The CVN, or Card Verification Number, on a credit or debit card is the short security code printed on the card that merchants ask for during online, phone, and mail-order purchases. It’s three digits on the back of Visa, Mastercard, and Discover cards, and four digits on the front of American Express cards. Its job is to prove you actually have the card in your hand, not just a card number pulled from a data breach.
Where to Find the CVN on Your Card
The location and length depend on the network that issued your card. Each network uses its own name for the same code.
- Visa: three digits on the back, in or near the signature panel. Visa calls it a Card Verification Value (CVV2).
- Mastercard: three digits on the back, same area as Visa. Mastercard calls it a Card Validation Code (CVC2).
- Discover: three digits on the back, usually at the end of your account number near the signature strip.
- American Express: four digits on the front, printed above or near the account number. American Express calls it a Card Identification Number (CID).
On a Visa, Mastercard, or Discover card, flip the card over and look to the right of the signature panel for a standalone group of three digits.1Discover. What Is a CVV Number on a Credit Card On an American Express card, the four-digit CID is hot-stamped on the front face of the card.2American Express. Guide to Checking Card Faces
What the CVN Does
The CVN exists to fight card-not-present fraud, meaning any transaction where the merchant can’t physically inspect your card: online, phone, and mail orders.3Federal Reserve Bank of Kansas City. Card-Not-Present Fraud Rates in the United States After the Migration to Chip Cards A thief who has only your card number and expiration date from a leaked database still can’t complete most online purchases without the printed code.
The printed CVN is generated with a different algorithm than the verification value encoded on your card’s magnetic stripe. So a skimmer at a gas pump or ATM that copies stripe data doesn’t capture the printed code, and a retailer’s database breach shouldn’t contain it either, because merchants aren’t allowed to store it.
Why Merchants Can’t Keep Your CVN on File
The Payment Card Industry Data Security Standard (PCI DSS) treats the CVN as “sensitive authentication data.” Under PCI DSS Requirement 3.2, merchants must not store the code after a transaction is authorized, and must render it unrecoverable once authorization is complete.4PCI Security Standards Council. FAQ – Can Card Verification Codes/Values Be Stored for Card-on-File or Recurring Transactions Even encrypted storage is prohibited. Only card issuers, meaning your bank, may retain this data.
That rule explains something you’ve probably noticed. A subscription service asks for the CVN the first time you sign up but never again. The merchant replaces your card details with a token, a randomly generated stand-in, for future billing. The CVN is gone from their system the moment your first payment clears.
How to Protect Your CVN
The biggest risk isn’t a sophisticated attack. It’s handing the code to the wrong person or typing it on the wrong website. A few habits cover most of the exposure:
- Never share it proactively. Your bank will not call, email, or text you to ask for the CVN. Any unsolicited request for it is a scam.
- Check for HTTPS before entering card details. Look for the padlock and “https://” in the URL bar. Its absence guarantees the connection isn’t encrypted.
- Don’t read the code aloud in public. Phone orders in coffee shops and airports hand the number to anyone within earshot.
- Don’t photograph or write it down. Some security experts suggest covering the printed code with a small sticker or opaque tape once you have it memorized, so a casual glance or quick photo can’t capture it.
Virtual Card Numbers
Many issuers offer virtual card numbers that generate a temporary card number, expiration date, and CVN for online purchases. Your real card details stay in a digital vault, and the merchant sees only the disposable token. If a retailer gets breached, the stolen virtual number is useless: it can be deleted instantly or has already expired.5Chase. How Virtual Credit Card Numbers Protect Information Some virtual cards also let you set spending limits and expiration dates.
Dynamic CVNs
A newer option is the dynamic CVN, where the security code changes automatically every 12 to 24 hours. Some physical cards use a small battery-powered screen on the back; other issuers generate a fresh code inside their banking app that you enter at checkout.6National Cyber Security Centre. Insight – The Codes They’re A-Changin’ Stolen codes expire within hours. Adoption among U.S. issuers remains limited.
What to Do If Your CVN Is Compromised
Speed matters, and it matters more for debit cards than for credit cards because the federal liability rules are very different.
On a credit card, the Truth in Lending Act caps your maximum liability for unauthorized charges at $50, and even that only applies to charges made before you reported the card lost or stolen.7Office of the Law Revision Counsel. 15 U.S.C. 1643 – Liability of Holder of Credit Card Once you notify your issuer, you owe nothing for later charges. Most major issuers waive even the $50 through zero-liability policies.
Debit cards are riskier. The Electronic Fund Transfer Act uses a tiered system that rewards fast reporting:8Office of the Law Revision Counsel. 15 U.S.C. 1693g – Consumer Liability
- Report within two business days of learning about the theft: liability is capped at $50 or the amount of the unauthorized transfers, whichever is less.
- Report after two business days but within 60 days of your statement: liability can rise to $500.
- Fail to report within 60 days of your statement: unlimited liability for unauthorized transfers made after that 60-day window closes.
The 60-day clock starts when your bank sends the statement showing the unauthorized transaction, not when you open it.9Consumer Financial Protection Bureau. Regulation E Official Interpretations – Section 1005.6 Review debit statements regularly rather than letting them stack up.
If you suspect the card is compromised:
- Call your issuer using the number on the back of the card, or use the bank’s app, and ask them to block the card and send a replacement.10Office of the Comptroller of the Currency. Credit Card and Debit Card Fraud
- Dispute unauthorized charges. For credit cards, charges are typically reversed during the investigation. For debit cards, the money may already be gone, so acting fast limits the loss.
- Turn on transaction alerts. Real-time notifications let you catch fraud within seconds of a charge.
- Review recent statements for small test charges. Fraudsters often run a purchase under a dollar before attempting anything larger.
Replacement cards from most banks arrive within 5 to 10 business days and are usually free, though expedited delivery may cost extra. The new card will have a different CVN, so update any saved payment methods and subscriptions tied to the old one.