The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back or front of your credit card that merchants use to confirm you have the physical card in your hand. It is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also knowing this code. The CVV exists to reduce fraud on purchases you make without swiping or inserting the card in person — phone orders, online checkouts, and mail orders.
Visa and Mastercard call it CVV2. American Express calls it CID and prints it on the front. Discover calls it CID as well. The number itself changes nothing about how your card works; it is purely a verification tool that sits between you and the merchant.
Key Takeaways
- The CVV is a three- or four-digit code on your card that merchants request during online and phone purchases to confirm you have the card.
- Visa and Mastercard print the CVV on the back of the card; American Express and Discover print it on the front.
- Never share your CVV with anyone except the merchant you are paying, and never enter it on a website unless you initiated the transaction.
- If someone has your card number and CVV, they can make purchases without your permission, so treat the CVV as carefully as you treat the card number itself.
Where the CVV appears on different card types
Visa and Mastercard print the CVV on the back of the card, usually to the right of the signature strip. It is the last three digits of a longer number. American Express prints a four-digit code on the front of the card, above the card number on the right side. Discover also prints a three-digit code on the back, in the same location as Visa and Mastercard.
The CVV is not embossed or raised like the card number — it is printed flat. This matters because older card readers that only read raised numbers cannot capture the CVV, which is part of why it works as a security measure.
Why merchants ask for the CVV
When you buy something online or over the phone, you cannot insert or swipe your card, so the merchant has no way to verify you have it. Asking for the CVV is their way of checking that you are not just using a card number someone found or stole. If a thief has only your card number and expiration date — information that might appear on a receipt or be captured in a data breach — they still cannot complete most online purchases without the CVV.
The CVV also protects merchants. If a customer later claims they did not make a purchase, the merchant can show that the CVV was entered correctly, which is strong evidence the cardholder made the transaction. This shifts some fraud risk away from the merchant and back toward the card issuer.
What the CVV does not protect
The CVV does not protect you if someone has your full card number, expiration date, and CVV — they can make purchases online just as you can. It also does not protect you in person; a thief who steals your physical card can use it at any store without needing the CVV. In-person transactions use the chip or magnetic stripe, not the CVV.
The CVV also does not change if your card is compromised. Unlike a password you can reset, the CVV stays the same for the life of the card. If your card number is stolen, the card issuer will send you a new card with a new number and a new CVV, but the old CVV remains valid on the old number until the card is officially closed.
How to keep your CVV safe
Treat your CVV the same way you treat your card number — never share it unless you are making a purchase from a merchant you trust. Do not enter it on a website unless you started the transaction yourself. Do not give it to someone over the phone unless you called them first and you are certain they are who they claim to be.
Be especially cautious of emails or text messages asking for your CVV. Legitimate companies will never ask for it this way. If you receive a message claiming to be from your bank or a store asking for your CVV, do not reply — contact the company directly using a phone number or website you know is real.
If your card is lost or stolen, call your card issuer immediately. They will cancel the card and send you a new one with a new CVV. If you notice charges you did not make, report them right away; your card issuer has fraud protection rules that limit your liability.
CVV and data breaches
When a retailer's database is hacked, thieves sometimes steal card numbers, expiration dates, and other information. However, legitimate merchants are not supposed to store the CVV after a transaction is complete — they should delete it. This means that even if a breach exposes your card number, your CVV may not be exposed.
Some merchants break this rule or store the CVV anyway, which is why a data breach can be more serious than it should be. If you learn that a store where you shopped was breached, contact your card issuer and ask them to monitor your account. Many will offer free credit monitoring for a period of time after a major breach.
Frequently Asked Questions
Can someone use my card online if they only have the card number?
Most online merchants will ask for the CVV before processing the payment, so a thief with only your card number and expiration date will be blocked at checkout. However, some merchants do not require the CVV, so it is possible but less common. This is why the CVV matters — it closes a gap that would otherwise exist.
Is it safe to give my CVV to a website?
It is safe to enter your CVV on a website you trust during checkout, as long as you initiated the purchase yourself. Look for a padlock icon in the address bar and make sure the web address starts with "https" rather than "http". Never enter your CVV on a website that contacted you first via email or text.
What should I do if I think someone has my CVV?
Contact your card issuer right away and tell them your card may be compromised. They will cancel the card and send you a new one with a new CVV. Watch your account for unauthorized charges and report any you find. Your card issuer's fraud protection rules limit how much you have to pay for unauthorized purchases.
Why does American Express put the CVV on the front instead of the back?
American Express designed their cards differently and chose to print the four-digit code on the front. The location does not make it more or less secure — it is still a number only you should know and only you should share with merchants.
Can I use my card without the CVV if I forget it?
In person, yes — you can swipe or insert the card without the CVV. Online or by phone, most merchants will not process the payment without it. If you forget your CVV, you can call your card issuer and they will tell you what it is, or you can look at your physical card.