CVV
What is Card Verification Value?
Card Verification Value (CVV) is a security feature on credit and debit cards: a three- or four-digit code that businesses use to authenticate a card alongside the card number and expiration date when a purchase is made. It adds a layer of verification that the person paying has the physical card in hand.
The code is not stored in the card's magnetic stripe or chip, so it's used mainly in like . It confirms a card's validity and makes it harder to use stolen card numbers, protecting both and merchants.
Key facts
- A CVV is a three-digit code on Visa, Mastercard, and Discover cards, and a four-digit code on American Express cards.
- It is printed, not embossed, and is never encoded in the magnetic stripe or chip.
- It goes by several names depending on the network: CVV2, CVC2, CID, and CSC.
- It is used for most online and phone payments but not for in-person chip or contactless payments, where the card is read directly.
- Card scheme rules prohibit merchants and from storing the CVV once a payment is authorized.
Where the CVV is located, and what it's called
The code's name, length, and position on the card depend on the card .
| Network | Name | Digits | Location |
| Visa | CVV2 | 3 | Back, on the signature panel |
| Mastercard | CVC2 | 3 | Back, on the signature panel |
| Discover | CID | 3 | Back, on the signature panel |
| American Express | CID | 4 | Front, above the card number |
Static and dynamic CVV
Most cards carry a static CVV printed at issue that stays the same for the life of the card. If it's exposed in a data breach, the card stays vulnerable until it is reissued with a new code.
Some issuers offer a dynamic CVV that changes on a set schedule and is shown in a banking app or on a small display built into the card. Because each code is valid only for a short window, a stolen number becomes useless once the code rotates. Dynamic CVVs are still uncommon.
Why the CVV matters
Because the CVV is not stored in the stripe or chip and cannot be retained after authorization, it's hard for an attacker to obtain it from skimmed or database-breached card data. A transaction that includes the correct CVV is stronger evidence that the person paying is holding the genuine card.
For merchants, checking the CVV filters out fraud attempts that rely on a stolen card number alone. A CVV mismatch can be used as a signal to decline a payment or route it for extra review. On its own it doesn't prove a transaction is legitimate; it works alongside authentication and address verification checks.
