What the CVV (Card Security Code) Does and Why It Matters

The CVV is a three- or four-digit security code printed on your card that proves you physically have it

The CVV (Card Verification Value) is a short number on the back of your credit card — usually three digits, or four if you have an American Express. It sits separate from your card number and expiration date. When you enter it during an online or phone purchase, you are telling the merchant that you actually hold the physical card in your hand, not just someone who memorized your number.

The CVV is not stored in the magnetic stripe or chip on your card. It only appears printed on the card itself. This matters because a thief who steals your card number from a data breach cannot use that number alone to make online purchases — they would also need the CVV, which they do not have. It is one of several layers that protect you.

Different card networks call it different names. Visa and Mastercard call it CVV2. American Express calls it CID. Discover calls it CVV2. The function is the same across all of them: proof that you have the card.

Key Takeaways

• The CVV is a three- or four-digit code printed on the back of your card that you enter when shopping online or by phone.
• Merchants use the CVV to verify you physically have the card, which blocks many fraudulent purchases made with stolen card numbers alone.
• The CVV is not the same as your PIN — your PIN is for ATMs and in-person transactions, while the CVV is for remote purchases.
• You should never share your CVV with anyone except the merchant you are actively paying, and legitimate companies will never ask for it by email or phone.

Where the CVV appears on your card

On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually in the signature panel on the right side. You will see it after the full card number is printed across the back.

On American Express cards, the CVV is a four-digit number printed on the front of the card, above the card number on the right side. This is one of the few places American Express differs from other card networks in how they display security information.

The CVV is always printed, never embossed. If you run your finger over it, you will not feel it raised the way you feel the card number. This is intentional — it makes the CVV harder to copy or forge.

How merchants use the CVV to protect you

When you enter your CVV during checkout, the merchant sends it to your card issuer (your bank) in a separate message from your card number. The issuer checks whether the CVV matches the one they have on file. If it does, the transaction moves forward. If it does not, the purchase is declined.

This stops many online fraud attempts because a criminal who obtained your card number from a stolen database or a data breach does not have the CVV. They can try to guess it, but most payment systems will block the transaction after a few wrong attempts. The CVV is not stored in the same place as your card number, so a breach that exposes one does not automatically expose the other.

The CVV does not protect you in person. When you swipe or insert your card at a store, the cashier does not ask for the CVV. The chip or magnetic stripe handles the verification. The CVV is specifically for remote transactions — online, by phone, or by mail — where the merchant cannot see the card itself.

CVV is not the same as your PIN

Your PIN (Personal Identification Number) is a four-digit code you create when you open your account. You use it at ATMs to withdraw cash and sometimes at checkout terminals when you pay with your debit card. Your PIN is something only you should know.

Your CVV is printed on the card by the issuer and is the same every time you use it. You do not create it, and you cannot change it. You share it with merchants during remote purchases, which means it is less secret than your PIN.

If someone steals your PIN, they can drain your bank account at an ATM. If someone steals your CVV, they still need your card number and expiration date to make an online purchase. The two codes protect different types of transactions and work in different ways.

What to do if your CVV is compromised

If you believe your card number and CVV have both been exposed — for example, through a data breach at a retailer where you shopped — contact your card issuer right away. You can find the number on the back of your card or on your statement.

Your issuer can issue you a new card with a new number and a new CVV. This usually takes five to ten business days. Until the new card arrives, you can still use your old card in person at stores, but online purchases will be blocked if the issuer suspects fraud.

You do not need to do anything else. You do not need to change your PIN or contact the retailer. Your card issuer handles the fraud investigation and the replacement. If fraudulent charges do appear on your account, report them to your issuer — you are not responsible for them under federal law.

When merchants should and should not ask for your CVV

A legitimate merchant will ask for your CVV only when you are actively making a purchase online, by phone, or by mail. They will ask for it at the payment screen or during the call, right before you complete the transaction.

A legitimate merchant will never ask for your CVV by email, text, or social media. They will never call you out of the blue asking for it. They will never ask you to read it aloud to confirm your identity. If someone contacts you this way, it is a scam. Hang up or delete the message and contact your card issuer directly using the number on your card.

Some merchants ask if you want to save your CVV for future purchases. You can choose to do this, but it is not necessary. Saving it is convenient but slightly less secure than entering it each time. The choice is yours.

Frequently Asked Questions

Can someone use my card number without the CVV?

They can try, but most online merchants will decline the transaction if the CVV does not match. In-person purchases do not require a CVV at all — the chip or magnetic stripe handles that. So a thief with only your card number can make in-person purchases if they have a physical card, but remote purchases are much harder without the CVV.

Is it safe to save my CVV with online retailers?

Saving your CVV is convenient for repeat purchases, but it is slightly less secure than entering it each time. If that retailer's database is breached, your CVV could be exposed. Major retailers use encryption to protect saved payment information, but the risk is not zero. The choice depends on how much convenience matters to you versus how cautious you want to be.

What if I enter the wrong CVV?

The transaction will be declined. You can try again with the correct number. Most payment systems allow a few attempts before blocking further tries to prevent someone from guessing your CVV. If you keep entering it wrong, wait a few minutes and try again, or contact the merchant's customer service.

Do I need to memorize my CVV?

No. You only need to know where to find it on your card when you make a purchase. Do not write it down or store it anywhere. If you are making a purchase, look at the back of your card and enter the number at that moment. This is safer than keeping it written down or saved in your phone.

Can my CVV change?

It changes only when you get a new card. If your card is lost, stolen, or expired, your issuer sends you a replacement with a new card number and a new CVV. The CVV on your current card will never change on its own.