CVV is a three- or four-digit security code printed on your credit card
CVV stands for Card Verification Value. It is a number your card issuer prints on the physical card itself — not encoded in the magnetic stripe or chip — as a way to verify that you actually hold the card when you make a purchase online or over the phone. The code exists because someone reading your card number alone cannot complete a transaction; they would also need this separate number that only appears on the card itself.
The CVV is not the same as your PIN (Personal Identification Number), which you use at ATMs and in-store terminals. The CVV is specifically for remote transactions — online shopping, phone orders, mail orders — where the merchant cannot physically inspect your card.
Different card networks use slightly different names for the same thing. Visa and Discover call it CVV2. Mastercard calls it CVC2 (Card Verification Code). American Express calls it CID (Card Identification). All three serve the same purpose, and merchants treat them the same way.
Where to find your CVV on your card
For Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. It appears after the last four digits of your card number.
American Express cards are different: the four-digit CVV appears on the front of the card, above and to the right of the main card number. This is one of the few places where American Express cards differ visibly from other cards.
The CVV is printed in a way that makes it slightly raised or embossed on some cards, though this varies by issuer. The key point is that it is printed on the card surface, not embedded in the chip or stripe — which is why a thief who steals your card number online cannot use it without also having physical access to the card itself.
Why merchants ask for your CVV
When you enter your card number, expiration date, and CVV into a website checkout form, the merchant sends that CVV to your card issuer (your bank or credit union) to verify. The issuer checks whether the CVV matches the one they have on file for that card number. If it does not match, the transaction is declined.
This verification step is a basic fraud prevention tool. It proves that you have the physical card in your possession at the moment of purchase. Someone who has stolen only your card number — from a data breach, a skimmed ATM, or a compromised website — would not have the CVV and could not complete the purchase.
The CVV does not protect you against someone who steals your actual card. If a thief has the physical card, they have the CVV too. But it does stop many online fraud attempts where only the card number has been compromised.
Key Takeaways
- CVV is a three- or four-digit security code printed on your credit card that merchants request for online and phone purchases to verify you hold the physical card.
- Visa, Mastercard, and Discover print the three-digit CVV on the back of the card; American Express prints a four-digit code on the front.
- The CVV is not stored in the card's chip or magnetic stripe, which is why someone with only your card number cannot use it without the CVV.
- Your card issuer verifies the CVV against their records when you make a remote purchase, and the transaction is declined if the number does not match.
CVV and data security
The CVV is designed to be a security feature, but it has limits. Legitimate merchants are required by payment card networks to ask for it during online checkout, but they are also required not to store it after the transaction is complete. This means a data breach at a retailer should not expose your CVV even if it exposes your card number.
However, you should never share your CVV with anyone who contacts you by phone, email, or text claiming to be from your bank or card issuer. Your bank already has your CVV on file and will never ask you to provide it. Requests for your CVV are a common phishing tactic used by scammers.
If you see your CVV printed on a receipt or in an email confirmation, that is a red flag that the merchant is not following proper security practices. Report it to your card issuer immediately.
What happens if your card is compromised
If your card number is stolen but your physical card remains in your possession, your CVV provides some protection against immediate fraudulent online purchases. A thief with only the card number and expiration date cannot complete most online transactions without the CVV.
If your physical card is stolen, the thief has both the card number and the CVV, so this protection does not apply. Contact your card issuer right away to report the card as lost or stolen. They will cancel the card and issue you a new one with a new CVV.
If you notice unauthorized charges on your statement, report them to your card issuer regardless of whether you think your CVV was compromised. Most card networks offer fraud protection that limits your liability for unauthorized purchases, though the specifics depend on your issuer and how quickly you report the fraud.
CVV versus other card security features
The CVV is one of several security features built into credit cards. The card number itself is divided into sections that identify the issuer, the account, and include a check digit that validates the number mathematically. The expiration date limits how long a stolen card number can be used. The magnetic stripe and chip both contain encrypted information that is harder to steal than a printed number.
Together, these features make it more difficult — though not impossible — for someone to use a stolen card number. The CVV specifically targets remote transactions where the card is not physically present. For in-store purchases, the chip or magnetic stripe provides the security verification instead.
No single security feature is foolproof. The most effective protection is monitoring your statements regularly, reporting suspicious activity quickly, and being cautious about where you enter your card information online.
Frequently Asked Questions
Can someone use my card number without the CVV?
For most online purchases, no — the CVV is required. However, some older or less secure websites may not ask for it, and in-person fraud using a stolen card number is possible if the thief also has the physical card. If you see charges you did not make, report them to your card issuer immediately.
Is it safe to give my CVV to a website?
It is normal and expected to enter your CVV during online checkout. Reputable merchants ask for it as part of standard payment processing. Never enter it in response to an unsolicited email, text, or phone call, and never enter it on a website that does not look legitimate or does not use a secure connection (look for "https" in the address bar).
What if I forgot my CVV?
Check the back of your physical card — it is printed there. If you do not have your card with you, contact your card issuer. They can help you complete your purchase or issue you a replacement card. Never share your CVV with anyone except the merchant you are buying from.
Does the CVV change if I get a new card?
Yes. Each card has its own unique CVV. When your card issuer sends you a replacement card — whether because yours expired, was damaged, or was reported stolen — the new card will have a different CVV printed on it.
Can I use my card online without entering the CVV?
Most major retailers require the CVV for online purchases, but some may not ask for it depending on their payment system. If a website does not ask for your CVV, that does not mean it is unsafe — it may simply use a different verification method. However, if a website asks you to enter your CVV in an unusual way or outside of a checkout form, that is a warning sign.