The CVV is a three- or four-digit security code printed on your card that proves you physically hold it
The CVV (Card Verification Value) is a number on your debit or credit card that merchants and payment processors use to confirm you have the card in your hands. It is not stored in the card's magnetic stripe or chip, and it is not part of your account number. When you make an online purchase or give your card details over the phone, the merchant asks for this code to verify the transaction is legitimate.
The CVV sits in a different location depending on which card network issued your card. On Visa, Mastercard, and Discover cards, it is a three-digit code printed on the back of the card, usually to the right of the signature strip. On American Express cards, it is a four-digit code printed on the front, above your account number on the right side.
This code exists because online and phone transactions cannot use the same verification methods as in-person swipes or chip reads. A merchant who has only your card number and expiration date cannot prove you authorized the purchase. The CVV fills that gap—if a thief has stolen your card number but not the physical card, they cannot complete most online transactions without guessing the CVV.
Key Takeaways
- The CVV is a three- or four-digit code on the back (or front, for American Express) of your card that proves you physically possess it.
- Merchants use the CVV to verify online and phone transactions, but never store it after the purchase is complete.
- You should never share your CVV with anyone except the merchant you are paying, and never enter it on a website that does not have a secure connection.
- If your CVV is compromised, you do not need to replace your card unless fraudulent charges appear—the code itself cannot be used without your card number and expiration date.
Where the CVV appears on different card types
Visa, Mastercard, and Discover cards print the CVV on the back, in the signature area. It is the last three digits of a longer number printed there. American Express places its four-digit code (called the CID, or Card Identification Number) on the front of the card, to the right of your account number.
Some older cards or specialty cards may have the code in a different location or format, but the principle is the same: it is a number only you should see when you hold the physical card. If you cannot find it, contact your card issuer to confirm where it appears on your specific card.
Why merchants ask for the CVV during online and phone purchases
When you swipe or insert a card in person, the terminal reads the magnetic stripe or chip, which contains encrypted data that proves the card is real and active. Online and phone transactions cannot read this data, so merchants have no way to verify the card is genuine without additional information.
The CVV serves as proof that you have the physical card. A thief who has only your card number and expiration date (information that may appear on a receipt or be visible in a data breach) cannot complete an online purchase without also knowing the CVV. This reduces fraud risk for both the merchant and your bank.
Merchants are required by payment networks to request the CVV for online and phone transactions, but they are also required to not store it after the transaction is complete. If a merchant's database is breached, the CVV should not be in that database—only your card number and expiration date should be there, and those alone are not enough to make an unauthorized purchase.
What happens if someone gets your CVV
A CVV by itself is nearly useless to a thief. They also need your card number, expiration date, and your name—and even with all of that, they can only make online or phone purchases, not in-person transactions. If a thief has your full card details but not the physical card, they are limited to merchants who do not require a CVV or who accept transactions without it.
If you believe your CVV has been compromised—for example, you used it on a website that was later breached—monitor your card statements for unauthorized charges. You do not need to request a new card unless fraudulent activity appears. Your bank can dispute any charges you did not make, and you are not responsible for them under federal law.
If fraudulent charges do appear, contact your card issuer immediately. They will cancel the card and issue a replacement with a new CVV. The new card will arrive within 7 to 10 business days in most cases.
How to protect your CVV
Never share your CVV with anyone except the merchant you are paying. Your bank, your card issuer, and legitimate customer service representatives will never ask for your CVV over the phone or by email. If someone contacts you claiming to be from your bank and asks for this code, it is a scam—hang up and call your bank directly using the number on the back of your card.
When entering your CVV online, make sure the website uses a secure connection. Look for "https://" at the beginning of the URL (not "http://"), and look for a padlock icon in the address bar. These indicate the connection is encrypted and your information is not being transmitted in plain text.
Do not write your CVV on your card, take a photo of it, or store it in your phone or email. If you need to reference it later, retrieve it from the physical card itself. Avoid using the same password for multiple online shopping accounts, and use a password manager to create and store unique, complex passwords for each site where you save your card details.
CVV versus other card security features
The CVV is one of several security layers built into card transactions. The magnetic stripe and chip both contain encrypted data that changes with each transaction, making it nearly impossible to clone a card by copying this data alone. The CVV adds another layer by requiring proof of physical possession.
Newer security tools include 3D Secure (also called Verified by Visa, Mastercard SecureCode, or Discover ProtectBuy), which prompts you to enter a password or receive a one-time code when you make an online purchase. Some cards also offer virtual card numbers—temporary numbers tied to your account that expire after one use or one merchant, so your real card number is never shared.
These tools work alongside the CVV, not instead of it. Most merchants still require the CVV for online transactions, even if they also use 3D Secure or other verification methods.
What to do if you lose your card or suspect fraud
If your physical card is lost or stolen, call your card issuer immediately. They will cancel the card and issue a replacement. The new card will have a new CVV, so any thief who memorized the old code will not be able to use it.
If you suspect unauthorized charges on your account, contact your card issuer right away. Under the Fair Credit Billing Act, you are not responsible for fraudulent charges if you report them within 60 days of the statement date. Your bank will investigate and reverse the charges while they conduct their review. In most cases, you will receive a temporary credit within 10 business days, and a final resolution within 45 days.
Keep copies of any correspondence with your bank about the fraud, including the case number and the names of representatives you spoke with. This documentation protects you if the dispute is escalated.
Frequently Asked Questions
Can someone use my card number without the CVV?
It depends on the merchant. Most online retailers require the CVV and will reject a transaction without it. Some older or less secure websites may not require it, which is why those sites pose higher fraud risk. In-person transactions do not require the CVV because the card is physically present.
Is it safe to save my CVV on a website for faster checkout?
No. Legitimate payment processors and major retailers do not allow you to save the CVV. If a website offers to store it, that is a red flag—the site is not following payment security standards. Never save your CVV anywhere, even in your browser's autofill.
What if I give my CVV to a scammer?
Contact your card issuer immediately and report the fraud. If the scammer also has your card number and expiration date, ask your bank to cancel the card and issue a replacement. Monitor your statements for unauthorized charges and dispute any that appear. You are not liable for fraudulent charges reported within 60 days.
Do I need to memorize my CVV?
No. You only need to reference it when making a purchase. Keep your physical card in a safe place and look at it when you need the code. Never write it down or store it digitally.
Why does my new card have a different CVV?
Each card has its own unique CVV. When your bank issues a replacement card (due to loss, theft, or expiration), the new card receives a new CVV. This is normal and adds another layer of security.