The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a number on the back of your debit or credit card—usually three digits, sometimes four on American Express. It sits separately from your card number and expiration date. When you make a purchase online or over the phone, the merchant asks for this code to confirm you actually hold the card in your hand, not just know the number.
The CVV is not stored in the card's magnetic stripe or chip. It exists only on the physical card itself and in the card issuer's records. This design means that if someone steals your card number online, they cannot complete a transaction without also having the physical card to read the CVV off it.
Different card networks call it different names: Visa and Mastercard call it CVV2, American Express calls it CID, and Discover calls it CVV2. The function is the same across all of them.
Key Takeaways
- The CVV is a three- or four-digit code printed on your card that merchants use to verify you have the physical card during online and phone transactions.
- The CVV is never stored in your card's chip or magnetic stripe, so a stolen card number alone cannot be used without it.
- You should never share your CVV in person, via email, or with anyone who calls you claiming to be your bank.
- If someone uses your card number and CVV fraudulently, contact your card issuer immediately—most offer fraud protection that limits your liability.
Where the CVV appears on your card
On Visa, Mastercard, and Discover cards, the CVV is printed on the back of the card, usually to the right of the signature strip. It appears as three digits in a small box or printed directly on the card surface.
On American Express cards, the CVV is on the front, above the card number on the right side. It is four digits instead of three.
The CVV is never embossed or raised like your card number—it is always printed flat on the surface. This matters because it means the CVV cannot be read by older card readers that only capture embossed numbers, adding another layer of protection.
Why merchants ask for the CVV
When you buy something online or over the phone, the merchant cannot swipe your card or insert it into a chip reader. They have no way to physically verify you have the card except to ask you for information only the cardholder would know. The CVV serves that purpose.
The merchant sends the CVV to your card issuer (your bank or credit card company) along with the transaction. The issuer checks whether the CVV matches their records. If it does not match, the transaction is declined. This check happens in seconds, and you never see it.
Merchants are not supposed to store your CVV after the transaction completes. Payment card industry rules forbid it. If a merchant's system is breached, the CVV should not be in the stolen data because it should have been deleted immediately after the payment was processed.
When you should and should not give your CVV
Give your CVV only when you are making a purchase online or over the phone with a merchant you trust. This includes retailers, subscription services, and bill payment sites. The CVV is expected in these situations.
Never give your CVV to someone who calls you, emails you, or texts you claiming to be your bank. Your bank already has your CVV on file and will never ask you for it. If someone contacts you asking for it, hang up or delete the message immediately. This is a common fraud tactic.
Do not give your CVV to anyone in person, even if they claim to work for your bank. Do not photograph your card and send the image to anyone. Do not write your CVV on checks or receipts. Do not store it in your phone or email.
What happens if someone has your CVV
If a criminal has your card number and CVV, they can make online or phone purchases without your permission. They cannot use the card in a physical store because they do not have the physical card itself, but remote transactions are enough to cause real damage.
The moment you notice unauthorized charges, contact your card issuer. Call the number on the back of your card or your statement—not a number from an email or text. Report the fraud immediately.
Most banks and credit card companies offer fraud protection that limits your liability to zero or a small amount (often $50) if you report the fraud quickly. The issuer will cancel your card, investigate the charges, and issue you a replacement card. Disputed charges are usually removed from your account within one to three billing cycles while the investigation proceeds.
CVV versus other card security features
The CVV is one of several security layers on your card. Your card number itself is the primary identifier. Your expiration date tells the merchant when the card expires. Your name on the card is a basic check that the person using it matches the cardholder.
Chip technology (EMV) adds another layer: when you insert your card into a reader, the chip creates a unique code for that specific transaction. This code cannot be reused, so even if a criminal intercepts it, they cannot use it again. Online and phone transactions do not use the chip, which is why the CVV exists for those situations.
Some cards now include tokenization or digital wallet options (Apple Pay, Google Pay, Samsung Pay). These replace your actual card number with a temporary token that works only once. They are more secure than giving your card number and CVV to a merchant because the merchant never sees your real card details.
Protecting your CVV in daily life
Keep your card in your wallet or purse, not loose in a bag or on a desk. When you hand your card to a cashier, watch them process it. Do not let them take it out of your sight.
When entering your CVV online, make sure you are on a secure website. Look for the padlock icon in your browser's address bar and confirm the URL starts with "https://" not "http://". Never enter your CVV on a public Wi-Fi network unless you are using a VPN.
Check your statements regularly—at least monthly. If you see a charge you do not recognize, report it to your card issuer right away. The sooner you report fraud, the faster it gets resolved.
Frequently Asked Questions
Can someone use my card number without the CVV?
In person, yes—a cashier can process a card by swiping or inserting it without asking for the CVV. Online or over the phone, most merchants will decline the transaction if the CVV does not match. Some older or less secure merchants may not check it, which is why fraud still happens.
Is it safe to give my CVV to a website?
It is normal and expected to enter your CVV on legitimate retail websites during checkout. Make sure the site is secure (look for "https://" and a padlock icon), that you recognize the merchant, and that you are not on public Wi-Fi. Never enter it on a site that looks suspicious or unfamiliar.
What should I do if I accidentally shared my CVV?
Contact your card issuer immediately. Tell them you shared your CVV and ask them to monitor your account for fraud. They may cancel your card and issue a new one as a precaution. Watch your statements closely for the next few months.
Do I need to memorize my CVV?
No. You only need to know it when you are making a purchase. Memorizing it is actually riskier because you might accidentally say it aloud or write it down. Keep it on the card itself and nowhere else.
Why does American Express have four digits instead of three?
American Express uses a four-digit code because their card numbers are longer than Visa and Mastercard numbers. The extra digit provides the same level of security verification. Both three- and four-digit codes work the same way functionally.