A CVC code is the three- or four-digit security number printed on your credit or debit card, used to verify you physically have the card when making purchases online or over the phone. You’ll encounter this code anytime a checkout page asks for it alongside your card number and expiration date.
CVC, CVV, CSC: Different Names, Same Thing
The abbreviation CVC stands for Card Verification Code, but you’ll see several other names for the exact same security feature depending on the card network or website. Visa calls it a CVV (Card Verification Value). Mastercard uses CVC. American Express calls it a CID (Card Identification Number). You might also see CVV2, CVC2, or simply “card security code” on checkout forms. They all refer to the same short number on your card, and they all serve the same purpose.
Where to Find It on Your Card
On Visa and Mastercard cards, the code is a three-digit number printed on the back of the card, typically near or to the right of the signature panel. It’s separate from your main card number and is usually printed in a slightly different font or style.
American Express cards work a bit differently. The code is four digits instead of three, and it’s printed on the front of the card, above and to the right of the main card number. The extra digit makes the code harder to guess, though it functions the same way at checkout.
How CVC Codes Prevent Fraud
Your card number and expiration date can be stolen in a data breach or skimmed from a receipt. The CVC code adds a second layer of verification for transactions where the merchant can’t see your card in person, like online orders or phone purchases. If someone has your card number but not the physical card, they won’t have the CVC code to complete the purchase.
This protection is reinforced by strict industry rules. Under PCI DSS (the security standard that governs how businesses handle card data), merchants are prohibited from storing your CVC code after a transaction is authorized. This rule applies even if you give a merchant explicit permission to save it, and even if they encrypt it. The code can only be used for the single transaction you’re completing, then it must be discarded. That’s why you have to re-enter your CVC code each time you buy something from a new site, and why legitimate subscription services and saved-card features never ask you to provide it again after the first purchase.
Why Some Transactions Don’t Require It
If you’ve saved your card with a retailer or set up a recurring subscription, you’ve probably noticed the site stops asking for your CVC after the initial purchase. That’s by design. Recurring and card-on-file transactions are processed using your card number and expiration date alone. Since the merchant verified your CVC during the original authorization, they don’t need it again, and they’re not allowed to store it for future use.
In-person purchases at physical stores also skip the CVC entirely. When you tap, swipe, or insert your card, the terminal reads data directly from the chip or magnetic stripe, which uses a different authentication method than the printed code.
Dynamic CVC Codes and Virtual Cards
Traditional CVC codes are static: the number printed on your card stays the same until the card expires. A newer approach uses dynamic codes that change periodically or generate fresh values for each transaction. Visa, for example, offers a feature called dCVV2 that lets cardholders request a temporary code through their bank’s mobile app. You enter that one-time code at checkout instead of the number printed on your card. Once the transaction is authorized, the code expires and can’t be reused.
Virtual cards take this a step further. When you use a digital wallet or your bank generates a virtual card number for an online purchase, it typically comes with its own CVC that’s separate from the one on your physical card. This means even if the virtual card details are compromised, your actual card remains protected.
Keeping Your CVC Code Safe
Since the CVC code is specifically designed to prove you have the card in hand, protecting it comes down to a few straightforward habits. Never share the code over email, text, or social media. Legitimate companies will only ask for it during a secure checkout process, not through a message or phone call they initiated. If someone contacts you claiming to be your bank and asks for your CVC, that’s a scam. Your bank already has the information it needs and will never request your security code.
Some cardholders memorize their CVC and then cover or obscure the printed number on the card itself. This way, even if the card is briefly out of your sight (handed to a server at a restaurant, for instance), no one can quickly copy the code. As long as you can recall the three or four digits, the card works exactly the same at terminals and ATMs, since those transactions don’t use the printed CVC.