CVV is the three- or four-digit security code on your credit card
CVV stands for Card Verification Value. It is a number printed on your card — not encoded in the magnetic stripe or chip — that exists only to prove you physically have the card in your hand. When you enter it during an online purchase or over the phone, you are telling the merchant you can see the card itself.
The CVV is not the same as your card number or PIN. Your card number identifies your account. Your PIN is what you use at an ATM or in person at a store. The CVV serves a different purpose: it is a fraud prevention tool that works only for remote transactions — online, by phone, or by mail — where the merchant cannot swipe or insert your card.
Visa and Mastercard call it CVV2. American Express calls it CID (Card Identification Data). Discover calls it CID as well. The function is identical across all card types.
Key Takeaways
- CVV is a three- or four-digit code printed on the back of your card (or front, on American Express) that proves you have the physical card.
- You enter your CVV when you buy something online or over the phone, but never when you swipe or insert your card in person.
- The CVV is printed on the card surface only and does not appear on receipts or statements, so merchants should not store it after a transaction.
- Giving your CVV to someone you do not trust is as risky as giving them your card number, because together they can make online purchases in your name.
Where to find your CVV on your card
For Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, to the right of the signature panel. You will see it after the last four digits of your card number are printed there.
For American Express cards, the CVV is a four-digit number printed on the front of the card, above the card number on the right side. It is smaller than the card number itself.
Do not confuse the CVV with the expiration date, which appears on the front of all cards. The expiration date tells you when the card stops working. The CVV is separate and serves only to verify you have the card during remote purchases.
Why merchants ask for your CVV
When you enter your CVV during an online checkout or phone order, the merchant sends it to the card network (Visa, Mastercard, etc.) to verify that you have the card. The network checks the number against what is on file and returns a yes or no — but the merchant never learns what the actual CVV is. This is by design.
The CVV reduces fraud because a thief who steals your card number from a data breach or a receipt cannot use it online without also having the physical card to read the CVV from. It is a second piece of information that is harder to obtain remotely.
Some merchants also ask for your CVV when you call to place an order by phone. This serves the same purpose: to confirm you have the card in front of you and are authorizing the charge yourself.
What merchants should and should not do with your CVV
Legitimate merchants do not store your CVV after a transaction is complete. Payment card industry rules forbid it. If a merchant stores your CVV, they are breaking the rules and exposing themselves to liability — and you to risk, because a data breach would expose that number.
You should never enter your CVV on a website that does not use encryption (look for "https://" in the address bar and a padlock icon). You should never give your CVV to someone over the phone unless you initiated the call to a merchant you trust. You should never write your CVV on a check or include it in an email.
If a website asks you to enter your CVV but does not ask for your full card number, that is a warning sign. Legitimate online purchases require both. If a site asks for your CVV alone, it may be a phishing attempt designed to steal your card information.
CVV is not the same as your card's security features
Your card may also have a hologram, a raised number, or a chip. These are different security features that work in different ways. The hologram and raised numbers make it harder to counterfeit a card. The chip encrypts your card data when you insert it in a reader, which protects you against skimming — a technique where a thief reads your card data without touching it.
The CVV does not protect you against in-person fraud because you do not enter it when you swipe or insert your card at a store or ATM. It protects you only during remote transactions where the merchant cannot physically verify the card.
What to do if your CVV is compromised
If you believe someone has your card number and CVV — for example, because you entered it on a fraudulent website or gave it to someone you later realized was untrustworthy — contact your card issuer immediately. Tell them you suspect fraud and ask them to cancel the card and issue a replacement.
Your card issuer can review recent transactions and dispute any charges you did not make. Most card issuers offer fraud protection that limits your liability to $50 or zero, depending on when you report the fraud. The sooner you call, the better your protection.
You do not need to wait for fraudulent charges to appear on your statement. If you believe your card information is at risk, call your issuer right away. They can cancel the card before damage occurs.
Frequently Asked Questions
Can someone use my card if they only have my card number, not my CVV?
They can use it in person at a store or ATM if they have a counterfeit card made with your number. Online, they cannot complete most purchases without the CVV. However, some older or less secure websites may not require it, so do not assume your card is safe just because your CVV is unknown to others. Monitor your statements regularly.
Is it safe to save my CVV on a website for faster checkout?
No. Legitimate websites will not let you save your CVV. If a site offers to store it, that is a red flag. You can safely save your card number and expiration date for repeat purchases, but the CVV should be entered fresh each time.
What if I cannot find my CVV?
If your card is damaged and the CVV is worn away or unreadable, contact your card issuer. They can read it from their records and tell you what it is, or they can issue a replacement card. Do not give your card number to anyone else to read the CVV for you.
Do I need to enter my CVV at gas pumps or ATMs?
No. Gas pumps and ATMs do not ask for your CVV. If a machine asks for it, do not use that machine — it may be a skimming device designed to steal your information. Report it to the gas station or bank that owns it.