The CVC code on a credit card is the three- or four-digit security number printed on the card that a merchant asks for during online or phone purchases. Because the merchant can’t swipe or tap the card, entering that number is how you prove you physically have it in hand. It’s one of the simplest defenses against card-not-present fraud, which is projected to cost $28.1 billion by 2026.
Where to Find the Code
The location depends on who issued the card. On Visa, Mastercard, and Discover cards, the code is a three-digit number printed on the back, usually on or right next to the signature strip. American Express prints a four-digit code on the front of the card, above the account number.
Each network has its own name for the same thing. Visa calls it CVV2, Mastercard calls it CVC2, and American Express and Discover call theirs a CID. The naming is branding; the function is identical. If the digits on your card have worn off, your issuer can confirm the code by phone or through its app once you verify your identity.
What the Code Actually Does at Checkout
When you enter the CVC during an online purchase, it travels with your card number and expiration date to your bank, which checks it against the value on file. If it matches, the transaction is approved. If it doesn’t, the transaction is declined right there.
The code is not stored on the card’s magnetic stripe or chip. That gap is deliberate. A criminal who skims your card at a gas pump captures the number and, in some cases, the PIN, but not the CVC. Online merchants ask for it separately precisely because skimming can’t produce it.
Most checkouts pair the CVC check with the Address Verification System, which compares the billing address and zip code you type against what your bank has on file. If either check fails, the merchant can reject the purchase. If you’ve moved recently and haven’t updated your billing address, an AVS mismatch is the usual reason a legitimate purchase gets flagged.
CVC vs. PIN
These two numbers protect different kinds of transactions and shouldn’t be confused. Your PIN is a four- or six-digit number you choose, and you type it on a keypad at an ATM or in-person terminal. Your CVC is printed on the card and used only for remote purchases, where no keypad exists. The PIN stays the same until you change it. The CVC changes every time your card is reissued with a new expiration date.
Why Merchants Ask for It Every Time
If you’ve noticed that even a website with your card on file still asks for the CVC, that’s a rule with real teeth behind it. The Payment Card Industry Data Security Standard forbids any merchant or payment processor from storing your CVC after a transaction is authorized. They’re allowed to keep your card number for recurring billing, but the verification code has to be deleted once the charge goes through.1PCI Security Standards Council. PCI DSS Information Supplement: PCI DSS Tokenization Guidelines
The reason is practical. If a hacker breaches a merchant’s database and walks away with millions of card numbers, the missing CVCs make those numbers much harder to use for online fraud. Every new purchase requires the physical card or someone who knows its code. Merchants that break this rule face monthly fines from the card networks, and repeat violators can lose the ability to accept cards at all.
Digital Wallets Skip the CVC
Apple Pay, Google Pay, and similar wallets handle this differently. When you add a card, the app doesn’t store your real card number or CVC on the device. Your card is replaced with a randomized token, sometimes called a Device Account Number, that is unique to that device. Add the same card to your phone and your tablet, and each device gets a different token.2Visa. A Deep Dive into Tokenized Transactions
Each purchase then generates a one-time cryptogram that functions like a single-use CVC. If someone intercepts it, it’s already useless for any future charge. This is also how subscription services bill you every month without holding data they aren’t allowed to keep: they store the token, not the card.
What to Do If Your CVC Is Compromised
If unauthorized charges show up but your card is still in your wallet, someone probably obtained the number and CVC through a data breach, a phishing scam, or a compromised website. Act fast.
- Call your issuer using the number on the back of the card or through the bank’s app. Report the charges and request a replacement. A new card comes with a new number and a new CVC, which locks the thief out.3Office of the Comptroller of the Currency. Credit Card and Debit Card Fraud
- Place a fraud alert with one of the three credit bureaus (Equifax, Experian, or TransUnion). That bureau has to notify the other two. The alert lasts one year and makes it harder for someone to open new accounts in your name.3Office of the Comptroller of the Currency. Credit Card and Debit Card Fraud
- File a report with the FTC at IdentityTheft.gov, and, for online theft, with the FBI’s Internet Crime Complaint Center.3Office of the Comptroller of the Currency. Credit Card and Debit Card Fraud
What You Owe for Unauthorized Charges
Federal law limits your liability, but credit cards and debit cards are treated very differently.
Credit Cards
Under the Truth in Lending Act, the most you can owe for unauthorized credit card charges is $50. Once you notify your issuer that the card or number has been compromised, you owe nothing for anything charged after that point.4Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
In practice, most cardholders pay nothing. Visa’s zero-liability policy guarantees cardholders won’t be held responsible for unauthorized charges and requires issuers to replace stolen funds within five business days of notification.5Visa. Visa Zero Liability Policy Mastercard has a similar policy. These go further than the law requires, though they can be withheld for gross negligence or delayed reporting.
Debit Cards
Debit card protection under the Electronic Fund Transfer Act depends on how quickly you report:6Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Within 2 business days: your liability is capped at $50.
- Between 2 and 60 days: your liability rises to $500.
- After 60 days: you could be on the hook for the entire amount stolen.
Debit card fraud drains your actual bank balance rather than the bank’s money. Even when the bank refunds you, the missing cash can cause bounced payments and overdraft fees while you wait. If your debit card CVC is compromised, don’t wait to see whether more charges appear. Report it the same day.