A CVV (card verification value) is the 3-digit code printed on the back of most credit cards, or the 4-digit code on the front of American Express cards. It exists to prove the person paying holds the physical card. Honest merchants never ask you to send it by email, text, or chat, and no legitimate business sells CVV numbers.
What Is a CVV/CVC Code and Why Does It Matter?
Card networks added the CVV to stop a specific problem: someone copying a card number from a receipt or database and using it without the plastic. The code sits on the card only. It is not embossed, not in the magnetic stripe, and not part of the account number.
That single detail is why the code carries so much weight. A thief with a card number can try a purchase, but most online merchants require the CVV too. Stealing it takes a second step, which is where the risk shifts to you.
CVV, CVC, CVV2, and CVC2: same idea, different labels
- CVV / CVV2 — Visa's name for the code.
- CVC / CVC2 — Mastercard's name for the same thing.
- CID — American Express, 4 digits, printed on the front.
- CVV1 — a different value encoded in the magnetic stripe. You never see it.
How Do Criminals Get CVV Codes?
Most card data theft comes from three places: skimmers on gas pumps and ATMs, data breaches at merchants, and phishing pages that copy a checkout form. A fourth route is simple shoulder surfing, where someone photographs your card while you pay.
Stolen numbers and codes get bundled into bulk files and resold. That market runs on volume and speed, which means the window between a leak and a fraudulent charge is often hours, not weeks.
How Do You Protect Your CVV When Buying Online?
Treat the code like a password you can never change. These habits cut your exposure without much effort.
- Shop with merchants you can verify. Check the domain spelling, look for a real business address, and read reviews off-site.
- Use a virtual card number. Many issuers generate a one-time or merchant-locked number with its own CVV.
- Pay with a wallet or tokenized checkout. Apple Pay, Google Pay, and PayPal pass a token instead of your real code.
- Never type your CVV into a link from an email or text. Open the merchant's site yourself.
- Turn on transaction alerts for every charge over a low threshold.
- Lock your card in the issuer app when you are not using it.
- Cover the card in public. Skimming and photographing both need a clear view.
- Avoid saved cards on shared or public devices. Browser autofill stores the number and code.
Is it safe to give your CVV over the phone?
Only if you placed the call and you know the business. Inbound calls asking for your code are a standard phone scam. Hang up and call the number on the back of your card.
Do merchants store your CVV after a purchase?
PCI DSS, the payment card industry data security standard, forbids storing the card verification code after a transaction is authorized. If a support agent reads your old CVV back to you, that is a red flag about their systems.
Are "CVV Shops" and Instant CVV Sellers Legal?
No. A site selling CVV numbers is selling access to accounts that belong to other people. Buying from one is not a gray area. In the United States it falls under wire fraud, access device fraud, and identity theft statutes, and each charge can carry prison time and fines.
There is also a practical trap. Sellers in that market take payment up front and deliver nothing, because the buyer has no recourse and no way to complain. Buyers lose money to the seller and still face liability if the data is used.
What Are the Warning Signs Your Card Data Is Being Sold?
- A charge of a few cents or dollars you do not recognize. Thieves test cards with small amounts first.
- A card replacement arriving that you did not request.
- Denied transactions on a card that should have room.
- Password reset emails for shopping accounts you did not trigger.
- A credit report entry for a store card you never opened.
What Should You Do If Your CVV Is Compromised?
- Freeze the card in your issuer's app, or call the number on the back and close it.
- Dispute every charge you do not recognize. Federal law caps your liability for unauthorized card use, but only if you report it.
- Change passwords on shopping and email accounts, starting with the email account itself.
- Report the theft at IdentityTheft.gov and file a complaint with the FBI's Internet Crime Complaint Center.
- Pull your credit reports and place a fraud alert or freeze.
FAQ
Does the CVV change if I get a new card?
Yes. A replacement card arrives with a new number and a new code. Virtual card numbers can rotate their CVV on every transaction if you set them that way.
Can I shop online without a CVV?
Some merchants skip the code and rely on other checks. That usually means more friction elsewhere, such as a one-time passcode sent to your phone.
Is a CVV the same as a PIN?
No. A PIN authorizes a debit transaction at a terminal or ATM. A CVV verifies the physical card for a card-not-present purchase.
What is the safest way to pay online?
A tokenized wallet or a virtual card number. Both keep your real code out of the merchant's system, so a breach there cannot expose it.