The CVV2 is a three- or four-digit security code printed on the back of your card
The CVV2 (Card Verification Value 2) is a number you'll find on the back of your credit card, usually in the signature strip area. On Visa and Mastercard, it's three digits. On American Express, it's four digits and sits on the front. This code exists to verify that you physically possess the card when you're making a purchase — especially important for online and phone transactions where the merchant can't swipe or insert your card themselves.
The CVV2 is not the same as your card number or PIN. It's a separate piece of information generated by your card issuer using an encryption method, and it changes if you get a replacement card. The merchant never stores this number after the transaction completes, which is why you have to enter it every time you shop online.
Your card issuer uses the CVV2 to confirm that the person making the purchase actually has the physical card in hand. When you enter it during checkout, the merchant's payment processor sends it to your bank, which verifies it matches what they have on file. If it doesn't match, the transaction is declined.
Key Takeaways
- The CVV2 is a three- or four-digit code on the back of your card that proves you physically have the card when making online or phone purchases.
- Merchants are not allowed to store your CVV2 after a transaction, so you must enter it each time you shop online.
- Never share your CVV2 with anyone except the merchant you're actively paying, and never enter it on a website unless you initiated the transaction yourself.
- A CVV2 mismatch will cause your transaction to be declined, even if all your other card information is correct.
Why merchants ask for it during online and phone purchases
When you swipe or insert your card in person, the merchant's terminal reads your card's magnetic stripe or chip, which contains encrypted data that proves the card is real and in their possession. Online and phone transactions don't have that verification step — the merchant only has numbers you've typed or spoken. The CVV2 fills that gap by confirming you have the physical card.
Payment Card Industry (PCI) rules require merchants to request the CVV2 for card-not-present transactions. This reduces fraud because someone who has stolen your card number alone cannot complete an online purchase without also knowing the CVV2, which is not printed on receipts and is not stored in merchant databases.
What happens if you enter the wrong CVV2
If you mistype your CVV2, your transaction will be declined at checkout. Your bank will reject it because the code doesn't match their records. You can try again immediately — a single failed CVV2 entry doesn't lock your card or trigger a fraud alert, though multiple failed attempts in a short time may.
If you consistently enter the wrong CVV2, check that you're reading the correct digits from the back of your card. Some people accidentally include the last four digits of their card number, which sit near the CVV2 on Visa and Mastercard. The CVV2 is the separate three-digit group, usually to the right of the signature line.
How to protect your CVV2 from theft
Never enter your CVV2 on a website you didn't navigate to yourself. If you click a link in an email or text message claiming to be from your bank or a retailer, you're at risk of landing on a fake site designed to steal your information. Always type the website address directly into your browser or use a bookmark you created yourself.
Don't photograph your card or store images of it on your phone or computer. Don't write your CVV2 down or store it in an email, note app, or password manager. The only time you should have your CVV2 visible is when you're actively making a purchase and need to type it in.
When you receive a replacement card from your issuer, your old CVV2 becomes invalid. If your card was compromised, the new card's CVV2 will be different, which is one reason why card replacement stops most fraudulent activity even if the thief has your card number.
CVV2 versus other card security features
Your card has several layers of security, and the CVV2 is one of them. Your PIN (Personal Identification Number) is different — it's what you enter at an ATM or in-person at a store when you choose credit rather than debit. Your PIN is never requested online, and you should never share it with anyone.
Your card's chip (if your card has one) creates a unique encrypted code for each transaction, making it harder to clone than the older magnetic stripe. The chip is read when you insert your card in person, but it doesn't replace the CVV2 for online purchases.
3D Secure (also called Verified by Visa, Mastercard SecureCode, or American Express SafeKey) is an additional layer some merchants use. It requires you to enter a password or receive a code on your phone to confirm the purchase. This is separate from the CVV2 and adds extra verification for high-risk transactions.
What merchants can and cannot do with your CVV2
Merchants are forbidden by PCI compliance rules from storing your CVV2 after a transaction. If a retailer asks you to provide your CVV2 and then save it for future purchases, that's a red flag — they're violating payment card rules and putting your security at risk. Legitimate merchants use tokenization instead, which means they store a substitute code that cannot be used to make new charges without additional verification.
If you set up recurring charges (like a subscription or monthly bill), the merchant stores your card number but not your CVV2. When the charge runs, they don't need the CVV2 because the transaction is authorized by you in advance, not initiated by you at checkout each time.
If a data breach exposes merchant records, your CVV2 should not be in those records because it was never stored there. This is why a CVV2 mismatch can stop fraud even when your card number has been compromised — the thief has the number but not the code.
What to do if you think your CVV2 was compromised
If you believe someone has seen your CVV2 (for example, you entered it on a website you later realized was fake), contact your card issuer immediately. You can find the number on the back of your card or in your online account. Tell them you may have exposed your CVV2 and ask them to monitor your account for unauthorized charges.
Your issuer may issue you a replacement card with a new CVV2. This is a precaution — the old CVV2 becomes useless once the replacement arrives. You don't need to wait for fraud to occur; prevention is the point.
Review your recent transactions for any charges you don't recognize. Most card issuers allow you to dispute unauthorized charges within a set window (often 60 days), and you're typically not liable for fraudulent transactions if you report them promptly.
Frequently Asked Questions
Can someone use my card if they only have my card number and CVV2?
They can attempt an online purchase, but most merchants will also ask for your billing address and ZIP code. If the address doesn't match your issuer's records, the transaction will be declined. A thief with only your number and CVV2 can make some purchases, but the risk is lower than if they also had your address and name.
Why is my CVV2 different from my PIN?
Your PIN is a password you create and memorize for in-person ATM and debit transactions. Your CVV2 is a security code printed on your card by your issuer for online and phone purchases. They serve different purposes and are never interchangeable.
Do I need to enter my CVV2 at gas pumps or ATMs?
No. Gas pumps and ATMs read your card's chip or magnetic stripe directly. You enter your PIN at an ATM, but never your CVV2. If a machine asks for your CVV2, it's not a legitimate payment terminal.
What if I lost my card and someone finds it — can they use it online without the CVV2?
They can see your CVV2 on the back of the card, so yes, they could attempt online purchases. This is why you should report a lost or stolen card to your issuer immediately. They'll cancel it and issue a replacement with a new CVV2, stopping most fraudulent activity within hours.
Is it safe to give my CVV2 to a company over the phone?
Only if you initiated the call to a number you know is legitimate (not a number from an email or text). If a company called you unsolicited asking for your CVV2, hang up and call the company directly using a number from their official website or your statement. Legitimate businesses rarely call asking for your CVV2.