CVV2 is the three- or four-digit security code printed on your card, separate from your account number
CVV2 stands for Card Verification Value 2. It is a number printed on the back of your credit card (or sometimes the front, depending on the card type) that exists only in printed form — it is not encoded in the card's magnetic stripe or chip. The code is three digits for Visa, Mastercard, and Discover cards, and four digits for American Express cards (which prints it on the front).
The purpose of CVV2 is to verify that you physically possess the card when you make a purchase, especially for online or phone transactions where the merchant cannot see the card itself. When you enter the CVV2 during checkout, the merchant sends it to the card network for verification. The network checks whether the code matches the card on file. If it does not match, the transaction is declined.
CVV2 is different from the card's account number. Your account number identifies which account the charge goes to; CVV2 proves you have the physical card in your hands. This separation is intentional — if someone obtains your account number through a data breach, they cannot complete an online purchase without also having the CVV2.
Key Takeaways
- CVV2 is a three- or four-digit code printed on your card that merchants use to verify you possess the physical card during online or phone purchases.
- The code is not stored in the card's magnetic stripe or chip, so a stolen account number alone cannot be used to make online purchases without it.
- You should never share your CVV2 with anyone except a merchant during a legitimate transaction, and legitimate companies will never ask for it via email or phone.
- CVV2 is different from the card's expiration date and account number — all three pieces of information are required for most online transactions.
Where CVV2 appears on your card
For Visa, Mastercard, and Discover cards, the CVV2 is printed on the back of the card in the signature panel area, usually to the right of the signature line. It is the last three digits of a longer number printed there.
For American Express cards, the CVV2 (called CID on Amex cards) is four digits and appears on the front of the card, above the account number on the right side.
The code is printed in raised or flat text, depending on the card design, but it is never embossed like the account number. This makes it visually distinct and harder to read from a distance or photograph.
Why merchants ask for CVV2 during online purchases
When you enter your card information on a website, the merchant collects your account number, expiration date, and CVV2. The account number and expiration date are encoded in the card's magnetic stripe or chip, so a merchant could theoretically process a transaction with just those two pieces of information. The CVV2 is not encoded anywhere on the card — it exists only in printed form.
This means that if someone steals your card number from a data breach or a compromised website, they cannot complete an online purchase without also knowing the CVV2. They would need to either have the physical card or have seen it in person. Requiring CVV2 for online transactions shifts the risk slightly away from the merchant and toward the cardholder, because it proves the cardholder had the card at the time of purchase.
Some merchants, particularly those with recurring billing (subscriptions, memberships), store the CVV2 after the first transaction. This is not standard practice and carries additional risk — if that merchant's database is breached, the CVV2 is exposed. Many payment processors and card networks discourage storing CVV2 for this reason.
CVV2 versus other card security features
Your card has several security features, and it is important to understand what each one does:
| Feature | What it is | What it protects against |
|---|---|---|
| Account number | 16 digits (usually) that identify your specific account | Routes the charge to the correct account; does not verify possession |
| Expiration date | Month and year printed on the front | Prevents use of expired cards; does not verify possession |
| CVV2 | Three or four digits printed separately from the account number | Verifies you have the physical card for online and phone purchases |
| Chip (EMV) | Metallic square on the front that creates an encrypted transaction code | Prevents counterfeit cards and in-person fraud at chip-reading terminals |
| Magnetic stripe | Black stripe on the back with encoded card data | Allows swiping at terminals; less secure than chip |
CVV2 is specifically designed for remote transactions (online, phone, mail). The chip is designed for in-person transactions at a terminal. Neither one protects you if someone has your full card information and knows your PIN or billing address — that is why monitoring your account for unauthorized charges is important.
What to do if your CVV2 is compromised
If you believe your CVV2 has been exposed — for example, through a data breach at a merchant where you shopped — contact your card issuer immediately. You can find the phone number on the back of your card or on your statement.
Your issuer can issue you a new card with a new CVV2. The new card will have a different account number or the same account number with a new expiration date and CVV2, depending on your issuer's process. You will need to update your payment information anywhere you have stored the old card (subscription services, saved payment methods on websites, etc.).
In most cases, if fraudulent charges appear on your account after a breach, your issuer will reverse them under the card's fraud protection policy. You are not liable for unauthorized charges if you report them promptly. However, you should still change your CVV2 as soon as possible to prevent future unauthorized use.
Why you should never share your CVV2
You should only enter your CVV2 directly into a merchant's website or give it to a merchant over the phone when you initiate the transaction. You should never share it via email, text message, or social media, and no legitimate company will ask for it through those channels.
Scammers often pose as your card issuer or a merchant and ask for your CVV2 over the phone or email. If someone contacts you asking for this information, hang up or delete the message and call your card issuer directly using the number on your card or statement. Do not use a phone number provided by the person who contacted you.
If you have already shared your CVV2 with someone you do not trust, contact your card issuer right away. They can monitor your account for fraud and issue a replacement card if necessary.
Frequently Asked Questions
Can someone use my card online if they only have my account number and expiration date?
They can attempt a transaction, but most merchants will decline it if the CVV2 is missing or incorrect. Some older or less secure websites may not require CVV2, so there is still a risk. This is why monitoring your account regularly for unauthorized charges is important, even if you have not shared your CVV2.
Is CVV2 the same as the three-digit code on the back of my card?
Yes. CVV2 is the official name for the three-digit security code on the back of Visa, Mastercard, and Discover cards. American Express calls theirs CID, and it is four digits on the front. Both serve the same purpose.
Do I need to enter my CVV2 every time I use my card online?
Most merchants ask for it on every transaction. Some merchants with recurring billing (subscriptions) may store it after the first transaction, so you do not need to enter it again. This is less common and carries more risk if that merchant is breached.
What should I do if I see charges on my card that I did not make?
Contact your card issuer immediately using the number on your card or statement. Report the unauthorized charges and ask them to reverse them. You are not liable for fraudulent charges if you report them promptly, usually within 60 days of the statement date.
Can I change my CVV2 without getting a new card?
No. CVV2 is printed on the card itself and cannot be changed without issuing a new physical card. If you want a new CVV2, you must request a replacement card from your issuer. The new card will have a different CVV2 and possibly a different expiration date.