The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a short number on the back or front of your credit card that merchants use to confirm you own the card. It is not stored in the card's magnetic stripe or chip, so someone who steals your card number alone cannot use it online or over the phone without also knowing this code. The CVV sits separate from your account number and expiration date — that separation is the whole point.
Visa and Mastercard call it CVV2. American Express calls it CID and prints it on the front. Discover calls it CID as well. The name changes, but the function is the same: it is a fraud check that takes seconds.
You will see merchants ask for it during online checkout, over the phone, or when you use a payment terminal that does not read your chip. It is not the same as your PIN, which you enter at an ATM or in-person to prove you authorized the transaction.
Key Takeaways
- The CVV is a three- or four-digit code on your card that merchants request to verify you physically possess the card during remote transactions.
- Visa and Mastercard print the CVV on the back; American Express and Discover print it on the front.
- The CVV is not stored in your card's chip or magnetic stripe, so a stolen card number alone cannot be used without it.
- You should never share your CVV with anyone except the merchant you are paying, and legitimate companies will never ask for it by email or phone.
Where the CVV appears on different card types
On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature panel. It is the last three digits of a longer number on the back.
On American Express, the CVV is a four-digit code printed on the front of the card, above the account number on the right side. Discover also prints a three-digit code on the back, similar to Visa and Mastercard.
The location matters because scammers sometimes ask for the CVV in ways that do not match where it actually appears. If someone claims to be from your bank and asks you to read a number from the front of your card, that is a red flag — legitimate banks already know where the CVV is and would not need you to describe it.
Why merchants ask for the CVV during online and phone purchases
When you swipe or insert your card in person, the merchant's terminal reads your chip or magnetic stripe and confirms the card is real and active. When you shop online or order by phone, the merchant cannot read your card directly, so they ask for the CVV instead. It proves you have the physical card in your hand.
A thief who has only your card number and expiration date — information that might appear on a receipt or be stolen from a data breach — cannot complete an online purchase without the CVV. That three- or four-digit code is the barrier between a stolen number and an actual fraudulent charge.
Merchants are not supposed to store your CVV after the transaction is complete. Payment processors and card networks have rules against keeping it on file, which means even if a merchant's database is hacked, the CVV should not be there to steal.
What to do if someone asks for your CVV by email or phone
Never give your CVV to anyone who contacts you first — not by email, text, phone, or social media. Your bank, the card issuer, and legitimate merchants will never ask for it this way. If you receive a message claiming to be from your bank and asking for your CVV, it is a scam.
Legitimate transactions work in the opposite direction: you initiate the purchase and enter the CVV yourself into a secure form or terminal. You control when and where you share it. If someone is asking you to provide it, you should assume they are not who they claim to be.
If you receive a suspicious request, hang up or do not reply, then call your bank directly using the number on the back of your card. Do not use a phone number from the email or message — that number belongs to the scammer.
How the CVV differs from your PIN and other card security features
Your PIN (Personal Identification Number) is a four-digit code you create and memorize. You enter it at an ATM or when you pay in person at a store that asks for it instead of a signature. Only you should know your PIN. The CVV is printed on the card itself and is not something you memorize.
Your card also has a chip (EMV chip) that stores encrypted information and is harder to counterfeit than the old magnetic stripe. When you insert your card into a chip reader, the terminal communicates with the chip to verify the card is real. The CVV is a separate security layer for situations where the chip cannot be read — online shopping, phone orders, and older terminals.
Your expiration date is public information that appears on the front of your card. Merchants need it to process online payments, but it alone does not prove you own the card. The CVV is the proof.
What happens if your CVV is compromised
If your CVV becomes known to a scammer — through a data breach, a phishing email, or because you shared it with someone posing as a merchant — contact your card issuer right away. Tell them you believe your card security has been compromised and ask them to cancel the card and issue a replacement.
Your card issuer can monitor your account for fraudulent charges and will typically reverse any unauthorized transactions. You are not responsible for fraud that occurs after you report it, though the process of getting your money back can take a few weeks.
In the meantime, you can still use your card for in-person purchases at chip readers, since the CVV is not needed there. Online and phone purchases will not work until you receive your replacement card.
Frequently Asked Questions
Is it safe to enter my CVV on a website?
Yes, if the website is legitimate and uses encryption. Look for "https://" at the start of the web address and a padlock icon in your browser. Never enter your CVV on a website that does not have these signs. If you are unsure whether a site is real, close the browser and call the merchant directly using a phone number from their official website or your receipt.
Can someone use my card if they only have the card number and expiration date?
They can attempt online or phone purchases, but most merchants now require the CVV, which stops the transaction if the thief does not have it. In-person purchases at chip readers do not require the CVV. If you see unauthorized charges, report them to your card issuer immediately.
Should I write my CVV on the back of my card?
No. Never write your CVV anywhere or store it in your phone, email, or notes. The whole purpose of the CVV is that it is only on the physical card. If you write it down, you defeat that protection.
What if a merchant asks me to read my CVV over the phone?
Hang up. Legitimate merchants have secure phone systems where you enter your CVV using your phone keypad, not by speaking it aloud. If a person is asking you to say the number out loud, it is a scam.