The CVV is a three- or four-digit security code printed on your card, separate from your card number

The CVV (Card Verification Value) is a number printed on the back of most credit cards, usually in the signature strip area. On American Express cards, it appears on the front. The code is three digits on Visa, Mastercard, and Discover cards, and four digits on American Express.

The CVV exists to verify that you physically have the card in your hand. When you make a purchase online or over the phone, the merchant asks for this code because they cannot swipe or insert your card themselves. It is a basic fraud check — if someone has stolen your card number but not the physical card, they typically cannot complete the transaction without the CVV.

The CVV is not the same as your PIN (Personal Identification Number). Your PIN is what you enter at an ATM or when you tap your card at a checkout terminal. The CVV is only for remote transactions — online shopping, phone orders, mail orders.

Key Takeaways

  • The CVV is a three- or four-digit code printed on your card that proves you have the physical card when you cannot insert or swipe it.
  • Merchants never store your CVV after a transaction, so if a website is breached, thieves do not gain your CVV from that breach.
  • You should never share your CVV with anyone except the merchant you are paying, and never enter it on a website that looks suspicious or unsecured.
  • If someone has your card number and CVV, they can make online purchases without your permission, so treat the CVV as carefully as your card number itself.

Where the CVV appears and why merchants ask for it

On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature line. On American Express cards, it is a four-digit code printed on the front, above the card number on the right side.

Merchants request the CVV during online or phone transactions because it is one of the few pieces of card information that is not printed on receipts or stored in most payment systems. The merchant's payment processor checks the CVV against the card issuer's records in real time. If the CVV does not match, the transaction is declined. This makes it harder for someone using a stolen card number to complete a purchase, since they would need to know or guess the CVV as well.

The CVV is also called the CVC (Card Verification Code), CID (Card Identification), or security code, depending on the card network. The function is the same across all these names.

Why merchants do not store your CVV

By law and by payment network rules, merchants are not allowed to store your CVV after the transaction is complete. This is a core part of the Payment Card Industry Data Security Standard (PCI DSS), a set of rules that all businesses handling credit cards must follow.

The reason is straightforward: if a merchant's database is hacked, thieves should not be able to walk away with CVVs. Your card number alone is less useful for online fraud without the CVV. This is why a data breach at a retailer or website does not automatically mean your CVV has been stolen — it usually has not been stored there in the first place.

If you see a website or app that asks you to save your CVV for future purchases, that is a red flag. Legitimate merchants do not do this. They may save your card number for recurring charges, but they will ask you to re-enter the CVV each time, or they will use a tokenization system that does not store the actual CVV.

When you should and should not share your CVV

Share your CVV only with a merchant you trust and only during a transaction you initiated. This includes online retailers, subscription services, phone orders, and mail orders. You should enter it directly into the merchant's website or give it verbally to a customer service representative you called yourself.

Never share your CVV in an email, text message, or chat. Never enter it on a website that does not have a secure connection (look for the padlock icon in your browser's address bar and a URL that starts with "https"). Never give it to someone who called you claiming to be from your bank or credit card company — legitimate financial institutions will never ask for your CVV over the phone.

If you receive an email asking you to "verify" your card information by clicking a link and entering your CVV, that is a phishing scam. Delete it and report it to your card issuer.

What happens if someone has your CVV

If a thief has both your card number and your CVV, they can make online purchases without your permission. They cannot use your card at a physical store (because they do not have the physical card to insert or tap), but they can order from websites, make phone purchases, and set up subscriptions.

If you notice unauthorized charges on your statement, contact your card issuer immediately. By law, you are not responsible for fraudulent charges if you report them within a certain timeframe — typically 60 days from when the statement was mailed or made available to you. Your card issuer will investigate, and if the charge is confirmed as fraud, they will reverse it and issue you a new card.

If you believe your CVV has been compromised but you have not seen fraudulent charges yet, you can request a new card from your issuer. There is no need to wait. A new card will have a new CVV, which makes any stolen CVV useless.

How the CVV differs from other card security features

The CVV is one layer of fraud protection, but not the only one. Other security features include your card number itself, your expiration date, your name, and your billing address. For in-person transactions, the chip on your card (if it has one) provides additional security by creating a unique code for each transaction that cannot be reused.

For online transactions, some card issuers offer additional protections like 3D Secure (also called Verified by Visa, Mastercard SecureCode, or Discover Secure), which requires you to enter a password or receive a one-time code on your phone before the transaction goes through. This is separate from the CVV and adds another layer of verification.

Your card issuer may also monitor your account for unusual activity and decline transactions that look suspicious based on your spending patterns, location, or the merchant's risk profile. None of these protections are foolproof, but together they make it much harder for thieves to use a stolen card number.

Frequently Asked Questions

Can someone use my card number without the CVV?

They can try, but most online merchants will decline the transaction if the CVV does not match. At a physical store, they cannot use your card at all without the physical card itself. However, some older or less secure merchants may not check the CVV, so it is still important to treat your card number as carefully as your CVV.

Is it safe to enter my CVV on a website?

It is safe if the website is legitimate, has a secure connection (https), and you initiated the transaction. Look for the padlock icon in your browser. Never enter your CVV on a website you reached by clicking a link in an email or text message, even if the link looks official.

What should I do if I accidentally shared my CVV?

Contact your card issuer right away and request a new card. Do not wait to see if fraudulent charges appear. A new card will have a new CVV, which makes the old one useless. Your issuer can also flag your account for monitoring.

Why do some websites ask for my CVV every time I order?

This is actually the secure way to handle repeat customers. Legitimate merchants store your card number for convenience but ask you to re-enter the CVV each time to verify you still have the physical card. If a website saves your CVV, that is a sign it may not be following security standards.

Is the CVV the same as my card's security code?

Yes. CVV, CVC, CID, and security code all refer to the same three- or four-digit number. Different card networks use different names, but the function is identical across all of them.