What is a CVV?

If you’ve ever made a purchase online or over the phone, you’ve most likely been asked to provide your credit card’s security code for verification. This three- or four-digit card verification value, most often referred to as a CVV, is located on the front or back of your credit card. The purpose of providing the code is to prove that you actually have the physical card in hand, which is another step in card fraud prevention.

There are two types of CVVs on your credit and debit cards. The CVV1 is embedded on your card’s magnetic strip, which is read by a merchant’s point-of-sale terminal, and the CVV printed on your card is for card-not-present purchases. 

What is a CVV number?

The CVV debuted in late 1990s and early 2000s to combat card-not-present fraud during the rapid rise of online shopping. 

Initially, it was an 11-digit number, but was then quickly reduced to an easier three to four digit code. Mastercard was one of the first companies to use CVVs on credit and debit cards in 1997, followed by American Express in 1999 and Visa in 2001.

Visa, Mastercard and Discover cards all have three-digit CVVs, while American Express cards have four-digit CVVs.

What makes the CVV so beneficial is that card payment industry regulations stipulate that CVVs cannot be stored in a payment system database once a payment is processed. So, if a company’s payment database is breached by criminals, the payment data information becomes much less valuable to thieves without those CVV codes. Plus, this type of security also protects full card data from being used illegally by online merchants or employees.

CVV is a universal term that refers to your card’s three- or four-digit code, but different card issuers refer to them using varying acronyms:

NAME	DEFINITION	ISSUER
CVV2	Card Verification Value Code	Visa
CVC	Card Validation Code	Mastercard
CID	Card Identification Code	Discover
CVV	Card Valuation Value	American Express
CID	Card Identification Code	Debit cards

See MoreSee Less

How CVVs are generated

The card issuing bank uses a specific algorithm when creating CVVs that employs a combination of your card’s account number, expiration date, data encryption standard keys and a three-number service code. The exact algorithm banks use isn’t public knowledge for security reasons. 

How to find the CVV on your credit card 

If you have a Visa, Mastercard or Discover card, you’ll find the three-digit CVV code printed near or on the signature strip on the back of the card.

For American Express cards, the four-digit CVV code can be found on the front of the credit card near or on top of the 15-digit card number.

What is a CVV used for? 

A CVV is an added security layer to protect against fraud when making purchases over the phone or online. You’ll typically be asked to not only provide your name, card number and expiration date for a card-not-present transaction, but also your card’s CVV number. Without offering up your CVV number, your purchase will most likely not be processed.

When you use your credit or debit card when shopping in person, a different CVV1 code is embedded in your card’s magnetic strip if you have to swipe your card to complete a purchase. That number doesn’t change unless you get a new or replacement card.

If your card has an EMV chip, a unique security code called iCVV (integrated circuit card verification value) is embedded within the chip. The iCVV code is encrypted, making it more difficult for card skimmers to gather the information.

The codes contained within the EMV chip and the magnetic strip are different from the three- or four-digit code printed on the card, giving the cardholder an extra layer of security against card counterfeiters, data breaches and card skimming.

However, all that security won’t help if your physical card is stolen as the thief has access to all the information needed to make fraudulent purchases, which is why you need to report a stolen card right away. Your old card will be replaced with a new card with a new CVV, a new credit card number and expiration date.

Your CVV should not be confused with your card’s personal identification number or PIN. For one, a debit cardholder typically creates their own PIN after receiving a temporary PIN from the issuer, which is a four-digit number used to verify debit card transactions. Credit card PINs are only used when you need to make a cash withdrawal from an ATM — called a cash advance.

Thieves are clever, but you can be smarter. Here’s how to spot a credit card skimmer

How to protect your CVV 

While not completely foolproof, your card’s CVV protects you and should be shielded from prying eyes.

Typically, a card-not-present transaction will be rejected if a CVV code is incorrectly inputted several times. And just know that your card’s CVV is not required for subsequent transactions for recurring subscription services or other repeating purchases.

Here are some tips to protect your CVV:

• Don’t randomly share your card’s CVV and keep your physical cards away from prying eyes.
• Only use secure websites (that have https in the URL instead of just http) when making a purchase online.
• Don’t write down your CVV number.
• When dining out, ask for options to pay with your card at the table or through a phone app.
• Don’t provide your CVV to suspicious callers saying they’re from your bank or favorite merchant.
• If your physical card is lost or stolen, notify the issuer immediately.
• Review your card statements carefully every month to detect and report any fraudulent transactions.

Frequently asked questions (FAQs)