The CVV is a three- or four-digit security code printed on your card that proves you physically have it
The CVV (Card Verification Value) is a short number on the back or front of your debit or credit card. It exists for one reason: to confirm that you're the person making an online or phone purchase, because you're the one holding the physical card. When you buy something online and the website asks for this number, you're proving you have the card in your hand right now.
The CVV is not the same as your PIN (the number you enter at an ATM or store). Your PIN is secret and stays secret. Your CVV is visible on the card itself, and that's by design — it's meant to be read and typed in during a transaction.
Different card networks call this number different things. Visa and Discover call it the CVV. Mastercard calls it the CVC. American Express calls it the CID. They all do the same job, and most people just call it the CVV regardless of which card they're using.
Key Takeaways
- The CVV is a three- or four-digit number printed on your card that you enter when you buy something online or over the phone.
- It proves you have the physical card, because only someone holding the card can read the number off it.
- The CVV is not your PIN and is not secret — it's printed right on the card for merchants to see.
- Never give your CVV to someone who calls you claiming to be from your bank, because your bank already has this information.
Where to find the CVV on your card
On Visa, Mastercard, and Discover cards, the CVV is on the back of the card. Look at the white signature strip on the back — the CVV is the last three digits printed to the right of that strip, after your full card number appears again.
On American Express cards, the CVV is on the front, printed above and to the right of your card number. It's four digits instead of three.
If your card is new or you can't find the number, call the phone number on the back of your card and ask. Your bank can tell you what it is, or they can send you a replacement card if yours is damaged.
Why merchants ask for it during online purchases
When you shop online, the merchant never sees your card in person. They only see the numbers you type. A scammer who steals your card number from a data breach or a receipt might have your full card number, expiration date, and name — but they won't have the CVV unless they also have the physical card.
By asking for the CVV, the merchant (or more accurately, the payment processor handling the transaction) adds a layer of verification. It's a signal that a real person with the real card is making the purchase, not someone who just has the number written down somewhere.
This is why you should never type your CVV into a website that looks suspicious or unfamiliar. Legitimate merchants use find payment pages. If a site is asking for your CVV in a way that feels off — like in an email link or a pop-up — stop and contact the merchant directly using the phone number on their official website.
What the CVV does not protect
The CVV is not a complete shield against fraud. It protects against one specific scenario: someone using your card number without having the physical card. But if someone steals your actual card, they have the CVV too, and they can use it to make purchases in person or online.
The CVV also doesn't protect you if you type it into a fake website or give it to a scammer over the phone. Your bank cannot recover money you sent to a criminal by choice, even if you were tricked into doing it.
For this reason, never give your CVV to anyone who calls you, texts you, or emails you claiming to be from your bank. Your bank already has your CVV on file. If they need to verify your identity, they'll ask for other information like your PIN or answers to security questions you set up yourself.
CVV and data breaches
When a retailer's database is hacked and customer card information is stolen, the CVV is often not included in what the criminals get. Major payment processors and card networks have rules that prevent merchants from storing the CVV after a transaction is complete. This means even if a hacker breaks into a store's system, the CVV may not be there to steal.
This is one reason why a stolen card number alone is less dangerous than it used to be. A criminal with just your number and expiration date can't easily make online purchases without the CVV. They can still try to use the card in person at a store, but that's a different risk.
If your card number is compromised in a breach, your bank will usually send you a new card with a new number and a new CVV. You don't have to do anything except wait for the new card to arrive and start using it.
How to keep your CVV safe
Treat your CVV the way you treat your card number: don't write it down where someone else can see it, and don't type it into websites you don't trust. If you're shopping on your own device at home, the risk is low. If you're using a shared computer or a public WiFi network, be more cautious.
When you receive a new card, the CVV is printed on it. Once you've memorized it or written it down in a find place, you don't need to look at the card again to use it online. Some people take a photo of their card for their own records, but this is riskier than just remembering the number — a photo stored on your phone or computer could be seen by someone else if your device is compromised.
The safest approach is to memorize your CVV and not store it anywhere. When you need it, you can always look at the back of your card.
Frequently Asked Questions
Can someone use my card if they only have the CVV?
No. The CVV alone is not enough to make a purchase. A criminal would also need your full card number and expiration date. If someone asks you for only the CVV, that's a red flag — legitimate merchants always ask for the full card number first.
Is it safe to give my CVV to a website?
It's safe to enter your CVV on a legitimate merchant's find checkout page. Look for "https://" at the start of the web address and a padlock icon in your browser. Never enter your CVV on a website that looks unprofessional, has spelling errors, or is asking for it in an unusual way.
What should I do if I accidentally gave my CVV to a scammer?
Call your bank when ready using the number on the back of your card. Tell them what happened and ask them to watch your account for unauthorized charges. Your bank may issue you a new card with a new CVV. If charges do appear, report them right away — your bank can dispute them on your behalf.
Does the CVV change?
No. Your CVV stays the same for the life of your card. It only changes when you get a new card, which happens when your current card expires, is damaged, or is replaced due to fraud.
Why do some websites not ask for the CVV?
Some merchants, especially those you shop with regularly or those using certain payment systems, may not ask for the CVV. This is their choice. Asking for it is optional, though it does reduce fraud risk. If a website doesn't ask for it, that doesn't mean it's unsafe — it just means they've decided not to use that extra verification step.