CVV stands for Card Verification Value, a three- or four-digit security code printed on your credit card

The CVV is a number your card issuer adds to verify you physically hold the card when you make a purchase. It appears on the back of most cards as a three-digit code, or on the front of American Express cards as a four-digit code. The CVV itself is not stored in the card's magnetic stripe or chip — it only exists on the physical card and in your card issuer's records. This design means a thief who steals your card number online cannot complete a purchase without also having the physical card in hand.

Different card networks call this code by different names. Visa and Discover call it CVV2, Mastercard calls it CVC2, and American Express calls it CID. The function is the same across all of them: to add a layer of security to card-not-present transactions like online shopping or phone orders.

Key Takeaways

  • CVV is a three- or four-digit code printed on your card that proves you physically hold it during online or phone purchases.
  • The code is not stored in your card's chip or magnetic stripe, so someone with only your card number cannot use it without the CVV.
  • You should never share your CVV with anyone except the merchant you are paying, and legitimate companies will never ask for it by email or phone.
  • Merchants are not supposed to store your CVV after a transaction, so if a data breach occurs, the CVV should not be exposed.

Where the CVV appears on your card

On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express cards, the four-digit code appears on the front, above the card number on the right side. The location matters because it confirms you are looking at the physical card — a scammer with only your card number would not know where to find it or what it is.

The CVV is printed in a specific way that makes it harder to photocopy or scan. On most cards, the code appears in a raised or embossed format, or in a special ink that does not reproduce well on a copy. This physical security feature reinforces the idea that the code proves possession of the actual card.

Why merchants ask for your CVV

When you shop online or by phone, the merchant cannot see your physical card. Asking for the CVV is their way of confirming that you have the card in your hands right now. The merchant sends your CVV to your card issuer, who checks whether the code matches their records. If it does not match, the transaction is declined.

This check happens in seconds and is invisible to you. The merchant never needs to store the CVV after the transaction is complete — in fact, payment card industry rules forbid them from doing so. If a merchant's database is hacked, your CVV should not be in it.

How CVV differs from your card number

Your 16-digit card number is the main identifier for your account. It is stored in many places: your card issuer's system, the merchants you shop with regularly, your bank's records, and payment processors. If your card number is stolen, a thief can try to use it online or over the phone, but they will be stopped at checkout when asked for the CVV.

The CVV is a one-time verification tool, not an account identifier. It proves you have the physical card at that moment. Because it is not stored by merchants and changes only if you request a new card, it is much harder to steal or misuse than your card number alone. This is why you should treat your CVV as more sensitive than your card number — it is the last line of defense against unauthorized purchases.

Red flags: when someone should not ask for your CVV

Legitimate companies will ask for your CVV only during checkout on a secure website or when you call them to place an order. They will never ask for it by email, text message, or social media. They will never ask you to read it aloud to a customer service representative unless you initiated the call to make a purchase. If someone contacts you claiming to verify your account and asks for your CVV, it is a scam.

Your card issuer already has your CVV on file — they do not need you to provide it to confirm your identity. If your bank calls you about suspicious activity, they will ask you to verify other details like your address or recent transactions, not your CVV. Hang up and call the number on the back of your card if you are unsure whether a call is legitimate.

What to do if your CVV is compromised

If you believe your CVV has been exposed — for example, through a data breach at a merchant or a phishing email you fell for — contact your card issuer right away. You can call the number on the back of your card. Your issuer can cancel your current card and issue you a new one with a different CVV. The old CVV will no longer work, even if someone has it.

You do not need to wait for fraudulent charges to appear. If you suspect your CVV is in the hands of someone who should not have it, requesting a replacement card is the fastest way to protect yourself. Most card issuers can mail a replacement within 5 to 10 business days, and many offer a temporary card number you can use online in the meantime.

Frequently Asked Questions

Is my CVV the same as my PIN?

No. Your PIN is a four-digit code you create and use at ATMs and in-person at stores. Your CVV is a code printed on your card that you use for online and phone purchases. Only you know your PIN; the CVV is visible on the card itself. They serve different security purposes.

Can someone use my card if they have my card number but not my CVV?

They can try, but most online and phone merchants will decline the transaction if the CVV does not match. In-person purchases do not require a CVV because the merchant can see your physical card. Online and phone purchases almost always do, which is why the CVV is an important security layer.

Should I write my CVV down or save it somewhere?

No. You should memorize it or look at your physical card each time you need it. Never write it down, store it in your phone, or save it in an email or note-taking app. The only place your CVV should be stored is on your card and in your card issuer's secure system.

What if I forgot my CVV?

Look at the back of your physical card — the three- or four-digit code is printed there. If you do not have your card with you, you can call your card issuer and they can read it to you over the phone after verifying your identity. Never ask someone else to read it to you or share it over text or email.