The CVV is a three- or four-digit security code printed on your card, separate from your card number

The CVV (Card Verification Value) is a number on the back of your credit card designed to prove you physically hold the card when you make a purchase. On most cards, it is three digits printed on the signature strip on the back. American Express cards print a four-digit CVV on the front, above the card number.

The CVV is not encoded in the magnetic stripe or chip — it only appears as printed text. This means a merchant who has stolen your card number from a database cannot use it online without also having the physical card or a photo of it. The code changes nothing about how your card works in person; it exists only to verify remote purchases.

Merchants never store your CVV after a transaction. Payment processors use it once to confirm the purchase is legitimate, then discard it. This is why a data breach of a retailer's database does not usually include CVV numbers — they are not supposed to be there.

Key Takeaways

  • The CVV is a three- or four-digit code printed on your card that proves you physically hold it when shopping online or by phone.
  • Merchants and payment processors do not store your CVV after the transaction, so a stolen card number alone cannot be used online without it.
  • You should never share your CVV with anyone except the merchant or payment processor during a legitimate purchase.
  • If someone asks for your CVV by email, text, or phone call, it is a fraud attempt — legitimate businesses never request it that way.

Where the CVV appears on different card types

Visa, Mastercard, and Discover cards print the CVV on the back, in the signature area, as three digits. It usually appears after the last four digits of your card number or in a separate box.

American Express prints a four-digit code called the CID (Card Identification Number) on the front of the card, above the card number on the right side. Some older Amex cards also printed a code on the back, but the front code is the one merchants request.

If your card is damaged and the CVV is no longer readable, contact your card issuer to request a replacement card. You cannot use the card for online or phone purchases without it, since merchants will reject the transaction when the CVV does not match.

Why merchants ask for the CVV during online and phone purchases

When you enter your card number, expiration date, and CVV into a website or give them to a phone representative, the payment processor checks that all three pieces of information match the card on file. If the CVV does not match, the transaction is declined. This step catches most stolen card numbers, because a thief who obtained your number from a data breach does not have the physical card and cannot read the CVV.

The CVV also helps protect you if your card number is used fraudulently. If someone makes a purchase with your number but enters the wrong CVV, the transaction fails and you are not charged. Your card issuer can then flag the card as compromised and send you a replacement.

In-person purchases at physical stores do not require you to enter or state your CVV. The card reader reads the chip or magnetic stripe, which contains different security information. The CVV is only for remote transactions where the merchant cannot physically inspect the card.

How to protect your CVV from fraud

Never share your CVV with anyone except during a legitimate purchase from a merchant you trust. Do not write it down, photograph it, or store it in your phone or email. If you need to make a purchase and cannot remember the number, look at the physical card — never ask someone else to read it to you.

Be suspicious of any request for your CVV by email, text message, or unsolicited phone call. Your bank and credit card company will never ask for your CVV this way. If you receive such a request, do not respond and report it to your card issuer immediately.

When shopping online, only enter your CVV on the merchant's secure checkout page — the URL should begin with "https://" and show a padlock icon. Do not enter it on a page that looks unusual, loads slowly, or asks for information in an odd order. If something feels wrong, close the browser and contact the merchant directly using a phone number from their official website.

What happens if your CVV is compromised

If someone obtains your CVV along with your card number and expiration date, they can make online and phone purchases in your name. However, this is less common than theft of the card number alone, because the CVV is printed on the card and not stored in databases — it is harder to steal in bulk.

If you notice fraudulent charges on your statement, contact your card issuer right away. Most card companies offer fraud protection that limits your liability to $50 or $0, depending on your agreement and how quickly you report the fraud. Your issuer will investigate the charges and issue you a new card with a new CVV.

You do not need to change your CVV yourself. Only your card issuer can issue a new card with a new code. If you are concerned about fraud but have not seen unauthorized charges, you can request a replacement card as a precaution.

CVV versus other card security features

Your card has several layers of security, and the CVV is one of them. The chip embedded in modern cards creates a unique code for each transaction, making it much harder to counterfeit than the old magnetic stripe. The chip is why in-person fraud has declined — a thief cannot simply swipe a stolen card number at a store.

Your expiration date is printed on the card but is not a security code. It tells the merchant when the card stops working, but it does not prove you hold the card. The CVV is the only printed security feature designed specifically for remote purchases.

Some card issuers now offer virtual card numbers — temporary numbers tied to your real account that work for a single purchase or a limited time. These are stronger than the CVV alone because they expire after use. If you shop frequently online, ask your card issuer whether they offer this feature.

Frequently Asked Questions

Can someone use my card number without the CVV?

Not for online or phone purchases — the merchant will reject the transaction if the CVV does not match. However, a thief with your card number could attempt in-person fraud by creating a counterfeit card. This is why monitoring your statement and reporting fraud quickly matters.

Is it safe to store my CVV in my browser or password manager?

No. Never save your CVV anywhere, even in encrypted password managers. If your device is compromised, the thief gains access to the code. Enter it manually each time you make a purchase, or use a virtual card number if your issuer offers one.

What should I do if a website asks me to save my CVV for future purchases?

Decline. Legitimate merchants do not store CVV numbers — payment processors handle that securely. If a website insists on saving it, do not shop there. Report the site to your card issuer, as it may be fraudulent.

Do I need to give my CVV when I call a company to make a purchase?

Yes, if the company is legitimate and you initiated the call. However, verify you are calling the official number from the company's website, not a number from an email or text. Never give your CVV to someone who called you unsolicited.