At Experian, one of our priorities is consumer credit and finance education. This post may contain links and references to one or more of our partners, but we provide an objective view to help you make the best decisions. For more information, see our Editorial Policy.
In this article:
- What Is a CVV on a Credit Card?
- How Your CVV Protects You From Identity Theft
- The Bottom Line
When you make a purchase online or by phone, you're often asked to provide a credit card's CVV number. A CVV, or card verification value, may be a number you've typed out hundreds of times, but have you ever wondered what it is and why retailers ask for it?
A CVV is the three- or four-digit number on your card that adds an extra layer of security when making purchases online or over the phone. It serves to verify that you have a physical copy of the card in your possession and helps protect you if your card number falls into the hands of hackers and identity thieves.
What Is a CVV on a Credit Card?
A CVV is a number on your credit card or debit card that's in addition to your credit card number and expiration date (and it's not the same as your PIN). Different issuers have slightly different names and locations for them. The CVV for Visa, Mastercard and Discover credit cards is a three-digit number on the back of your card, to the right of the signature box. American Express uses a four-digit code, which they call the card identification number (CID). The American Express CID is on the front of the card above the account number.
When you present your card in person, you might be asked to show your ID or enter a PIN to verify the transaction. But it's not so easy to authenticate someone's identity for a purchase online or on the phone, so issuers started using these numbers as another barrier to fraud.
In transactions where the card isn't present, meaning online or on the phone, merchants often now ask for this number in addition to your credit card number and expiration date. It's not always required, but it helps ensure they're (most likely) getting payment from the legitimate cardholder.
If a thief is able to steal your credit card number and expiration date but doesn't have your CVV, they can't buy anything from merchants that require purchasers to provide a CVV.
How Your CVV Protects You From Identity Theft
CVVs add another layer of identity theft protection and can help prevent unauthorized transactions. While many major retailers store your credit card account number in their databases, your CVV or CID is not allowed to be stored after the card is authorized due to credit card compliance standards.
This means even if identity thieves hack into a merchant's system and steal your credit card number, or somehow otherwise access your credit card number, they may not be able to use your card information if they don't have the code when attempting an online or phone purchase.
Keep in mind that businesses are not currently required to request a CVV or CID code, and not all do. Moreover, some retailers will ask for it the first time you make a purchase to verify your identity, but then do not require it on subsequent purchases if you are logged in on their website as a customer.
It is also possible for identity thieves to use malicious software known as malware to steal your CVV or CID codes from retailers, or thieves could potentially obtain one from you in a phishing attempt if you're not careful. Plus, if someone steals your physical card, they will have access to it. Some financial institutions are experimenting with dynamic CVVs, or CVVs that change periodically, to make it even harder for thieves to make fraudulent purchases.
The Bottom Line
All credit cards and debit cards now have CVVs on them as a measure to help ward off fraudulent purchases made online or by phone. And while a CVV or CID code is harder to access than your card number, it doesn't guarantee protection. They certainly help, but they aren't foolproof, so it's still important to take steps to protect yourself. It's wise to use identity theft monitoring so you'll know right away if there's any unauthorized access to your accounts.
