What Is a CVV Number and How to Keep It Safe

The CVV — card verification value — is the three-digit number printed on the back of most credit cards, and it exists specifically to prove you have physical possession of the card at the moment of an online transaction, not just its number.

What it's actually verifying

Unlike your card number, which is embossed and often visible or stored by multiple merchants over time, the CVV is not printed on receipts and, per card network rules, merchants are not supposed to store it after a transaction completes. That makes it a reasonable proxy for physical possession: if someone has your card number but not the physical card, they likely don't have the CVV either, which is why most online transactions require it.

Why merchants aren't supposed to save it

Storing a CVV after authorization violates PCI-DSS compliance rules that virtually all card networks enforce on merchants. If you ever notice a website or app that has your CVV pre-filled for a saved card, that's a red flag worth reporting or at minimum avoiding for future transactions — it means the CVV was stored somewhere it shouldn't have been.

Common mistakes that undermine it

Writing your CVV on a sticky note, photographing both sides of your card together, or sharing it over a phone call from someone claiming to be your bank are the most common ways people accidentally give away this protection. Legitimate bank representatives never need your CVV over a call — this is one of the most reliable tells of a fraud attempt.

CVV versus OTP

The CVV proves possession of the card at transaction time; the OTP sent to your registered mobile is a second, separate authentication factor confirming it's really you making the purchase. Together they form India's two-factor authentication requirement for most online card transactions. Our PIN vs OTP security guide breaks down how these different verification layers work together.

What to do if you suspect it's compromised

If you've entered your CVV on a suspicious site, or suspect it was captured through a skimming device or phishing attempt, the safest move is to block the card immediately through your issuer's app and request a replacement rather than waiting to see if fraud actually occurs. Our what to do when your card is lost or stolen guide covers the exact steps for this, and our credit card fraud protection tips piece has broader guidance on spotting risk before it becomes a loss.

The short version

Never share your CVV over a call or message, be wary of any site that has it pre-saved, and treat a suspected compromise as reason enough to block the card immediately rather than wait and see.