What That 3-Digit Code on Your Credit Card Actually Does

The 3-digit code is called the CVV, and it's a security feature that proves you physically have the card

The three-digit number on the back of your credit card is called the CVV, which stands for Card Verification Value. Visa and Mastercard use this term. American Express calls theirs the CID (Card Identification Number), though it's four digits and sits on the front. The CVV exists for one reason: to confirm that you're holding the actual card when you make a purchase, not just using a card number someone gave you or found online.

When you swipe, insert, or tap your card in person, the merchant doesn't need the CVV—they can see the card themselves. But when you shop online or over the phone, the merchant can't verify you have the card. That's where the CVV comes in. You type it in, the payment processor checks it against what's stored in the card network's system, and if it matches, the transaction moves forward. If someone has only your card number but not the CVV, they can't complete most online purchases.

Key Takeaways

• The CVV is a three-digit security code on the back of Visa and Mastercard, or a four-digit code on the front of American Express cards.
• The CVV proves you physically possess the card when making online or phone purchases, since merchants can't see the card itself.
• Never share your CVV with anyone except the merchant you're paying directly, and never type it into a link someone sends you.
• The CVV is not the same as your PIN—your PIN is for ATM withdrawals and in-person debit card use, while the CVV is for remote purchases.

Where to find your CVV and what it looks like

On Visa and Mastercard, flip the card over and look at the back. On the right side of the signature strip, you'll see a three-digit number printed in a different color or font than the rest of the card. That's your CVV. It's not embossed or raised like your card number—it's printed flat on the surface.

American Express is different. The four-digit code appears on the front of the card, above your card number on the right side. Because American Express cards are less common in everyday use, many online forms still expect a three-digit code, so they may ask you to enter only the last three digits of the four-digit CID.

Why merchants ask for it during online checkout

When you enter your card details on a website, you're sending information through the internet. Your card number alone could theoretically be intercepted or stolen. The CVV adds a layer of verification that only someone holding the physical card would know. The merchant sends your CVV to the payment processor, who checks it against the card issuer's records without revealing the actual code to the merchant.

This system isn't perfect—data breaches happen, and sometimes merchants store CVVs when they shouldn't. But the CVV does stop a huge category of fraud: someone who finds a discarded receipt with your card number, or who buys stolen card numbers from a dark web marketplace, still can't use that card online without the CVV.

The difference between CVV and PIN

Many people confuse the CVV with a PIN, but they're completely separate. Your PIN (Personal Identification Number) is a four-digit code you create when you get a debit card. You use it at ATMs to withdraw cash and at checkout terminals when you choose "debit" instead of "credit." The PIN is stored in your bank's system and is never printed on the card.

The CVV is printed right on your credit card and never changes. You don't create it—the card issuer does. And you use it only for remote purchases (online, phone, or mail order), never at a physical store. If someone asks you for your PIN over the phone or online, that's a scam. Your bank and legitimate merchants will never ask for your PIN remotely.

What not to do with your CVV

Never share your CVV with anyone except the merchant you're actively paying. Don't type it into a link someone sends you in an email or text, even if the message looks like it's from your bank or a store you trust. Scammers create fake websites that look identical to real ones and use those links to steal CVVs.

Don't write your CVV down or store it in your phone. Don't give it to someone over the phone unless you called the merchant first and you're certain you're talking to a real employee. And don't take a photo of your card with the CVV visible—if your phone is hacked or stolen, someone could use that photo to make fraudulent purchases.

How payment processors verify the CVV without storing it

When you enter your CVV at checkout, the payment processor checks it against the card issuer's records in real time. The processor doesn't need to store your CVV—they just need to confirm it's correct. In fact, legitimate payment processors are not allowed to store your CVV after the transaction is complete. This is a requirement of the Payment Card Industry Data Security Standard, a set of rules that all merchants and payment companies must follow.

If a merchant stores your CVV, they're breaking the rules and exposing themselves to fines and legal liability. This is one reason why you should be cautious about which websites you trust with your card information. Established retailers with secure checkout systems are much safer than small or unfamiliar sites.

What happens if your CVV is compromised

If you believe someone has your CVV—because you entered it on a suspicious website, or because you received a call from someone claiming to be from your bank—contact your card issuer right away. You can find the number on the back of your card or on your statement. Tell them you may have shared your CVV and ask them to monitor your account for fraudulent charges.

You don't need to cancel your card just because your CVV might be exposed. Your card issuer can issue you a new card with a new CVV if they determine there's a real risk. In the meantime, they can flag your account for suspicious activity. If fraudulent charges do appear, report them immediately—federal law limits your liability for unauthorized charges to $50, and most card issuers waive that fee entirely.

Frequently Asked Questions

Can someone use my card number without the CVV?

They can try, but most online merchants will decline the transaction if the CVV doesn't match. In-person merchants don't ask for the CVV at all, so a stolen card number is more dangerous at a physical store than online. Some older or less secure websites may not verify the CVV, which is why those sites are riskier to use.

Is the CVV the same every time I use my card?

Yes. Your CVV never changes unless you get a replacement card. It's printed on the card itself and stays the same for the life of that card. When your card expires and you get a new one, the new card will have a different CVV.

Why does my American Express card have four digits instead of three?

American Express uses a different security system than Visa and Mastercard. Their four-digit code provides additional security. Most online forms still ask for three digits, so you would enter only the last three digits of your four-digit CID.

What if a website doesn't ask for my CVV?

Some websites, especially older ones or those with less secure systems, may not ask for the CVV. This is actually a red flag—it means the site isn't following current security standards. You can still use your card there, but the transaction is less protected. Stick with major retailers and well-known websites whenever possible.

Can I use my card without the CVV at a physical store?

Yes. In-person transactions don't require the CVV because the cashier can see your card and verify it's real. The CVV is only for remote purchases—online, phone, or mail order—where the merchant can't physically inspect the card.