, and Discover cards, the CVV is on the back of the card. Look at the signature strip — the white or light-colored panel on the back. The CVV is the last three digits printed to the right of the signature line. It appears after the full card number is printed in smaller text.
For American Express cards, the CVV is on the front. It is a four-digit number printed above the card number, on the right side. American Express calls this the CID (Card Identification Number) instead of CVV, but it serves the same purpose.
Do not confuse the CVV with the card number itself. The card number is longer (usually 16 digits for Visa and Mastercard, 15 for American Express) and appears on the front of the card. The CVV is much shorter and appears separately.
Why merchants ask for your CVV online
When you enter your card information on a website, the merchant cannot see you or touch your card. They have your card number, expiration date, and name — all of which are printed on the front where anyone could see them if they looked at your card for a few seconds. The CVV proves you actually have the card in your hands right now, not just the number written down somewhere.
This is why CVV is required for online purchases but not for in-person purchases. When you hand your card to a cashier or insert it into a terminal, the merchant can see that you have the physical card. Online, they cannot, so they ask for the CVV as proof.
Some merchants also ask for CVV when you call to place an order by phone. The same logic applies: they cannot see your card, so they ask for the code to verify you have it.
What CVV does and does not protect you against
CVV protects against one specific type of fraud: someone using your card number without having the physical card. If a thief steals your card number from a data breach or a receipt, they cannot complete an online purchase without the CVV. This is why CVV exists.
CVV does not protect you if someone steals your actual card. If a thief has your card in hand, they have the CVV too. They can use it to make online purchases or call a merchant and place an order. CVV also does not protect you against in-person fraud — a thief with your card can swipe it at a store just as you can.
CVV is one layer of security, not a complete shield. It works alongside other protections like fraud monitoring by your bank, purchase limits, and your right to dispute unauthorized charges.
Never give your CVV to someone who contacts you
Your bank, credit card company, and legitimate merchants will never call you or email you asking for your CVV. They already have this number on file. If someone contacts you claiming to be from your bank and asks for your CVV, it is a scam.
The same rule applies to text messages and social media. Do not give your CVV to anyone who reaches out to you, no matter what reason they claim. Legitimate companies only ask for CVV when you initiate the transaction — when you are the one entering information into their website or calling their customer service line.
If you receive a suspicious call or message, hang up or do not respond. Then call your bank directly using the number on the back of your card or on your statement. Do not use a phone number from the suspicious message.
CVV and data breaches
When a retailer's database is hacked and customer card information is stolen, the CVV is often not included in what the thief gets. This is because most merchants are not supposed to store CVV data after a transaction is complete. Payment card industry rules prohibit it.
However, not all merchants follow this rule, and not all breaches are the same. In some cases, CVV has been stolen along with card numbers. If your card information is compromised in a breach, your bank will typically cancel your card and issue a new one, which will have a new CVV.
You do not need to do anything to get a new card after a breach — your bank handles this. You will receive the new card in the mail with a new CVV printed on it.
Frequently Asked Questions
Do I need to enter my CVV every time I use my card online?
Most of the time, yes. Some websites offer to save your card information for future purchases, but you should be cautious about this. If you allow a website to store your card details, you may not need to enter the CVV again. However, this also means your information is stored on their servers, which increases the risk if they are hacked. Many people prefer to enter their CVV each time for security.
What if I can't find my CVV or it's worn off?
Contact your bank or card issuer. They can tell you your CVV over the phone after they verify your identity. You can also request a replacement card if the number is illegible. Your bank will mail you a new card with a new CVV printed clearly on it.
Is it safe to write down my CVV?
No. Do not write your CVV on your card, in a notebook, or anywhere else. The whole point of the CVV is that it is not stored in databases — it exists only on the physical card. If you write it down, you defeat that protection. Memorize it if you need to, or look at your card when you need it.
Can someone use my card if they only have the CVV?
No. They also need your card number and expiration date. The CVV alone is not enough to make a purchase. However, if someone has all three pieces of information — card number, expiration date, and CVV — they can make online purchases or phone orders without your knowledge.
Why does American Express put the CVV on the front instead of the back?
American Express designed their cards differently for historical reasons. The four-digit CID on the front serves the same purpose as the three-digit CVV on the back of other cards. It is still a security feature that proves you have the physical card. The location does not change how it works.