What is a CVV/CVC code?
The CVV (card verification value) is the three or four digit security code printed on a credit or debit card. It confirms that the person typing a card number holds the physical card. Card networks also label it CVC, CVV2, or CID, depending on the brand.
Where do I find the CVV on my card?
- Visa, Mastercard, and Discover: three digits on the back, to the right of the signature panel.
- American Express: four digits on the front, above the card number.
- Debit cards: layouts follow the network, so a debit Visa card uses the three digit back-of-card format.
Why does the CVV exist?
Card numbers leak in bulk during data breaches. A number on its own is not enough to complete an online order on most sites, because checkout also asks for the CVV. That single check blocks a large share of automated fraud attempts.
PCI DSS, the payment industry security standard, bars merchants from storing the CVV after a transaction is authorized. The card number may be kept if it is encrypted. The verification code may not be kept at all.
How do I protect my CVV when shopping online?
- Type the code only into a checkout page you opened from a bookmark or by typing the store address yourself.
- Keep it out of texts, email, and voice notes. No real store needs your code in a chat thread.
- Cover the back of the card when you hand it to a server or cashier.
- Use a virtual card number from your bank for subscriptions and unfamiliar shops.
- Turn on purchase alerts in your banking app so a charge you did not make shows up the same day.
What does a safe checkout page look like?
A real checkout page loads over HTTPS, shows a padlock in the address bar, and asks for the card number, expiry date, and CVV on one short form. The domain matches the store you meant to visit. Misspelled brand names, odd extensions, and requests for a photo of your card are red flags.
A payment processor handles the code, not the store staff. If a support agent asks for your full card number and CVV by email, that request is not valid.
Do virtual cards and tokenized checkouts change the picture?
A virtual card is a one-time or merchant-locked number issued by your bank, and it carries its own CVV. If that card leaks, the damage stays inside that card limit, and you can switch the number off in the app. Tokenization works the same way from the merchant side: the store keeps a token, not your code.
Both tools cut the street value of a stolen CVV, because the code stops working once the number behind it is retired.
What should I do if my card data is exposed?
- Freeze the card in your banking app. A freeze takes seconds and blocks new charges at once.
- Call the number on the back of the card and ask for a replacement with a new number and code.
- Read the last 60 days of statements, line by line.
- File a dispute for any charge you did not make. Under the Fair Credit Billing Act, credit card liability is capped at $50 for unauthorized use, and many issuers waive even that.
- Report identity theft at IdentityTheft.gov if anything beyond the card was taken.
Is buying or selling CVV data legal?
No. A card verification value belongs to the cardholder and the issuing bank, and trading it is fraud. In the US, selling stolen card data falls under wire fraud, access device fraud, and identity theft statutes, with prison terms attached. Sites that promise instant payment for CVV records are trafficking in stolen financial data, and buyers, sellers, and site operators all carry criminal exposure.
FAQ
Should I ever share my CVV over the phone?
Only with a merchant you called yourself, using the number from your own statement or the official site. Inbound calls that ask for the code follow a common scam pattern.
Can I shop online without a CVV?
Some subscriptions and digital wallets skip the code after the first purchase. You can also use a virtual card whose code you control. A shop that never asks for any verification is worth a second look.
Does the CVV change when I get a new card?
Yes. A replacement card ships with a new number and a new code, which is why reporting a lost card kills the old data.
Why do some sites ask for my CVV again on a saved card?
Because the store is not allowed to keep it. Asking again shows you still hold the card.
The short version
Treat the CVV like a debit card PIN. It proves possession, it should never sit in an inbox or a chat log, and a card freeze is the fastest response to any leak.
If a message offers cash for your card code, that is a fraud attempt aimed at you, and the same rules that protect you in a checkout line apply to that offer.