The CVV is a three- or four-digit security code printed on your card that proves you physically hold it

The CVV (Card Verification Value) is a number on the back of most credit cards — three digits for Visa, Mastercard, and Discover, four digits for American Express. It sits separate from your card number and expiration date. When you enter it during an online or phone purchase, you are telling the merchant you have the physical card in your hand, not just its number.

The CVV exists because a thief who steals your card number alone cannot complete most transactions without it. If someone has only your 16-digit card number and expiration date — information that might appear on a receipt or be intercepted online — they still cannot charge your card at most retailers without the CVV. It is a second layer of verification.

The CVV is not the same as your PIN (Personal Identification Number), which you use at ATMs and in-person at stores. The CVV is only for remote purchases: online, by phone, or by mail. Your PIN stays between you and your bank.

Key Takeaways

  • The CVV is a three- or four-digit code on the back of your card that proves you physically possess it when making remote purchases.
  • Merchants cannot see your CVV when you swipe or insert your card in person — it is only used for online, phone, and mail orders.
  • Never share your CVV with anyone who calls you or emails you, even if they claim to be from your bank.
  • If your card is lost or stolen, contact your bank immediately; the CVV alone cannot be used to make purchases without the card number and expiration date.

Where the CVV appears on your card

On Visa, Mastercard, and Discover cards, the CVV is printed on the back, usually to the right of the signature strip. It is the last three digits of a longer number on the back. On American Express cards, the CVV is four digits and appears on the front, above the card number on the right side.

The CVV is printed, not embedded in the chip or magnetic stripe. This means it only exists on the physical card itself — it is not stored in the payment network the way your card number is. That separation is intentional: it makes the CVV harder to steal remotely.

When you need to provide your CVV

You enter your CVV whenever you make a purchase without physically handing your card to the merchant. This includes online shopping, phone orders, and mail orders. The merchant's payment system sends the CVV to your bank's network to verify that you have the card.

You do not provide your CVV when you swipe or insert your card at a store, gas pump, or ATM. The merchant never sees it in those situations. If a cashier or attendant asks for your CVV in person, that is a red flag — legitimate in-person merchants do not need it.

How to protect your CVV

Treat your CVV the same way you treat your card number: keep it private. Do not write it down, do not text it, do not email it, and do not say it out loud where others can hear. If someone calls you claiming to be from your bank and asks for your CVV, hang up. Your bank already has your card information and will never ask for your CVV over the phone.

When shopping online, only enter your CVV on secure websites. Look for a padlock icon in the address bar and make sure the URL starts with "https://" rather than "http://". Avoid entering your CVV on public Wi-Fi networks, where data can be intercepted more easily.

If you believe your CVV has been compromised — for example, if you entered it on a website that was later hacked — contact your card issuer right away. They can cancel your card and issue a replacement with a new CVV. You are not responsible for fraudulent charges made with your card, but reporting them quickly protects you.

CVV fraud and what it means

A thief who has your card number, expiration date, and CVV can make online purchases without your knowledge. This is called "card-not-present" fraud because the thief does not need the physical card. However, the CVV requirement does stop many fraudsters, because it requires either stealing the physical card or obtaining all three pieces of information.

If fraudulent charges appear on your statement, contact your card issuer immediately. Federal law limits your liability for unauthorized charges: if you report them within 60 days of the statement date, you are typically not responsible for the amount. The card issuer will investigate and usually reverse the charges while they do.

CVV and data breaches

When large retailers are hacked, thieves sometimes steal card numbers and expiration dates but not CVVs. This is because responsible merchants do not store CVVs after a transaction is complete — payment networks require them to delete it. If a merchant keeps CVV data on file, that is a violation of payment industry rules and a major security risk.

If you learn that a retailer you shop at has been breached, check your statement for unauthorized charges. Even if your CVV was not stolen, your card number may have been. Most card issuers offer free fraud monitoring and will replace your card at no cost if it was compromised in a breach.

Frequently Asked Questions

Can someone use my card with just the CVV?

No. A thief needs your card number, expiration date, and CVV together to make an online purchase. Having only the CVV is useless without the other information. This is why the CVV exists — it prevents someone who sees your card number on a receipt from using it online.

Is it safe to save my CVV when I shop online?

No. Do not allow websites to store your CVV, even if they offer to. Legitimate payment systems do not save CVVs. If a site asks to store it, use a different payment method or shop elsewhere. You can always re-enter it the next time you shop.

What should I do if I accidentally shared my CVV?

Contact your card issuer immediately and describe what happened. They can monitor your account for fraud and issue a replacement card with a new CVV if needed. Act quickly — the sooner you report it, the better protected you are.

Does my debit card have a CVV?

Yes. Debit cards issued by Visa or Mastercard have CVVs just like credit cards do. The CVV works the same way: it protects remote purchases. Treat your debit card CVV with the same care as your credit card CVV.