The CVV is a three- or four-digit security code printed on your card, separate from your account number
The CVV (Card Verification Value) is a short number on the back or front of your credit card that exists only to prove you physically hold the card. It is not part of your account number. When you make an online purchase or give your card details over the phone, the merchant asks for this code to confirm the card is real and in your possession.
The CVV is printed on the card itself — it is not stored in the magnetic stripe or chip. This means a thief who steals your card number from a data breach cannot use that number alone to make online purchases, because they do not have the physical card to read the code from. That separation is the entire point.
Different card networks use different names: Visa and Discover call it CVV2, Mastercard calls it CVC2, and American Express calls it CID. The function is identical across all of them.
Key Takeaways
- The CVV is a three- or four-digit code printed on your physical card that proves you hold it in your hands.
- Online merchants and phone transactions require the CVV because a stolen card number alone cannot be used without it.
- The CVV is not stored in your card's chip or magnetic stripe, so data breaches of merchant databases do not expose it.
- Never share your CVV in an email, text, or unsolicited phone call — legitimate companies will never ask for it that way.
Where the CVV appears on your card
For Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, to the right of the signature panel. You will see it after the last four digits of your account number.
American Express places its four-digit code on the front of the card, above the account number on the right side. This code is called the CID instead of CVV, but it serves the same purpose.
The code is printed in raised or flat ink — it is not embossed like your account number. This matters because the code cannot be read by the same machines that read your account number, which is another layer of security.
Why merchants ask for it during online and phone purchases
When you buy something online or over the phone, the merchant cannot see your physical card. They have your account number, expiration date, and name — the same information printed on the front. Without the CVV, a thief with a stolen card number could make purchases without ever holding the card.
The CVV requirement forces the buyer to prove they have the card in hand. It is a simple check, but it stops most automated fraud and card-not-present theft. Merchants are required by card networks to request it for online and phone transactions, though in-person purchases at a store do not require it because the card is physically present.
The merchant's payment processor checks the CVV against the card issuer's records in real time. If the code does not match, the transaction is declined immediately. The merchant never stores the CVV after the transaction completes — payment card industry rules forbid it.
What happens if your CVV is compromised
If someone obtains both your account number and your CVV, they can make online purchases in your name. However, this is less common than account-number-only theft because the CVV is harder to steal — it is not stored in databases the way account numbers are.
If you believe your CVV has been exposed, contact your card issuer immediately. They can issue you a new card with a new CVV. The old card will be deactivated, and any fraudulent charges can be disputed. Most card issuers cover unauthorized charges, so you are not liable for fraud that you report promptly.
You do not need to change your CVV on its own — the code is tied to the physical card. A new card automatically comes with a new CVV printed on it.
How to protect your CVV
Never enter your CVV on a website that does not use a secure connection. Look for "https://" at the start of the web address and a padlock icon in your browser. Unsecured sites transmit your information in plain text, where it can be intercepted.
Do not share your CVV in emails, text messages, or over the phone unless you initiated the contact and you are certain you are speaking to your card issuer or a merchant you trust. Legitimate companies will never ask for your CVV unsolicited. If someone calls claiming to be from your bank and asks for your CVV, hang up and call your bank directly using the number on your card.
When you make a purchase in person, shield the keypad or screen from view when you enter your PIN. Do not leave receipts with your full account number or CVV visible in the trash. If you use a digital wallet like Apple Pay or Google Pay, your CVV is not transmitted to the merchant at all — the wallet handles the security.
CVV versus other card security features
Your card has multiple layers of security. The chip (the small metallic square on the front) creates a unique code for each transaction, making it nearly impossible to clone. The magnetic stripe on the back stores encrypted data. The expiration date limits how long a stolen card number can be used. The CVV proves physical possession.
None of these work alone. A thief with your account number and expiration date still cannot make online purchases without the CVV. A thief with your CVV cannot make purchases without the account number. Together, they create a system where multiple pieces of information must be stolen for fraud to occur.
Newer security methods like 3D Secure (Verified by Visa, Mastercard SecureCode) add another step: after you enter your card details, the merchant redirects you to your bank to confirm the purchase with a password or biometric. This is becoming standard for high-value online transactions.
Frequently Asked Questions
Is it safe to give my CVV to an online retailer?
Yes, if the website is secure (look for https:// and a padlock icon) and the retailer is legitimate. The CVV is designed to be shared during online purchases. However, never enter it on an unsecured site or give it to someone who contacts you unsolicited. Legitimate merchants will never ask for your CVV via email or phone.
What if I lose my card — do I need to worry about my CVV?
Call your card issuer immediately to report the card lost or stolen. They will deactivate it and send you a new one with a new CVV. Anyone who finds your card cannot use it online without the CVV, and in-person use will be blocked once you report it missing. The new card arrives within 7 to 10 business days in most cases.
Can someone use my card number if they don't have the CVV?
They cannot make online or phone purchases without it. In-person purchases at a store do not require the CVV because the card is physically present. However, if someone has your full card number and expiration date, they can attempt in-person fraud or try to use it at merchants who do not verify the CVV properly.
Does the CVV change if I keep the same card?
No. The CVV stays the same for the life of the card. It only changes when you receive a new card — either because yours expired, was damaged, or was reported lost or stolen. The issuer prints a new CVV on each new card.
Why do some websites not ask for a CVV?
Some merchants, especially subscription services or repeat customers, may skip the CVV check if they have already verified your card once. This is a merchant choice, not a security requirement. Larger retailers and payment processors typically require it every time for fraud prevention.