The CVV or CVC is a three- or four-digit security code printed on your card that proves you physically hold it

The CVV (Card Verification Value) or CVC (Card Verification Code) is a short number on your credit card that card networks use to confirm you have the physical card in your hand. Visa and Mastercard call it CVV; American Express calls it CVC. It is not the same as your card number, expiration date, or PIN, and it serves one specific purpose: to reduce fraud when you make a purchase without swiping or inserting the card.

When you buy something online, over the phone, or by mail, the merchant cannot read the magnetic stripe or chip on your card — they only have the numbers you tell them. The CVV is proof that you have actually seen the card itself, because that number is not stored in the magnetic stripe or chip, and it does not appear on receipts or statements. A thief who steals your card number alone cannot complete an online purchase without it.

Key Takeaways

  • The CVV is a three- or four-digit code printed on the back of Visa and Mastercard, or the front of American Express, and it is required for most online and phone purchases.
  • The CVV is not encoded in your card's magnetic stripe or chip, so a merchant who only has your card number cannot use it without the CVV.
  • You should never give your CVV to anyone who calls you claiming to be your bank, and legitimate banks will never ask for it by phone or email.
  • The CVV protects you from fraud when you use your card remotely, but it does not protect you if someone steals the physical card itself.

Where the CVV appears on your card

On Visa and Mastercard, the CVV is a three-digit number printed on the back of the card, to the right of the signature strip. On American Express, it is a four-digit number printed on the front of the card, above the card number on the right side. The location and length differ because American Express uses a different security standard than Visa and Mastercard.

The CVV is printed, not embossed — you cannot feel it when you run your finger over the card. This is intentional: it makes the number harder to read from a distance or in a photograph, and it ensures the number is not captured when someone makes a rubbing or impression of your card.

When merchants ask for your CVV and when they should not

Legitimate merchants ask for your CVV when you enter your card details online, over the phone, or by mail. They need it to process the transaction. However, a merchant should never ask for your CVV in person when you are swiping or inserting your card at a physical location — the card reader already has access to the security information it needs.

Your bank or card issuer will never ask for your CVV by phone, email, or text message. If someone calls claiming to be from your bank and asks for the CVV, it is a scam. Hang up and call your bank directly using the number on the back of your card. Legitimate banks already have your card information on file and do not need you to provide it this way.

How the CVV reduces fraud

When you make a purchase online or by phone, the merchant sends your card number, expiration date, and CVV to the payment processor. The processor checks that all three pieces of information match the card on file. If someone has stolen only your card number — from a data breach, a skimming device, or a lost receipt — they cannot complete a remote purchase without the CVV.

This protection works only for remote purchases. If someone steals your physical card, they can use it in a store without the CVV because the card reader can access the security information directly from the chip or magnetic stripe. That is why you should report a lost or stolen card to your bank immediately, even if you still have your CVV memorized.

What the CVV does not protect you from

The CVV does not protect you if your card is lost or stolen and used in person. It does not protect you from a data breach at a merchant's website, because once your information is stolen, the thief has the CVV along with everything else. It also does not protect you from a merchant who is dishonest — if a merchant stores your CVV after the transaction (which they are not supposed to do), and their system is breached, your CVV can be stolen.

The CVV is one layer of security, not a complete shield. You should also monitor your statements regularly, set up fraud alerts with your bank, and use strong passwords on accounts where you store payment information.

Why you should not write down or share your CVV

You should memorize your CVV or look it up on your physical card each time you need it — never write it down, photograph it, or store it in your phone or computer. If someone gains access to a document, photo, or file where you have written your CVV, they have everything they need to make a remote purchase.

Do not share your CVV with anyone except a merchant you are actively buying from, and do not give it to a person who contacts you unsolicited. If you are unsure whether a request is legitimate, hang up and call the organization directly using a phone number you find yourself, not one the caller provides.

Frequently Asked Questions

Is the CVV the same as my PIN?

No. Your PIN is a number you create and memorize to withdraw cash or access your account at an ATM or bank branch. Your CVV is a fixed number printed on your card that you use to prove you have the card when buying remotely. You should never share your PIN with anyone, and you should never enter it online.

What if I give my CVV to a scammer?

Contact your card issuer immediately. Tell them you believe your CVV has been compromised. They can cancel your card and issue a new one, and they can monitor your account for fraudulent charges. Most card issuers offer fraud protection, so you may not be responsible for unauthorized purchases, but reporting quickly gives them the best chance to stop fraud before it happens.

Can a merchant store my CVV after I make a purchase?

No. Payment Card Industry (PCI) rules prohibit merchants from storing your CVV after the transaction is complete. If a merchant asks you to provide your CVV for a future purchase, they should not be storing it — you should enter it fresh each time. If you discover a merchant has stored your CVV, report it to your card issuer.

Do I need to give my CVV for in-person purchases?

No. When you swipe or insert your card at a physical store, the card reader accesses the security information directly from your card. You should never be asked to provide your CVV in person. If a cashier asks for it, it is a red flag that something is wrong with the transaction or the terminal.