The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a number on the back of most credit cards — three digits for Visa, Mastercard, and Discover, four digits for American Express. It sits separately from your card number and expiration date. When you enter it during an online or phone purchase, you are telling the merchant that you have the physical card in your hand, not just the number.
The CVV is not stored in the card's magnetic stripe or chip. It exists only on the card itself and in the card issuer's records. That separation is the whole point: a thief who steals your card number from a data breach cannot use it online without also having the card to read the CVV off.
Different card networks call it different things — Visa and Discover call it CVV2, Mastercard calls it CVC2, American Express calls it CID — but they all work the same way.
Key Takeaways
- The CVV is a three- or four-digit number printed on your card that merchants ask for during online and phone purchases to confirm you have the physical card.
- The CVV is not encoded in your card's chip or magnetic stripe, so someone who steals your card number alone cannot use it online without the CVV.
- You should never give your CVV to anyone who calls you or emails you claiming to be from your bank or card issuer — legitimate companies will not ask for it that way.
- Merchants are not supposed to store your CVV after a transaction, so if a company asks you to save it for future purchases, that is a sign of poor security practices.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is printed on the back of the card, usually to the right of the signature strip. It is the last three digits of a longer number in that area.
On American Express cards, the CVV appears on the front, above the card number on the right side. It is four digits instead of three.
The CVV is printed in a way that makes it harder to photocopy or scan clearly than the rest of the card. It does not appear on receipts or statements, and it should not be stored by merchants after a transaction is complete.
Why merchants ask for it during online purchases
When you shop online, the merchant cannot see your physical card. Asking for the CVV is a way to verify that you have the card in front of you. If someone has only stolen your card number from a website or data breach, they will not have the CVV unless they also have the physical card.
The CVV is one layer of protection, but not the only one. Many online merchants also use address verification (checking that the billing address matches what the card issuer has on file) and other fraud detection tools. Together, these reduce the risk that a stolen card number will be used successfully.
Some merchants, especially subscription services, ask you to save your CVV along with your card number for future charges. This is not standard practice and suggests weak security. Legitimate companies typically do not store the CVV after the first transaction.
What to do if someone asks for your CVV by phone or email
Do not give your CVV to anyone who calls you or emails you, even if they claim to be from your bank or card company. Legitimate financial institutions will never ask for your CVV this way. If you receive such a request, hang up or delete the email and call your card issuer directly using the number on the back of your card.
Scammers often pose as bank employees or fraud investigators to trick you into revealing your CVV. They may claim there is suspicious activity on your account or that they need to verify your identity. This is a common fraud tactic.
If you have already given your CVV to someone over the phone or email, contact your card issuer right away. They can cancel your card and issue a replacement. The faster you report it, the less time a fraudster has to use the number.
How the CVV differs from your card number
Your card number is the 16-digit (or sometimes 15-digit) number on the front of your card. It identifies your account and is used for all transactions, online and in person. Your card number appears on receipts and statements.
The CVV is separate and shorter. It is not part of your account number and does not identify you to the card issuer's system the way your card number does. It is purely a verification tool for merchants.
If your card number is stolen, a thief can attempt to use it online, but they will be blocked at checkout if they do not have the CVV. If your CVV is stolen alone, it is useless without the card number. That is why keeping both pieces of information separate is important.
What happens if your card is lost or stolen
If you lose your card or believe it has been stolen, contact your card issuer immediately. They will cancel the card and send you a replacement with a new CVV. Any fraudulent charges made after you report the card missing are typically not your responsibility — federal law limits your liability for unauthorized use.
You do not need to worry about the old CVV being used after your card is cancelled. The card issuer's system will reject any transaction attempt using the old card number and CVV combination.
While you wait for your replacement card, you can still shop online using digital wallet services like Apple Pay or Google Pay if your card is linked to them. These services do not expose your CVV to merchants.
CVV and data breaches
When large retailers or websites experience data breaches, card numbers are often stolen. However, the CVV should not be included in those breaches if the company followed proper security standards. Payment Card Industry (PCI) rules prohibit merchants from storing CVVs after a transaction, so a breach of a merchant's database should not expose your CVV.
If a breach does expose your CVV along with your card number, that is a sign the company was not following security rules. In that case, contact your card issuer and ask for a replacement card with a new CVV.
You can check whether your card information has been exposed in a known breach by visiting haveibeenpwned.com, though this site tracks email addresses and usernames more reliably than card numbers.
Frequently Asked Questions
Can someone use my card number without the CVV?
Online and over the phone, no — most merchants require the CVV for those transactions. In person, a thief with only your card number cannot complete a purchase because they do not have the physical card. However, some older or poorly secured merchants may not ask for the CVV, so it is still important to monitor your account for unauthorized charges.
Is it safe to write my CVV on the back of my card?
No. If your card is lost or stolen, writing the CVV on it defeats the purpose of having it printed separately. Keep the CVV in your head or in a secure location separate from your card, never on the card itself.
Do I need to memorize my CVV?
You do not need to memorize it, but you should know where to find it when you shop online. Keep your card in a safe place and only look up the CVV when you are making a purchase on a website you trust.
What if a website says my CVV is invalid?
Double-check that you have entered it correctly — it is easy to misread the numbers. Make sure you are looking at the right part of the card (back for Visa and Mastercard, front for American Express). If you keep getting an error, contact the merchant's customer service or try a different payment method.
Can I use the same CVV for multiple purchases?
Yes, the CVV stays the same for every transaction until your card is replaced. However, merchants should not store it, so you will need to enter it each time you shop online. If a website asks you to save your CVV for future purchases, that is a red flag for poor security practices.