CVC is the three- or four-digit security code on your card that proves you physically have it
The CVC (Card Verification Code) is a number printed on your credit or debit card, separate from your card number. It exists only on the physical card itself—not in any database or magnetic stripe. When you make a payment online, by phone, or through a merchant terminal, providing the CVC tells the payment processor that you actually hold the card in your hand, which reduces the risk that a stolen card number alone can be used to charge you.
The CVC goes by different names depending on your card issuer. Visa and Discover call it the CVV (Card Verification Value). American Express calls it the CID (Card Identification). Mastercard uses CVV2. All three serve the same purpose: a fraud check that happens in seconds during payment processing.
Key Takeaways
- CVC is a three- or four-digit code printed on your card that proves you physically possess it during a payment.
- Visa and Discover cards have a three-digit CVC on the back; American Express has a four-digit code on the front.
- The CVC is never stored in the card's magnetic stripe or chip, so a stolen card number alone cannot be used without it.
- Online merchants are required by payment networks to request the CVC for card-not-present transactions, and most payment processors decline transactions that lack it.
Where to find your CVC on your card
For Visa, Mastercard, and Discover, the CVC is a three-digit number printed on the back of your card, usually to the right of the signature strip. For American Express, the four-digit code appears on the front of the card, above the card number on the right side. If you cannot see the number clearly, contact your card issuer for a replacement card or call the number on the back of your card to confirm the code before you attempt a payment.
Never write down or photograph your CVC and store it separately from your card. The whole point of the code is that it should only be known to you and the card issuer. If you lose your card or suspect fraud, the CVC becomes invalid the moment your issuer cancels the card and sends you a replacement.
How CVC protects you during payment
When you enter your CVC at checkout, the payment processor sends it to your card issuer in real time. The issuer checks whether the code matches the card number you provided. If it does not match, the transaction is declined immediately. This happens in the background—you see only a success or failure message.
The CVC protects you against two common fraud scenarios. First, if someone obtains your card number through a data breach or by copying it during a transaction, they cannot use that number alone to make online purchases without the CVC. Second, if a criminal uses a skimming device to steal your card data at a gas pump or ATM, they still need the CVC to charge your card online. The CVC is not stored on the magnetic stripe, so skimmers cannot capture it.
CVC protection has limits. It does not prevent fraud if someone steals your physical card, because they will have the code in hand. It also does not protect you if you voluntarily give your card details to a scammer or if you enter your information on a fraudulent website. The code is one layer of security, not a complete shield.
When merchants ask for CVC and when they should not
Merchants must request your CVC for any card-not-present transaction—that is, any payment where you are not physically handing the card to them or inserting it into a terminal. Online purchases, phone orders, and mail orders all require CVC. In-person payments at a store or restaurant do not, because the merchant can see and verify the physical card.
Be cautious if a merchant asks for your CVC in person or if they ask you to provide it over the phone for a transaction you did not initiate. Legitimate merchants do not store your CVC after a transaction, and payment networks prohibit them from doing so. If a business calls you asking for your CVC without your request, hang up and call the business directly using the number on your statement or their official website.
What happens if you enter the wrong CVC
If you mistype your CVC, the payment processor will reject the transaction within seconds. You will see an error message at checkout, usually something like "Card verification failed" or "Invalid security code." You can try again immediately with the correct code. There is no penalty for entering it wrong, and the failed attempt does not damage your credit or lock your card.
If you repeatedly enter an incorrect CVC—usually after three or four attempts—some payment processors will temporarily block further attempts to prevent brute-force attacks. If this happens, wait a few minutes and try again, or contact your card issuer to confirm the code is correct. If your card is damaged or worn and you cannot read the CVC clearly, request a replacement card from your issuer.
CVC and fraud disputes
If someone makes an unauthorized charge to your card and claims they did not have the CVC, your card issuer will investigate. The fact that the correct CVC was entered during the transaction is strong evidence that you authorized the charge, because only you should know that code. However, this does not mean you are automatically liable. If you can show that your card was compromised or that you did not make the purchase, you can still dispute it.
Report unauthorized charges to your card issuer as soon as you notice them. Most issuers cover fraudulent charges under their zero-liability policies, meaning you will not pay for unauthorized transactions. The investigation typically takes 30 to 60 days, during which time the issuer may issue a temporary credit while they verify the details.
CVC is different from your PIN
Your CVC and your PIN (Personal Identification Number) are two separate security codes that serve different purposes. The CVC is printed on your card and used for card-not-present transactions. Your PIN is a number you create and memorize, used only when you insert your card into an ATM or a chip reader at a store. A merchant or ATM operator should never ask for your PIN, and you should never share it with anyone.
If someone has your card number and CVC but not your PIN, they cannot withdraw cash from an ATM or use your card at a chip reader in person. Conversely, if someone has your PIN but not your card, they cannot make online purchases. Keeping both codes private and separate is essential to protecting your account.
Frequently Asked Questions
Can someone use my card number without the CVC?
Not for online purchases or card-not-present transactions. Payment networks require the CVC for these transactions, and most processors will decline a charge if the CVC is missing or incorrect. However, someone with your physical card can use it in person without needing to know the CVC, which is why you should report a lost or stolen card immediately.
Is it safe to give my CVC over the phone?
Only if you initiated the call to a merchant you trust. Never provide your CVC if a business calls you unsolicited asking for it. Legitimate companies will not call you asking for your CVC. If you need to make a payment by phone, call the business using the number on your statement or their official website, not a number they provide.
What if I cannot see my CVC because my card is damaged?
Contact your card issuer and request a replacement card. Do not attempt to write the number down from an old statement or guess—the CVC must match the physical card. Your issuer will send you a new card with a new CVC within 7 to 10 business days.
Does entering my CVC mean the transaction is may provide to go through?
No. The CVC verifies that you have the card, but other checks still happen. Your issuer may decline the transaction if the amount is unusual, if the merchant location seems suspicious, or if your account has fraud alerts. A successful CVC check only means that part of the verification passed.
Can I use the same CVC for multiple transactions?
Yes, the CVC stays the same for the life of your card. Every time you use your card online, you enter the same code. When you get a replacement card, you will receive a new CVC, and the old one becomes invalid.