CVV & CVC Explained: What the Card Security Code Is
It is the little three-digit number on the back of your card that almost every online checkout asks for — and the one number you should never share in a message, email or phone call. This short code goes by many names: CVV, CVC, CVV2, CID, CVC2, CSC. They all refer to the same thing: the card security code. This guide explains exactly what it is, where to find it, why it keeps your card safer, and the common myths worth clearing up.
What the security code is
The card security code is a short number — three digits on most cards, four on American Express — that is printed, not embossed, onto the card. Its single job is to prove that whoever is making an online or phone payment is physically holding the card, not just quoting a number they found or guessed.
Crucially, the code is not stored in the magnetic stripe or the chip, and merchants are forbidden from saving it after a transaction. That is what makes it valuable: even a database breach that leaks card numbers and expiry dates usually does not leak security codes.
The many names for the same code
- CVV / CVV2 — Card Verification Value (Visa).
- CVC / CVC2 — Card Verification Code (Mastercard).
- CID — Card Identification Number (American Express and Discover).
- CSC — Card Security Code (the generic term).
The "2" versions (CVV2, CVC2) are the codes printed for online and phone use. There is also a "CVV1" encoded in the magnetic stripe for in-person swipes, but that is not the number you ever type in.
Where to find it
- Visa, Mastercard, Discover: a three-digit number on the back, in or beside the signature strip.
- American Express: a four-digit number on the front, printed above and to the right of the card number.
On newer minimalist and virtual cards the code may live only in your banking app rather than on a physical card.
Why the security code protects you
The security code is a cheap but effective defence against card-not-present fraud. Here is why it works:
- It proves possession. A fraudster who only has a leaked number and expiry date still cannot complete most online payments without the code.
- It cannot be stored. Payment rules (PCI DSS) ban merchants from keeping it, so it rarely appears in the breaches that expose other card data.
- It cannot be brute-forced easily. Banks lock a card after a few wrong attempts, so guessing a three-digit code before the card is frozen is impractical.
It is one layer in a stack that also includes the Luhn checksum, address verification (AVS) and 3-D Secure authentication.
CVV vs. the rest of the card number
It helps to see where the security code sits among the other numbers on a card:
| Part of the card | What it is | Where it lives |
|---|---|---|
| Card number (PAN) | 13–19 digits identifying the account | Front, embossed; also in chip/stripe |
| BIN / IIN | First 6–8 digits: scheme, bank, country | Start of the card number |
| Expiry date | When the card stops working | Front |
| Security code (CVV/CVC) | 3–4 digit possession check | Printed only; never stored |
You can inspect the public, non-sensitive part of a card — its scheme, issuing bank and country — by entering the first digits into our BIN Lookup, and check that a number is well-formed with the Card Validator. Neither ever needs your security code.
How to keep your CVV safe
- Never share it in a text, email, chat or phone call. No genuine bank will ask for it that way.
- Only type it into the payment page of a site you trust, over HTTPS.
- Be suspicious of any page that asks for your CVV outside of a real purchase — that is a classic phishing move.
- Use virtual or one-time cards for risky sites, so a leaked code is useless.
- Cover the back of your card in public and when sharing photos.
For developers: testing without real codes
If you build a checkout, never test with a real security code. Payment sandboxes publish test card numbers with matching dummy codes (for example, any 3-digit value for test Visa/Mastercard numbers, any 4-digit value for test Amex). A few rules:
- Validate the card number format and detect the scheme client-side before you collect the code.
- Send the security code straight to your PCI-compliant payment provider — never log it, never store it, never put it in your own database.
- Expect three digits for most schemes and four for American Express, and validate the length accordingly.
Frequently asked questions
Is the CVV the same as a PIN?
No. A PIN is a secret you choose and type at an ATM or card machine. The CVV is printed on the card and used for online and phone payments. You should protect both, but they are different numbers for different situations.
Why do some sites not ask for a CVV?
Recurring subscriptions and some "card on file" merchants are allowed to skip it after the first payment, because storing the CVV is banned — so they cannot ask again. Trusted wallets like Apple Pay and Google Pay also replace it with a secure token.
Can someone use my card with only the number and expiry date?
On many sites, no — the missing security code blocks the payment. But not every merchant enforces it, so a leaked number plus expiry is still worth reporting to your bank immediately.
Is it safe to type my CVV online?
Yes, on a legitimate checkout page over HTTPS. The danger is not typing it to pay — it is typing it anywhere you were not expecting to pay, which is almost always a scam.
What is a dynamic CVV?
Some banks issue cards (or app-based virtual cards) whose code changes every hour or on demand. A stolen code expires quickly, which makes the card far harder to abuse.
The bottom line
The CVV/CVC is a small number doing a big job: proving you hold the card and staying out of the databases that get breached. Treat it like a password — type it only to pay, never share it, and consider virtual cards for extra safety. If you are a developer, keep it out of your systems entirely and lean on sandbox test cards, the Card Validator and BIN Lookup for everything you can do without real data.
