The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on the back or front of your credit card that merchants use to confirm you have the physical card in your hand. It is not encoded in the magnetic stripe or chip — it is printed only on the card itself. When you enter it during an online or phone purchase, the merchant sends it to your card issuer to verify it matches their records.
The CVV exists because online and phone transactions cannot read your card's chip or stripe the way an in-person terminal can. Without it, a thief who knows only your card number and expiration date could make purchases. The CVV adds a second layer of proof that you actually possess the card.
Different card networks use different names: Visa and Discover call it CVV2, Mastercard calls it CVC2, and American Express calls it CID. The function is the same across all of them.
Key Takeaways
- The CVV is a three- or four-digit number printed on your card that you must provide for online and phone purchases.
- Visa, Mastercard, and Discover print the CVV on the back of the card below the signature strip; American Express prints it on the front above the card number.
- Never share your CVV with anyone except the merchant you are actively paying, and never enter it on a website unless you initiated the transaction.
- The CVV is not stored in your card's chip or magnetic stripe, so a merchant cannot retrieve it from a card reader — you must type or speak it.
- If someone has your CVV along with your card number and expiration date, they can make online purchases without your permission.
Where the CVV appears on different card types
On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, to the right of the signature strip. You will see it after the last four digits of your card number are repeated.
On American Express cards, the CVV is a four-digit number printed on the front of the card, above and to the right of the main card number. American Express calls this the CID instead of CVV, but it serves the same purpose.
If you cannot find the CVV on your physical card, contact your card issuer directly. Do not search for it online or call a number from an email or text message — scammers sometimes pose as card companies to collect this information.
Why merchants ask for the CVV
Merchants request the CVV during online checkout or over the phone because it proves you have the card in front of you at that moment. A thief who steals your card number from a data breach or a skimming device will not have the CVV unless they also have the physical card.
When you enter the CVV, the merchant sends it to your card issuer's system, which checks whether it matches the CVV on file. If it does not match, the transaction is declined. This verification happens in seconds and is invisible to you.
The CVV is also called a "card security code" or "security code" on some websites. The label varies, but the function is always the same: confirming you hold the card.
What the CVV does not protect
The CVV does not protect you in person. At a store, restaurant, or gas pump, you do not enter the CVV — the merchant reads your card's chip or stripe instead. This is why in-person fraud is less common than online fraud: the thief would need the physical card.
The CVV also does not protect you if someone gains access to your card issuer's database. If a bank or payment processor is breached, the CVV may be stolen along with your other card details. This is rare but has happened. Your card issuer's fraud monitoring is your main defense in that scenario.
The CVV does not appear on receipts or statements. Merchants are required by law to delete it from their systems after the transaction is approved, so even if their database is breached, the CVV should not be there.
How to protect your CVV
Never share your CVV with anyone except during a purchase you initiated yourself. Do not enter it on a website unless you typed the web address yourself or clicked a link from a source you trust. Scammers create fake checkout pages that look identical to real ones and harvest CVVs from people who enter them.
If a merchant calls you asking for your CVV, hang up and call the merchant's official phone number from their website or your statement. Legitimate businesses do not call customers asking for security codes. If a text message or email asks you to "verify" your CVV, it is a scam.
If you believe your CVV has been compromised, contact your card issuer immediately. They can cancel your card and issue a new one. You are not responsible for fraudulent charges made with your card, but reporting suspected fraud quickly protects you and helps the issuer investigate.
CVV and data breaches
When a retailer's payment system is breached, the CVV is sometimes stolen along with card numbers. However, card networks require merchants to delete the CVV from their systems within a short time after the transaction is approved. This means a well-secured merchant should not have your CVV stored anywhere.
If a breach occurs and your CVV is exposed, your card issuer will likely cancel your card and send you a new one as a precaution. You will receive a new card with a new CVV, even if the old card was not used fraudulently. This is standard practice.
You cannot change your CVV without getting a new card. The CVV is generated by your card issuer and printed during manufacturing. If you want a new CVV, you must request a replacement card.
CVV versus other card security features
Your card has multiple security layers. The chip (EMV) creates a unique code for each in-person transaction, making it nearly impossible to clone. The magnetic stripe is older and less secure but still used at some merchants. The CVV protects online and phone purchases. Your PIN (if you have one) protects ATM withdrawals and some debit card purchases.
Together, these features make it harder for a thief to use your card without permission. No single feature is foolproof, which is why card issuers also monitor your account for unusual activity and allow you to dispute fraudulent charges.
Frequently Asked Questions
Can someone use my card if they have my number and expiration date but not my CVV?
They can try, but most online merchants will decline the transaction if the CVV does not match. Some older or less secure websites may not check the CVV, so it is still possible but less likely. Phone merchants always ask for the CVV. If your card number is compromised, contact your issuer to cancel it.
Is it safe to save my CVV on a website for faster checkout?
No. Websites should never store your CVV, and legitimate merchants will not offer to save it. If a site asks to store your CVV, do not use that site. You can save your card number for convenience, but you should enter the CVV fresh each time you make a purchase.
What should I do if I accidentally shared my CVV with someone?
Contact your card issuer immediately and report the incident. They will monitor your account for fraudulent activity and may cancel your card and issue a new one. Act quickly — the sooner you report it, the sooner they can protect you.
Do I need to enter my CVV at ATMs or gas pumps?
No. ATMs and gas pumps read your card's chip or stripe and may ask for your PIN, but they do not ask for your CVV. If a machine asks for your CVV, it is a scam device. Do not use it and report it to the bank or business that owns it.
Can I look up my CVV online if I do not have my card?
No. Your card issuer will not display your CVV online, by phone, or in any other way. If you need your CVV, you must have your physical card in front of you. If you have lost your card, request a replacement from your issuer.