Short answer: keep your CVV safe by typing it only into a checkout page you reached by navigating to the merchant yourself, never into an email, chat, text message, or phone call. A card verification value is proof that the physical card is in hand, so any request to send it through a message channel is a red flag, not a convenience.
What the CVV actually protects
The three or four digit code on your card is not a password and it is not a second PIN. It exists so that a merchant can show the card was present at the moment of the transaction. Card network rules require merchants to discard the CVV once a charge is authorized, which means a store that offers to keep it on file for next time is either misconfigured or not telling you the whole story.
That single fact explains most of the advice below. Your CVV has value to a criminal precisely because it is short lived in a legitimate system. Anyone who wants to hold onto it, repeat it, or move it into another channel is working against the design of the payment network.
Advice first: habits that protect your CVV
- Start at the merchant, not at the offer. Type the store address yourself or use a bookmark you saved earlier. Links that arrive in messages can lead to a lookalike checkout.
- Treat messaging apps as off limits for card data. No legitimate seller needs the CVV in a chat thread. If a seller pushes you there to "confirm the order," stop.
- Prefer a virtual or single use card number from your issuer when a site is new to you. The CVV is tied to that number, so exposure stays contained.
- Pay inside an app or wallet when possible. Tokenized payments pass a substitute number to the merchant, so the merchant never sees your real CVV.
- Keep your card details out of notes, screenshots, and cloud documents. Photos of cards are a common source of leaked card data.
Parameters to check before you type the CVV
- Connection: the checkout page uses HTTPS and the address bar shows the store domain you expected, with no extra words or misspellings before it.
- Checkout path: the payment form sits inside the merchant's own domain or a recognized payment processor, not on a separate page reached by a redirect.
- Fields requested: name, card number, expiry, CVV, billing address. A form that also asks for your PIN, your banking login, or a photo of the card is collecting more than it needs.
- Storage claims: the site should not advertise that it saves your security code. Saved card numbers via a processor are normal; saved CVVs are not.
- Contact route: a real support channel, a published business address, and a return policy you can read before paying.
- Price sanity: discounts far below market on in demand goods are a lure, and the checkout that follows often exists to harvest card data.
Pitfalls that expose card data
- Entering the CVV on a page that was opened from an unsolicited text about a "failed delivery" or "held payment."
- Reading the CVV aloud to a caller who says they are confirming a charge. Banks do not ask for it outbound.
- Reusing one card across unfamiliar sites because it is already memorized. One compromised merchant affects every later purchase.
- Ignoring small test charges. A tiny authorization you do not recognize can be someone validating your card number and code.
- Leaving a browser to autofill card fields on a shared or public device.
If your CVV or card number is exposed
Contact your card issuer using the number on the back of the card, not a number from the message that reached you. Ask for the card to be blocked and replaced, then review recent transactions line by line. In the United States, federal law limits your liability for unauthorized credit card charges, and disputing early keeps the process simple. Report the incident to the FTC as well, since pattern reports help regulators trace the operation that targeted you.
The bottom line
There is no legitimate shop where you buy card verification values, and no trusted vendor sells them. The only safe place for your CVV is a checkout you reached on your own, on a connection you trust, with a card you can replace if something goes wrong.