A Card Verification Value, or CVV, is a short numeric security code printed directly on a payment card and used primarily in card-not-present transactions — online purchases, phone orders and mail-order transactions — specifically to help confirm that the person making the purchase actually has physical possession of the card itself, rather than merely knowing its printed account number from some other source.
Because the CVV is not stored on the card's magnetic stripe or chip data the way the card number itself is, and merchants are specifically prohibited from storing it after a transaction has been authorized, it provides a meaningful extra layer of protection against fraud committed using stolen card numbers alone, such as numbers harvested wholesale from a data breach elsewhere.
CVV in plain terms
Anyone who has physically handled a credit or debit card has likely noticed a short three- or four-digit code, usually printed on the back near the signature strip, kept entirely separate from the long card number embossed or printed on the front. Online checkout forms specifically ask for this code precisely because it is far less likely to have already leaked in a data breach than the card number itself, which travels through considerably more systems during ordinary processing.
A merchant asking for the CVV represents a basic, minimum-effort fraud check, not any kind of guarantee against fraud altogether — a stolen physical card, or one simply photographed in full by a thief, still exposes the CVV right along with everything else printed on it.
Where the CVV actually appears on a card
On Visa, Mastercard and most other major card networks, the CVV is a three-digit code printed on the back of the card near the signature panel. American Express instead prints a four-digit code on the front of the card, positioned directly above the main card number for easy reference.
CVV and PCI compliance requirements
Payment Card Industry Data Security Standard rules explicitly prohibit merchants and payment processors from storing a customer's CVV after a transaction has already been authorized, precisely because storing it defeats the entire purpose of using it as proof the cardholder genuinely had the physical card in hand at the exact moment of purchase.
Limitations of CVV as a standalone fraud control
A CVV check only ever verifies that whoever is actually transacting knows the specific code printed on the card, which does absolutely nothing to stop fraud committed by someone who has genuinely stolen or carefully photographed the physical card itself, which is precisely why issuers and merchants layer the CVV check alongside other complementary tools such as address verification and ongoing behavioral fraud scoring.
CVV requirements for stored and recurring payments
Many merchants that store a customer's card for future recurring billing, such as a subscription service, are permitted to validate the CVV only once at the time the card is first saved, since storing it for later reuse would itself violate PCI rules — which is one reason a subscription payment sometimes fails to flag an obviously stolen card the way a fresh, one-time CVV-checked purchase normally would.
CVV versus PIN as distinct security features
A CVV and a personal identification number serve genuinely different purposes despite both being short numeric codes associated with a card: the CVV specifically proves possession of the physical card for an online or phone purchase, while a PIN instead authenticates the cardholder's own identity at an ATM or a chip-and-PIN terminal, and a card's CVV is never the same code as its PIN under any card network's rules.
What to do if a CVV is compromised
If a cardholder suspects their CVV has been exposed, such as through a phishing message or a compromised retailer, the only reliable remedy is to have the issuer cancel the card and issue a new one with a freshly generated CVV, since a cardholder cannot simply change the existing code themselves the way they might change an online password after a similar exposure.