When you're buying something online or by phone, you'll often be asked for your credit card's CVV number, sometimes also called the card security code. CVV is short for card verification value, and it's a key security feature.
What is a credit card CVV?
The CVV is a three- or four-digit code that's printed on your credit card as a fraud-prevention measure. When you provide this number for an online or phone purchase, the merchant will submit the CVV when it authorizes the transaction. It's an attempt to verify that you have the physical card in your possession and that you're not just using stolen card information.
Where to find your credit card’s CVV
Visa, MasterCard and Discover cards have a three-digit CVV printed on the back of the card, usually next to the signature panel. Sometimes, you’ll also see the last four digits of your card’s account number listed along with the three-digit CVV; those four numbers appear before your CVV and don’t count as your CVV, so don't enter them when prompted online for your CVV.
American Express cards have a four-digit CVV located on the front of the card, just above and to the right of your account number.
For all four card networks, the CVV is printed on the card, rather than embossed in raised lettering.
The purpose of CVV numbers
The value of CVV numbers lies in how your credit card information is stored by merchants.
Merchants that handle credit card transactions are allowed to store your card data (with your permission) so you don't have to type it in again every time you buy something from the site. However, if your card information is stored, it has the potential to be stolen in one of the data breaches that have become common.
The CVV adds another layer of protection. Security standards in the payment industry prohibit merchants from storing CVV numbers. That way, even if a database is compromised, hackers still won’t have the CVV and won’t be able to use the stolen card numbers anywhere that requires the code.
This leads to the question of why sites that handle recurring payments — such as retailers like Amazon or subscription services like Netflix — can process payments on a stored credit card without you re-entering your CVV every time. These sites typically ask you for your CVV when you first use a card. From them on, they treat that card as valid for your account. But if your data is stolen, the CVV won't be included with it, so it will be of limited use elsewhere.
Why CVV isn't a fail-safe
As you’ve probably noticed, not all merchants require you to enter a CVV. Transactions can be authorized without it. A crook who has your card number and expiration date could use the information at such merchants.
Plus, there’s always phishing. A scammer may ask you for your credit number as well as your CVV, or might obtain your credit card account number and use that information to lure you into giving your CVV. Be sure to keep your personal data and account numbers safe from phishers, and learn to recognize the most common scams.