CVC is the three or four-digit security code on the back of your card

CVC stands for Card Verification Code. It is a short number printed on your card — usually three digits on the back, sometimes four on the front of American Express cards — that proves you physically have the card when you pay online or over the phone.

The code is not stored in the magnetic stripe or chip on your card. Banks print it separately so that if someone steals your card number, they cannot complete a purchase without also knowing this code. When you enter it during checkout, the merchant sends it to your bank to confirm the number matches what they have on file.

Different card companies call it by different names: Visa and Mastercard call it CVV (Card Verification Value), American Express calls it CID (Card Identification), and Discover calls it CID as well. For everyday purposes, all of these terms mean the same thing.

Key Takeaways

  • CVC is a three or four-digit code printed on your card that you enter when paying online or by phone to prove you have the physical card.
  • The code sits on the back of most cards (Visa, Mastercard, Discover) or the front right of American Express cards.
  • Never share your CVC with anyone except the merchant you are paying — your bank will never ask for it by email or phone.
  • Entering your CVC during online checkout adds a security layer because a thief with only your card number cannot complete the purchase without it.

Where to find your CVC on your card

On Visa, Mastercard, and Discover cards, flip the card over and look at the back. You will see a white or light-colored signature strip. To the right of that strip, usually in the top right corner, is a three-digit number. That is your CVC.

On American Express cards, the code is on the front of the card, printed above the card number on the right side. It is four digits long instead of three.

If your card is very old or worn, the number may be faded or hard to read. If you cannot see it clearly, contact your bank and they can read it to you over the phone or issue you a replacement card.

Why merchants ask for your CVC

When you shop in a store and swipe or insert your card, the merchant can verify you have the card in your hand. When you pay online or over the phone, they cannot see the physical card, so they ask for the CVC as proof. It is a straightforward way to catch fraud — if someone has stolen your card number but not the card itself, they will not know the CVC.

The merchant never stores your CVC after the transaction. Payment rules require them to delete it when ready after they confirm the code is correct. This means even if a hacker breaks into a store's computer system and steals card numbers, the CVC codes are not there to steal.

How to protect your CVC

Treat your CVC the same way you treat your PIN at an ATM — do not write it down, do not text it, and do not say it out loud where others can hear. The only time you should enter it is when you are paying a merchant you trust.

Your bank will never ask you for your CVC by email, text, or phone call. If someone contacts you claiming to be from your bank and asks for this code, it is a scam. Hang up or delete the message and call your bank directly using the number on the back of your card.

When you shop online, make sure the website address starts with "https://" (not just "http://") and look for a small padlock icon near the address bar. These signs mean the website encrypts your information as it travels from your computer to their server.

What happens if someone gets your CVC

If you believe someone has your CVC or has used it to make an unauthorized purchase, contact your bank right away. Most banks will cancel your card and issue a new one with a different CVC within a few business days. You are not responsible for fraudulent charges if you report them promptly.

Your bank can also review your recent transactions and dispute any charges you did not make. The dispute process usually takes 10 business days, though some banks resolve it faster.

CVC versus other card security features

Your card has several layers of protection. The CVC is one of them. Your card also has an expiration date, a chip (on newer cards), and a magnetic stripe (on older cards). Together, these features make it harder for someone to use a stolen card number.

Some online merchants also use a system called 3D find, which sends you a text or email asking you to confirm the purchase with a password or code. This adds another step beyond just entering your CVC. You may see this when paying for high-value items or when shopping with certain banks.

Frequently Asked Questions

Is it safe to enter my CVC on a website?

Yes, as long as the website is legitimate and uses encryption (look for "https://" and a padlock icon). The merchant will not store your CVC after the transaction, so it cannot be stolen from their system later. Only enter it on websites you trust and have visited before.

Can I use my card without knowing my CVC?

In a physical store, yes — you can swipe or insert your card without entering a code. Online or over the phone, most merchants require it. Some older payment systems may not ask for it, but most modern checkout pages do.

What if I forgot my CVC?

You can find it on the back of your card (or front if you have American Express). If your card is damaged and you cannot read the number, call your bank and they can tell you what it is or send you a replacement card.

Does my CVC change?

Your CVC stays the same for the life of the card. When your card expires and your bank sends you a new one, the new card will have a different CVC printed on it.

Can I pay online without a CVC?

Most online merchants require it, but some may not ask if you are a returning customer or if you are using a digital wallet like Apple Pay or Google Pay. These digital systems use different security methods instead of the CVC.