The CVV and CVC are the same thing — a three or four-digit security code on the back of your card

CVV stands for Card Verification Value. CVC stands for Card Verification Code. They are two names for the same number. You will see one term or the other depending on which card company issued your card — Visa and Discover call it CVV, while Mastercard and American Express call it CVC — but they work the same way.

The number sits on the back of your card, usually in or near the signature strip. On American Express cards, it appears on the front. It is a three-digit code on Visa, Mastercard, and Discover cards, and a four-digit code on American Express. The code is not stored in the card's magnetic stripe or chip, which is why merchants cannot pull it from a card reader — you have to read it and type it in yourself.

The purpose is to verify that you physically have the card in your hand when you make an online or phone purchase. If someone has only your card number and expiration date (from a data breach, for example), they cannot complete a transaction without the CVV, because they cannot see the back of the card.

Key Takeaways

  • CVV and CVC are the same security code; the name depends on which card company issued your card.
  • The code is three digits on Visa, Mastercard, and Discover, and four digits on American Express.
  • You should never share your CVV with anyone except the merchant you are paying, and legitimate merchants will never ask for it by phone or email.
  • A CVV protects you only against remote purchases; it does not protect your card if someone steals the physical card itself.

Where to find your CVV or CVC

On Visa, Mastercard, and Discover cards, turn the card over and look at the back. The three-digit code appears to the right of the signature strip, usually printed in a different color or font than the card number itself. On some cards it is in a box; on others it is simply printed on the back.

On American Express cards, the code is on the front, above the card number on the right side. It is four digits instead of three. American Express calls this the CID (Card Identification Number) in some contexts, but it functions the same way as the CVV on other cards.

When merchants ask for your CVV and when they should not

Legitimate merchants ask for your CVV when you make an online purchase or pay by phone. They need it to verify that you have the card. This is normal and expected. You should enter it on a secure checkout page or read it aloud to a customer service representative you called yourself.

A merchant should never ask for your CVV by email, text message, or unsolicited phone call. Your bank will never ask for your CVV. If someone contacts you claiming to be from your bank or card company and asks for this number, it is a scam — hang up or delete the message and call your bank directly using the number on the back of your card.

Some recurring payments (subscriptions, automatic bills) require you to enter your CVV once when you set up the payment, and then the merchant stores your card information for future charges. This is normal. But if a merchant asks you to provide your CVV every time you make a purchase, or asks for it in an unusual way, that is a red flag.

What the CVV does and does not protect

The CVV protects you against remote fraud — when someone uses your card number without having the physical card. It does not protect you if someone steals your actual card, because they can see the CVV in person. It also does not protect you if your card information is stolen in a data breach, because the CVV is not stored in the merchant's system (or should not be, by law).

The CVV is one layer of security, not a complete shield. Other protections include your card's chip (which generates a unique code for each transaction), your bank's fraud monitoring, and your legal right to dispute unauthorized charges. If you notice a charge you did not make, contact your bank immediately — you are not responsible for fraudulent charges if you report them promptly.

Why you should not write down or photograph your CVV

Your CVV is the only number on your card that is not embossed or printed in a way that lasts forever. It fades or wears off over time, which is intentional — it is meant to be temporary and visible only when you need it. This design makes it harder for someone who finds your card to use it for remote purchases.

If you write your CVV on a receipt, store it in your phone, or photograph it, you defeat this protection. Keep the code in your head or look at the back of your card when you need it. Never store it anywhere else, even in a password manager or notes app.

What happens if your CVV is compromised

If you believe your CVV has been seen by someone who should not have it — for example, you gave it to a website that looked suspicious, or you saw an unauthorized charge on your statement — contact your card issuer immediately. They can issue you a new card with a new CVV. You are not liable for fraudulent charges, but the sooner you report the problem, the faster your bank can stop additional charges.

You do not need to cancel your card just because someone saw the number once. But if you see multiple unauthorized charges, or if the compromise happened through a data breach at a major retailer, your bank may proactively issue you a replacement card as a precaution.

Frequently Asked Questions

Can someone use my card if they have the number and CVV but not the card itself?

Yes, they can make online or phone purchases. This is why the CVV exists — to make it harder. But they cannot use the card in a store, because the card reader checks the chip or magnetic stripe. If you see unauthorized charges, report them to your bank right away.

Is it safe to give my CVV to a website?

It is safe if the website is legitimate and uses encryption (look for "https://" in the address bar and a lock icon). It is not safe if the site looks suspicious, has poor grammar, or is asking you to pay in an unusual way. When in doubt, call the company directly to confirm the website is real.

What if I accidentally told someone my CVV over the phone?

Call your card issuer immediately and tell them what happened. They can monitor your account for fraud and issue a new card if needed. Do not panic — your bank has tools to catch unauthorized charges quickly, and you are not liable for them if you report them promptly.

Do I need to memorize my CVV?

No. You only need to look at it when you make a purchase. Memorizing it actually increases the risk, because you might say it aloud or type it somewhere you should not. Just look at the back of your card when you need it.

Why does American Express have four digits instead of three?

American Express uses a different card structure and security system than Visa and Mastercard. The four-digit code provides the same level of verification as the three-digit code on other cards. Both work the same way in practice.