The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a number on the back of most credit cards, usually three digits, positioned near your signature. American Express prints a four-digit CVV on the front. This code exists so that when you enter your card details online or over the phone, the merchant can confirm you actually hold the physical card — not just that someone has your card number.
When you make a purchase online, you typically enter your card number, expiration date, and CVV. The merchant sends that CVV to the card network (Visa, Mastercard, Discover, or Amex) to verify. If the CVV matches what the card issuer has on file, the transaction moves forward. If it doesn't match or is missing, the purchase is declined.
The CVV is not stored in the magnetic stripe or chip on your card. It's printed on the surface only, which means a merchant who processes your card in person cannot capture it the way they capture your card number. This design makes it harder for stolen card data to be used for online purchases.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card that merchants request during online or phone purchases to confirm you have the physical card.
- Never share your CVV with anyone by email, text, or phone call — legitimate companies will never ask for it outside a secure payment screen.
- The CVV is not the same as your PIN; your PIN is for ATM withdrawals and debit card transactions at checkout, while CVV is for online and phone purchases.
- If your CVV is compromised, contact your card issuer immediately to report potential fraud and request a replacement card.
- Merchants are not supposed to store your CVV after a transaction, which is why you must enter it each time you make a purchase.
Where the CVV appears on different card types
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number on the back of the card, to the right of the signature panel. On American Express cards, the CVV is a four-digit number printed on the front, above the card number on the right side.
Some older cards or specialty cards may not have a CVV printed at all. If your card lacks one, you can still make purchases in person or by phone, but online merchants may decline the transaction or ask you to contact your card issuer to complete the sale.
Why merchants ask for the CVV
Merchants request the CVV to reduce fraud. If a thief steals your card number from a data breach or skimming device, they typically do not have the CVV because it is not stored in the card's chip or magnetic stripe. Without the CVV, they cannot complete most online purchases.
When you enter your CVV during checkout, the merchant's payment processor verifies it against the card issuer's records. This verification happens in real time and takes only seconds. If the CVV does not match, the transaction is rejected immediately.
The CVV also protects you. If someone makes an unauthorized purchase using your card number, the transaction may be flagged because the CVV they entered did not match. This creates a record that helps your card issuer investigate fraud claims.
What you should never do with your CVV
Never share your CVV by email, text message, phone call, or any unsecured method. Legitimate companies — including your bank, PayPal, Amazon, and your credit card issuer — will never ask you to provide your CVV outside a secure payment page or phone line.
If someone calls you claiming to be from your bank and asks for your CVV, hang up and call your bank directly using the number on the back of your card. If you receive an email asking for your CVV, do not click any links in that email; instead, log into your account directly through the company's website or app.
Do not write your CVV on checks, receipts, or anywhere else. Do not photograph it or store it in your phone's notes app. The only time you should enter your CVV is during a secure online checkout or when making a purchase over the phone with a merchant you trust.
What happens if your CVV is compromised
If you believe your CVV has been exposed — for example, through a data breach at a retailer or a phishing email you fell for — contact your card issuer immediately. You can usually find the number on the back of your card or in your online account.
Your card issuer can issue you a replacement card with a new CVV. The old card can be deactivated so that even if someone has your card number and the old CVV, they cannot use it. Replacement cards typically arrive within 5 to 10 business days, though some issuers offer expedited delivery.
While you wait for the replacement, ask your card issuer whether they can temporarily increase fraud monitoring on your account or place a fraud alert. You can also check your account regularly for unauthorized charges and report any you find.
CVV versus other card security features
The CVV is one layer of fraud protection, but not the only one. Your card also has an expiration date, which merchants verify. Chip technology (EMV) makes it harder to counterfeit a card for in-person purchases. Your card issuer also monitors your account for unusual spending patterns and can flag suspicious transactions.
If you use a debit card, your PIN is different from your CVV. Your PIN is what you enter at an ATM or when you choose "debit" at a checkout and enter a code. Your CVV is only for online and phone purchases. Never share your PIN with anyone, just as you would never share your CVV.
Some online retailers offer additional security through two-factor authentication, which sends a code to your phone or email that you must enter to complete a purchase. This adds another barrier even if someone has your card number and CVV.
Frequently Asked Questions
Can someone use my card number without the CVV?
In person, yes — a merchant can process your card using just the number if they have the physical card or the chip. Online, it is much harder. Most online retailers require the CVV, so without it, a thief cannot complete the purchase. Some merchants may allow a transaction without a CVV if the cardholder calls, but this is less common and creates a record.
Is it safe to enter my CVV on websites?
It is safe if the website is legitimate and uses encryption. Look for "https://" in the address bar and a padlock icon, which indicate the connection is secure. Never enter your CVV on a website you do not recognize or that looks suspicious. If you are unsure whether a site is real, contact the company directly using a phone number or website address you find independently.
What if I forgot my CVV?
Look at the back of your physical card — the CVV is printed there. If you do not have your card with you, log into your online banking account; some card issuers display the CVV in your account dashboard. If you still cannot find it, call your card issuer. They can read it to you over the phone on a secure line, but they will not email it to you.
Do I need to memorize my CVV?
No. You should not memorize it or write it down. The CVV is meant to be used only when you have your physical card in hand. If you are making an online purchase, have your card nearby and enter the CVV directly from the card each time.
Can a store keep my CVV after I make a purchase?
No. Payment card industry rules forbid merchants from storing your CVV after a transaction is complete. If a merchant asks you to provide your CVV and then saves it for future purchases, they are violating the rules and putting your account at risk. Report this to your card issuer immediately.