The CVV is a three- or four-digit code printed on your card that proves you physically hold it

The CVV (Card Verification Value) is a security code printed on the back of most credit cards — three digits for Visa, Mastercard, and Discover, and four digits for American Express (which prints it on the front). When you make an online or phone purchase, the merchant asks for this code to confirm you have the physical card in your hand, not just the card number.

The code is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also knowing this code. That separation is the whole point: it adds a second barrier between your card number and fraudulent charges.

The CVV is different from your PIN, which you enter at an ATM or in-store terminal. The PIN protects the card itself; the CVV protects online and phone transactions where the merchant cannot see the physical card.

Key Takeaways

  • The CVV is a three- or four-digit code on your card that proves you physically hold it when you shop online or by phone.
  • Merchants never store your CVV after the transaction, so a data breach of their system should not expose this code.
  • You should never share your CVV with anyone who calls or emails you, even if they claim to be from your bank.
  • A stolen CVV alone is useless without your card number, expiration date, and cardholder name — but together they create real fraud risk.

Where the CVV appears on your card

For Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. For American Express, the four-digit code appears on the front, above the card number on the right side.

The code is printed, not embossed, so it sits flat on the card surface. This matters because it means the code cannot be read by the magnetic stripe reader or chip — only by someone looking at the card or reading it aloud. That design choice is deliberate: it ensures the CVV stays separate from the data stored electronically on the card.

How merchants use the CVV during checkout

When you enter your card number, expiration date, and CVV into an online form or give them to a phone representative, the merchant sends all three pieces of information to their payment processor. The processor checks that the CVV matches the card number on file with your bank.

If the CVV does not match, the transaction is declined — a sign that either you mistyped it or someone is trying to use a stolen card number without the physical card. The merchant never stores the CVV after the transaction completes; payment card industry rules forbid it. That means even if a merchant's database is breached, the CVV should not be exposed because it was never saved there.

Why you should never give your CVV over the phone or email

Your bank and credit card company will never call or email you asking for your CVV. If someone contacts you claiming to be from your bank and requests this code, it is a scam. Legitimate banks already have your card information on file and have no reason to ask for the CVV.

The same rule applies to emails, text messages, and pop-up windows. Real financial institutions do not request sensitive card details through these channels. If you receive such a request, hang up or delete the message and call your bank directly using the number on the back of your card.

Scammers use urgency and authority to pressure you into sharing the code — they may claim there is fraud on your account or that your card will be frozen. Do not fall for it. Your CVV is meant to stay between you and the merchant you are actively paying.

What happens if someone gets your CVV

A stolen CVV alone cannot be used for fraud because the thief also needs your card number, expiration date, and cardholder name. However, if a criminal has all four pieces of information, they can make online and phone purchases in your name.

If you notice unauthorized charges on your statement, contact your bank immediately. Most credit card companies limit your liability for fraudulent charges to $50, and many waive that entirely if you report the fraud quickly. Your bank will investigate the charge and typically issue a refund while they look into it.

To reduce the risk of fraud, monitor your statements regularly, use strong passwords on shopping websites, and shop only on secure sites (look for the padlock icon in your browser's address bar). Some banks also offer virtual card numbers for online shopping — a temporary number linked to your real account that expires after one use.

CVV versus other card security features

The CVV is one layer of fraud protection, but not the only one. Your card also has an expiration date, which limits how long a stolen card number can be used. Chip technology (EMV) makes in-store fraud harder by creating a unique code for each transaction, so a stolen chip number cannot be reused. Contactless payment and digital wallets add another layer by keeping your actual card number off the receipt.

Online, some merchants also use 3D Secure (Verified by Visa, Mastercard SecureCode), which sends you a code via text or app to confirm the purchase is really you. This is separate from the CVV and adds protection even if someone has your full card details.

Frequently Asked Questions

Can I use my card online without entering the CVV?

Most online retailers require the CVV, but some stored-payment systems (like Amazon or Apple Pay) do not ask for it on repeat purchases because they already verified your card. If a site does not ask for the CVV, it means they have already confirmed you own the card or they are using a different verification method.

Is it safe to write my CVV on the back of my card?

No. If your card is lost or stolen, writing the CVV on it defeats the entire purpose of the code. The whole point is that the CVV is separate from the card data, so a thief cannot use the card online without also knowing the code. Keep the CVV in your head or in a secure password manager, not on the card itself.

What if I forgot my CVV?

Look at the back of your physical card — it is printed there. If you do not have the card in front of you, you will need to retrieve it or contact your bank. Your bank can confirm details about your card but will not read the CVV aloud over the phone for security reasons.

Does the CVV change?

No, the CVV stays the same for the life of the card. It only changes when you receive a new card — either because yours expired, was damaged, or was replaced due to fraud. Each new card gets a new CVV printed on it.

Can I use my card at a gas pump or ATM without the CVV?

Yes. Gas pumps and ATMs do not ask for the CVV because they read your card directly through the chip or magnetic stripe. The CVV is only needed for online and phone purchases where the merchant cannot physically read your card.