CVV2 is the three-digit security code on the back of your card
The CVV2 (Card Verification Value 2) is a three-digit number printed on the back of your credit card, usually in the signature panel on the right side. It exists to verify that you physically possess the card when you make an online or phone purchase — the merchant asks for it, you provide it, and the payment processor checks it against the card issuer's records to confirm the number matches.
The CVV2 is not stored in the card's magnetic stripe or chip. It lives only in the card issuer's database and on the physical card itself. This separation is deliberate: if a criminal steals your card number from a retailer's database, they cannot use it online without also having the CVV2, which they would not have unless they physically held the card or you told them.
Visa, Mastercard, American Express, and Discover all use CVV2 codes, though American Express calls theirs the CID (Card Identification Number) and prints it on the front of the card instead of the back.
Key Takeaways
- CVV2 is a three-digit code on the back of your credit card that merchants request during online and phone transactions to confirm you have the physical card.
- The code is not stored in your card's magnetic stripe or chip, so a stolen card number alone cannot be used online without it.
- You should never write down your CVV2, store it in your phone, or share it with anyone except the merchant during a legitimate transaction.
- If your card is lost or stolen, contact your card issuer immediately; the CVV2 on the old card becomes useless once a replacement is issued.
Why merchants ask for CVV2 during online and phone purchases
When you swipe or insert your card in person, the merchant's terminal reads the chip or magnetic stripe and confirms the card is real and not reported stolen. Online and phone transactions cannot read the chip or stripe, so merchants have no way to verify you physically have the card. The CVV2 fills that gap: you read it off the back of the card and provide it, which proves you are holding it.
The payment processor then sends the CVV2 to your card issuer, who checks it against their records. If it matches, the transaction moves forward. If it does not match — because the card number was stolen but the CVV2 was not — the transaction is declined. This is why a criminal with only your card number cannot complete an online purchase.
Merchants are not supposed to store the CVV2 after the transaction completes. Payment Card Industry (PCI) rules forbid it. If a merchant's database is breached, the CVV2 should not be in there to steal.
What happens if someone has your card number but not your CVV2
A stolen card number alone is nearly useless for online shopping. The criminal can attempt a purchase, but the merchant will ask for the CVV2. Without it, the transaction fails. The criminal could try to guess it — there are only 1,000 possible three-digit combinations — but most payment processors lock the card after a small number of failed attempts, and the card issuer is notified.
In-person fraud is a different story. A criminal with only your card number cannot make a purchase at a physical store, because the terminal reads the chip or stripe directly from the card itself. They would need the physical card.
Phone fraud is the real risk. If a criminal calls a merchant and provides your card number and CVV2, they can complete a purchase. This is why you should never give your CVV2 to anyone who calls you, even if they claim to be from your bank or the merchant. Your bank will never ask for your CVV2 over the phone.
How to protect your CVV2
Treat your CVV2 the same way you treat your PIN: as a secret that only you and your card issuer should know. Do not write it down, photograph it, or store it in your phone or email. Do not give it to anyone except a merchant during a legitimate transaction.
When you enter your CVV2 online, use a secure connection — look for the padlock icon in your browser's address bar and make sure the URL begins with "https://" rather than "http://". Public Wi-Fi is not secure enough for entering sensitive card information; use your home network or mobile data instead.
If you receive a call from someone claiming to be your bank or a merchant asking for your CVV2, hang up. Your bank will never ask for it. If you are unsure whether a call is legitimate, hang up and call the number on the back of your card or on your statement.
What to do if your card is lost or stolen
Contact your card issuer immediately — the phone number is on the back of your card or on your statement. Report the card as lost or stolen. The issuer will cancel it and issue a replacement with a new card number and a new CVV2.
Once the old card is cancelled, its CVV2 becomes useless. Even if a criminal has the old card number and CVV2, they cannot use them because the card issuer's system no longer recognizes that combination as valid. The replacement card arrives within 7 to 10 business days in most cases.
While you wait for the replacement, you can still make online purchases with a digital wallet (Apple Pay, Google Pay) if your card issuer supports it, or you can use a different card. You can also call the merchant and provide your card information over the phone if you trust the call is legitimate, though this is less secure than online entry.
CVV2 versus other card security features
Your credit card has multiple layers of fraud protection. The CVV2 is one of them. The chip (EMV) is another — it generates a unique code for each transaction, making it nearly impossible to counterfeit. The magnetic stripe is the oldest and least secure, which is why chip and contactless payments are preferred.
Your card issuer also monitors your account for unusual activity. If a transaction looks out of place — a purchase in a different state within an hour of your last purchase, or a large purchase you did not make — the issuer may decline it or call you to confirm. This is separate from CVV2 verification and catches fraud that slips through.
You are also protected by federal law. If someone uses your card without permission, you are liable for no more than $50 of fraudulent charges, and most card issuers waive even that if you report the fraud promptly. Report any unauthorized transaction to your card issuer as soon as you notice it.
Frequently Asked Questions
Can someone use my card number without the CVV2?
Not for online purchases. In-person transactions do not require the CVV2 because the terminal reads the chip or stripe directly. Phone transactions are the risk — if a criminal has both your number and CVV2, they can order by phone. This is why you should never give your CVV2 to anyone who calls you.
Is it safe to enter my CVV2 on a website?
Yes, if the website is legitimate and uses a secure connection (https://). The CVV2 is designed to be entered online. Never enter it on a public Wi-Fi network, and never enter it on a website that looks suspicious or that you did not navigate to yourself.
What if I accidentally shared my CVV2 with someone?
Contact your card issuer immediately and report the incident. They will monitor your account for fraudulent activity and may issue a replacement card with a new CVV2. If fraudulent charges appear, report them right away — you are protected by federal law and will not be held liable.
Does the CVV2 change if I use my card?
No. The CVV2 stays the same for the life of the card. It only changes when you receive a replacement card due to loss, theft, or expiration. The card issuer prints a new CVV2 on each replacement.
Why does American Express put the CVV2 on the front of the card?
American Express uses a four-digit code called the CID and prints it on the front for historical reasons related to how their card design evolved. The function is the same: it verifies you have the physical card during online and phone transactions. Treat it with the same security as a three-digit CVV2.