What a PIN and a CVV are (and why they matter)

Cards come with two secret numbers, and beginners often mix them up: the PIN and the CVV. They both exist to prove that the person using the card is really you, but they guard against different kinds of theft. Knowing which is which — and how to protect each one — is a small skill that prevents real headaches.

The PIN: your in-person password

PIN stands for Personal Identification Number. It's the four-digit code you type into a keypad when you use your card in the physical world — at an ATM, or when you choose 'debit' at a store checkout. Its whole job is to protect you when the card is in someone's hands. If a thief steals your physical card, they still can't pull cash from an ATM without your PIN. It's the lock on the card itself.

• You choose your PIN (and can usually change it) — it isn't printed anywhere on the card.
• It's used for in-person, physical transactions: ATMs and PIN-debit purchases.
• Never use an obvious one: '1234,' '0000,' or your birth year are the first things a thief tries.
• Never write it on the card or store it in your wallet with the card.

The CVV: your online proof-of-possession

CVV stands for Card Verification Value — the three-digit number printed on the back of most cards (four digits on the front for some). Its job is the opposite of the PIN's: it protects you when the card is NOT physically present, like when you shop online or over the phone. Because the CVV is printed on the card and not stored on the magnetic stripe, a website asking for it is really asking, 'Do you actually have the physical card in your hand right now?' A thief who only skimmed your card number off a stripe wouldn't have it.

• You don't choose the CVV — it's assigned and printed on the card.
• It's used for online and phone purchases (called 'card-not-present' transactions).
• Legitimate merchants ask for it at checkout, but they're not supposed to store it after the sale.
• If a website or caller asks you to 'confirm' your CVV out of the blue, it's almost certainly a scam.

How to keep both safe

• Cover the keypad with your hand whenever you type your PIN — cameras and shoulder-surfers are real.
• Only enter your CVV on trusted websites you navigated to yourself, never from a link in an email or text.
• Your bank will never phone you and ask for your PIN or CVV. Anyone who does is a fraudster, full stop.
• If you shop online a lot, consider using your phone's wallet or a credit card, which shield your real numbers behind one-time codes.
• Some newer cards hide the number and CVV entirely, showing them only in the bank's app — a nice extra layer if yours offers it.

The bottom line

Your PIN and your CVV are two secret numbers guarding two different doors: the PIN locks your card for in-person use like ATMs, and the CVV proves you hold the card when shopping remotely. You pick and can change your PIN; the CVV is printed and fixed. Treat both like passwords — cover the keypad, only type the CVV on sites you trust, and remember that no real bank will ever ask you to recite either one.