The CVV is a three- or four-digit security code printed on your card that proves you physically have it

The CVV (Card Verification Value) is a number on the back of your credit card — usually three digits, or four if you have an American Express. It sits separately from your card number and expiration date. When you enter it during an online or phone purchase, you are telling the merchant that you have the physical card in your hand, not just the number.

The CVV is not stored in the magnetic stripe or chip on your card. That matters: a thief who steals your card number from a data breach cannot use it online without also knowing this code. It is one layer of protection against fraudulent charges.

Key Takeaways

  • The CVV is a three- or four-digit code printed on the back of your card (or front, for American Express) that you must enter for online and phone purchases.
  • Merchants are not supposed to store your CVV after a transaction, so each purchase requires you to enter it again.
  • Never give your CVV to someone who calls you or emails you claiming to be your bank — your bank already has your card on file.
  • If your card is lost or stolen, contact your card issuer immediately; the CVV alone cannot be used without the card number and expiration date.

Where the CVV appears on your card

For Visa, Mastercard, and Discover cards, the CVV is on the back, usually in the signature strip area on the right side. It is the last three digits of a longer number printed there.

American Express prints the CVV on the front of the card, above the card number on the right side. It is four digits instead of three.

If you cannot find it, check your card issuer's website or call the number on the back of your card. Do not search for it online or ask someone else to locate it for you.

Why merchants ask for it during checkout

When you buy something online or over the phone, the merchant cannot swipe or insert your card. They have only the information you type or say. The CVV proves you have the card itself — not just a number someone found or stole from a website.

This is why you enter it every time you make an online purchase, even from a store where you have shopped before. Merchants are legally forbidden from storing your CVV after the transaction ends. Each purchase requires a fresh entry.

What happens if someone has your CVV

A CVV alone is not enough to make a purchase. A thief would need your full card number, expiration date, and CVV all together. If only your CVV is exposed — which is rare — the risk is low.

If your card number and CVV are both compromised, contact your card issuer right away. They can cancel the card and issue a replacement. Most card issuers cover fraudulent charges under federal law, so you are not responsible for unauthorized purchases if you report them quickly.

How to protect your CVV

Never enter your CVV on a website that does not have a secure connection. Look for "https://" at the start of the web address and a padlock icon in your browser. If either is missing, do not enter your card information.

Do not give your CVV to anyone who calls or emails you, even if they claim to be from your bank. Your bank already has your card on file and will never ask for the CVV by phone or email. This is a common fraud tactic.

When you shop in person, do not let the cashier write down your CVV or take a photo of it. They should not need it for a card you are physically handing them.

CVV versus other card security features

Your card has several layers of protection. The chip (if your card has one) creates a unique code for each transaction that cannot be reused. The magnetic stripe on the back holds encrypted data. The CVV is a separate check that works for online and phone purchases where the chip and stripe cannot be read.

Together, these features make it harder — though not impossible — for someone to use a stolen card number. None of them protects you completely, which is why monitoring your statements and reporting fraud quickly matter.

What to do if your card is lost or stolen

Call your card issuer immediately using the number on your statement or their website. Do not use a number from a text message or email, even if it looks official. Tell them your card is missing and ask them to cancel it.

Your issuer will send a replacement card with a new number and a new CVV. You are not responsible for charges made after you report the card missing, as long as you act quickly.

Frequently Asked Questions

Can someone use my card number without the CVV?

In person, yes — a cashier can swipe or insert your card without asking for the CVV. Online or by phone, most merchants will decline the transaction without it. Some older or less secure websites may not require it, which is why using trusted retailers matters.

Is it safe to save my CVV for faster checkout?

No. Merchants are not supposed to store your CVV, and legitimate websites will not offer to do so. If a site asks to save it, that is a red flag. You will need to enter it fresh each time you shop.

What if I forgot my CVV?

Look at the back of your physical card. If you do not have the card with you, contact your card issuer and they can tell you what it is over the phone after they verify your identity. Never search for it online or ask someone else to find it.

Does the CVV change if I get a new card?

Yes. Each card has its own CVV. When your issuer sends you a replacement card — whether because yours expired, was damaged, or was reported stolen — the new card will have a different CVV.

Can I use my card online if I do not know the CVV?

Most online retailers will not complete the transaction without it. If you have the physical card, you can look it up. If you do not have the card, contact your issuer and they can provide it after verifying who you are.