The CVV is a three- or four-digit security code printed on your card, separate from your account number
The CVV (Card Verification Value) is a number on the back of most credit cards, usually three digits long. On American Express cards, it appears on the front and is four digits. This code exists to verify that you physically have the card in your hand when you make a purchase — especially important for online or phone transactions where the seller cannot see the card itself.
The CVV is not stored in the card's magnetic stripe or chip. It is printed on the card only, which means a merchant who has stolen your account number alone cannot use it without also having the physical card or knowing this separate code. This is why websites ask for it during checkout, and why you should never share it over email or text.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card that proves you physically possess it.
- Visa and Mastercard cards have a three-digit CVV on the back; American Express has a four-digit code on the front.
- Merchants use the CVV to reduce fraud during online and phone purchases, but they are not supposed to store it after the transaction.
- Never share your CVV by email, text, or phone call — legitimate companies will only ask for it during a secure checkout or payment page.
Where to find your CVV and what it looks like
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature panel. On American Express cards, it is a four-digit code printed on the front, above the account number on the right side.
The code is printed directly onto the card surface — it is not embossed like your account number, and it does not appear anywhere else on your statement or in your online banking portal. This physical-only placement is intentional: it makes the code harder to steal through a data breach, since the number never travels through the bank's computer systems the way your account number does.
Why merchants ask for it during online purchases
When you buy something online, the merchant cannot physically inspect your card. The CVV serves as a quick proof that you have the card in front of you. During checkout, you type the CVV into a secure payment form, and the payment processor checks it against the card issuer's records. If the code matches, the transaction moves forward; if it does not, the purchase is declined.
This check happens in seconds and reduces the risk that someone who stole your account number is using it without your permission. It is not foolproof — a person who has both your account number and CVV can still make fraudulent purchases — but it stops many common theft scenarios, particularly those involving data breaches that expose card numbers but not the physical cards themselves.
What merchants are and are not allowed to do with your CVV
Payment card networks (Visa, Mastercard, American Express, and Discover) have strict rules about CVV storage. Merchants are not permitted to store your CVV after a transaction is complete. If a merchant's database is breached, the CVV should not be there to steal. The code can be used to verify a single transaction, but then it must be deleted.
In practice, this rule is enforced unevenly. Some merchants follow it carefully; others do not. This is one reason why you should avoid entering your CVV on websites that seem untrustworthy or that do not use a secure checkout page (look for "https://" in the address bar and a padlock icon). If a company asks you to email your CVV or provide it over the phone to a number you called yourself, that is a red flag — legitimate businesses do not request it that way.
CVV fraud and what to do if yours is compromised
If someone obtains your CVV along with your account number and expiration date, they can make online or phone purchases in your name. This is one form of credit card fraud. If you notice unauthorized charges on your statement, contact your card issuer immediately — most credit card companies limit your liability for fraudulent charges to $50, and many waive that entirely if you report the fraud quickly.
If you believe your CVV has been compromised, you do not need to do anything special beyond reporting the fraud. Your card issuer will investigate the unauthorized charges and typically issue you a new card with a new account number and a new CVV. The old card will be deactivated. You should also monitor your credit report for a few months to watch for identity theft, though a CVV breach alone does not usually lead to that.
How CVV checks differ from other security features
The CVV is one layer of fraud protection, but it is not the only one. When you use your physical card in a store, the merchant reads the chip or magnetic stripe, which contains encrypted information that is harder to forge than a printed number. When you make a purchase online, the CVV is checked, but so is the billing address you provide — if it does not match the address on file with your bank, the transaction may be declined.
Some card issuers also use additional tools like purchase alerts (notifying you of large or unusual transactions), 3D Secure verification (a second password for online purchases), and fraud monitoring software that flags suspicious patterns. The CVV is a simple, widely used tool, but it works best as part of a larger system of checks.
Frequently Asked Questions
Is it safe to give my CVV to a website?
It is safe if the website uses a secure checkout page (look for "https://" and a padlock icon in your browser). Never enter your CVV on an unsecured page, and never provide it via email or text. Legitimate retailers only ask for it during payment processing, not before or after.
What if I lose my card — does someone need the CVV to use it?
If someone finds your physical card, they have both the account number and the CVV printed on it, so yes, they can use it for online purchases. Call your card issuer immediately to report it lost. They will deactivate the card and send you a replacement with a new number and CVV.
Can I see my CVV in my online banking account?
No. Banks and card issuers intentionally do not display the CVV online or in statements. It only appears on the physical card itself. If a website claims to show you your CVV, it is not a legitimate banking site.
Does the CVV protect me from in-person fraud?
No. The CVV is only used for online and phone purchases. In a store, the merchant reads your chip or magnetic stripe instead. For in-person fraud protection, you rely on the chip technology and your card issuer's fraud monitoring.