A card verification value is the three- or four-digit code printed on your credit or debit card that proves you physically hold the card when you pay online or over the phone. On Visa, Mastercard, and Discover cards, it sits on the back, usually just to the right of the signature panel. American Express prints a four-digit version on the front, above the account number. Because the code is not stored on the magnetic stripe or in the chip, it acts as a separate check on transactions where no one can see or swipe your card.
Where to Find It on Your Card
Flip a Visa, Mastercard, or Discover card over. The code is the last three digits printed in the signature panel area. On some cards, you’ll see the final four digits of your account number followed by the three-digit code in that same strip. American Express is the outlier: look on the front of the card, above and to the right of the embossed account number, for a four-digit code.
The code is always flat-printed rather than raised. That’s deliberate. Flat printing keeps the number from being captured by carbon-copy imprint machines or a physical rubbing of the card face, an anti-fraud measure from an earlier era that still does its job.
Different Names for the Same Number
Checkout forms don’t all use the same label, which is where confusion starts. Visa calls it a card verification value (CVV). Mastercard uses card validation code (CVC). American Express labels it a card identification number (CID). Discover calls it card verification data (CVD). You may also see “security code” or “CSC.” They all mean the same thing, and they all want the number printed on your card.
The Three Versions Behind the Scenes
The printed code is only one of three security codes tied to your account. Each covers a different way of paying.
- CVV1 is encoded in the magnetic stripe. When you swipe, the terminal reads it automatically. You never see or type it.
- CVV2 is the printed code on the front or back of your card. This is the one you type during online and phone purchases. Because it lives only on the card surface, someone who copies your stripe data still doesn’t have it.
- CVV3 is a one-time code that a contactless chip generates fresh every time you tap. Each transaction gets its own value.
When people say “the CVV,” they almost always mean CVV2.
How the Code Verifies an Online Purchase
When you check out on a website or read your card number to someone on the phone, the merchant sends your card number, expiration date, and CVV through a payment gateway to the bank that issued your card. The bank compares the CVV you typed against the value on file for that card.
Match, and the transaction moves forward. No match, and the bank declines it, even if your account has plenty of available credit or cash. That pass-or-fail check is what stops someone who obtained your card number in a data breach but never touched the physical card.
Why Subscriptions Don’t Ask Every Time
Streaming services and other recurring billers charge you month after month without asking for your CVV again. Two rules make that work.
The first is a storage prohibition. The Payment Card Industry Data Security Standard (PCI DSS) forbids merchants from keeping your CVV after a transaction is authorized. The rule covers every kind of storage, including databases, log files, transaction histories, and temporary caches, and it applies even to encrypted copies. That’s why a site with your card number saved will still make you retype the CVV for a new purchase.
The second is tokenization. When you first hand over your card details for a subscription, the payment system swaps your real card number for a random string called a token and stores that instead. Future charges go through the token, which the payment processor can link back to your real account. If the merchant is breached, the stolen tokens can’t be reversed into working card numbers. Tokenization lets a business bill you every month without holding data it isn’t allowed to keep.
Dynamic Codes and Virtual Card Numbers
The traditional printed code has one obvious weakness: it never changes. Anyone who sees or photographs your card has a working code for the life of that card.
Some banks now let you generate a temporary CVV inside their mobile app. You open the app, get a time-limited code, and use it in place of the printed one for an online purchase. Because the code expires within minutes or hours, a stolen version stops working quickly, and the bank may not need to reissue the card at all after a breach.
Virtual card numbers go further. Many issuers let you spin up an entirely separate card number, with its own CVV and expiration date, tied to your account. You can lock it to one merchant, one purchase, or a specific expiration date. If that merchant is later breached, the exposed virtual number can’t be used anywhere else, and your real card number was never in play.
What You Owe if Your Code Is Stolen
Federal law caps your losses when someone makes unauthorized purchases with your card information, but the caps for credit cards and debit cards are very different. This is the part worth knowing before something goes wrong.
Credit Cards
Your legal liability for unauthorized credit card charges cannot exceed $50, and that ceiling only applies to charges made before you notify the card issuer. Once you report the problem, you owe nothing for anything charged after that point. Most major issuers voluntarily waive even the $50 with zero-liability policies, but $50 is the statutory maximum either way.
Debit Cards
Debit card liability turns on how fast you report the theft. The tiers are steep:
- Report within two business days of learning your card information was stolen, and your maximum liability is $50.
- Report after two business days but within 60 days of the bank sending the statement showing the unauthorized charges, and the ceiling rises to $500.
- Wait more than 60 days after that statement is sent, and your liability is unlimited for unauthorized transfers made after the 60-day window. The bank isn’t required to reimburse those later charges at all.
That gap is the reason a compromised debit card CVV can hurt far more than a compromised credit card CVV. Watching your statements and reporting unfamiliar charges within two business days keeps you inside the strongest protection the law offers.