CVV / card security code.

In plain English

The card security code is a three or four digit number printed on a payment card, used to verify that whoever entered the card number is physically holding the card. It is calculated from the card number, the expiration date, and a bank key, so it cannot be worked out from the number alone. Card rules forbid merchants from storing it after authorization, which is why a website with your card saved still asks for it on some transactions. It does nothing for in-person chip or contactless payments, where the chip authenticates instead.

01Why it matters

Because merchants are not permitted to keep it, a database breach exposing card numbers usually does not expose the security codes, which is one reason stolen numbers are harder to use straight away.

02The math, step by step

Say a breach exposes 500,000 card numbers and expiration dates. Without the security codes, many online merchants decline those attempts. This is also why a caller who already knows your card number and asks only for the three digits is asking for the one piece they are missing.

Illustrative example. The amounts here are hypothetical, chosen to show how the math works, not real quoted rates or figures.

03What this is NOT

04Receipts

Every figure on this page is sourced to a primary document. Tap to open the original.