CVV2 is the three- or four-digit security code printed on the back of your credit card
CVV2 stands for Card Verification Value 2. It is a number printed on your card — not encoded in the magnetic stripe or chip — that merchants use to confirm you physically have the card when you make an online or phone purchase. The card issuer (your bank or credit union) never needs to see this number; it is meant only for the merchant to verify.
On most cards, CVV2 is a three-digit code on the back, right after the signature panel. American Express cards print a four-digit code on the front, above the account number. The code changes only when you get a replacement card; the issuer does not regenerate it.
CVV2 is different from the magnetic stripe (the black band on the back) and the EMV chip (the metal square on the front). Those encode your account number and expiration date. CVV2 is printed separately so that if someone steals your card number online, they cannot use it without also having the physical card in hand.
Key Takeaways
- CVV2 is the three- or four-digit code on your card that merchants request during online and phone purchases to verify you have the card.
- The code is printed, not encoded, so it does not appear in your card's magnetic stripe or chip data.
- You should never share your CVV2 with anyone except the merchant you are paying at that moment.
- Legitimate merchants ask for CVV2 during checkout; your bank will never ask for it by email, phone, or text.
- Storing your CVV2 in a digital wallet or password manager is not secure — merchants are not allowed to store it after a transaction.
Why merchants ask for CVV2 during checkout
When you enter your card number, expiration date, and CVV2 online, the merchant sends that information to their payment processor. The processor forwards the CVV2 to your card issuer, who checks whether the code matches the card number on file. If it matches, the issuer signals approval; if it does not, the transaction is declined.
This step takes seconds and happens behind the scenes. The merchant never sees the result of the CVV2 check directly — they only know whether the transaction was approved or declined. The point is that someone who has stolen your card number (from a data breach, for example) cannot complete a purchase without also having the physical card to read the CVV2 from.
Phone orders work the same way. When you call a merchant and give them your card details, they type your CVV2 into their system, which sends it to the processor and issuer for verification. This is why legitimate customer service representatives will ask for CVV2 but will never ask you to read it aloud and repeat it back to them.
The difference between CVV2 and other card security features
Your card has several security layers, and they serve different purposes. The magnetic stripe contains your account number, expiration date, and cardholder name in a format that older card readers can process. It does not contain CVV2. The EMV chip (the metal square) contains encrypted data and generates a unique code for each transaction, making it harder to counterfeit than the stripe alone.
CVV2 is a static number — it never changes during your card's life — but it is printed rather than encoded. This means a merchant who processes your card in person (swiping or inserting the chip) does not need CVV2, because they have the card physically. CVV2 is specifically for remote transactions where the merchant cannot see or touch the card.
A PIN (personal identification number) is different again. You enter a PIN at an ATM or when you use your debit card at a store. A PIN is encrypted and known only to you and your issuer. CVV2 is printed on the card and visible to anyone who holds it, so it is not a substitute for a PIN and should not be treated as a secret password.
When you should and should not share your CVV2
Share your CVV2 only during a purchase you initiated with a merchant you trust. This means entering it on a retailer's website checkout page, giving it over the phone to a company you called, or providing it in person if you are handing your card to someone at a store (though most stores now use chip readers that do not require CVV2).
Never share your CVV2 in response to an unsolicited email, text, or phone call — even if the message appears to come from your bank. Your bank already has your card information on file and will never ask for CVV2 by email or phone. If you receive such a message, it is a phishing attempt. Do not respond, and report it to your card issuer immediately.
Do not store your CVV2 in a text file, email, or password manager. Merchants are legally prohibited from storing CVV2 after a transaction completes, so there is no reason for you to keep it written down. If you save it digitally, you create a single point of failure: if that device or account is compromised, someone has both your card number and the code needed to use it online.
What happens if someone uses your CVV2 without permission
If a fraudster has your card number and CVV2, they can make online and phone purchases in your name. However, they cannot use your card in person at a store, because they do not have the physical card. This is why CVV2 fraud is typically limited to remote transactions.
If you notice unauthorized charges, contact your card issuer immediately. Federal law (the Fair Credit Billing Act) limits your liability to $50 for unauthorized charges, and most card issuers waive even that if you report the fraud quickly. The issuer will investigate, reverse the fraudulent charges, and issue you a replacement card with a new CVV2.
Monitoring your statements regularly — at least monthly — is the fastest way to catch fraud. Many card issuers also offer text or email alerts when a charge exceeds a threshold you set, which can catch fraud within hours rather than weeks.
How to protect your CVV2
Treat your CVV2 the same way you treat your card number: keep it private and share it only during a transaction you initiated. Do not photograph your card or store images of it on your phone or computer. Do not write it down except on a receipt you plan to destroy immediately.
When you shop online, use a secure connection (the URL should start with "https://" and show a padlock icon). Avoid entering card details on public Wi-Fi networks, because data sent over unencrypted connections can be intercepted. If you are unsure whether a website is secure, do not enter your card information.
Some card issuers offer virtual card numbers — temporary account numbers that work for a single transaction or a limited time. These numbers are not your real card number, so if the merchant's system is breached, the stolen number cannot be used elsewhere. Check whether your issuer offers this feature; if so, use it for online purchases with merchants you do not know well.
Frequently Asked Questions
Is CVV2 the same as the security code on the back of my card?
Yes. CVV2 is the official name for the three- or four-digit security code printed on your card. Visa and Mastercard call it CVV2; American Express calls it CID (Card Identification). They all serve the same purpose: verifying you have the physical card during a remote transaction.
Can a merchant store my CVV2 after I make a purchase?
No. Payment Card Industry (PCI) rules prohibit merchants from storing CVV2 after a transaction completes. If a merchant asks you to save your CVV2 for future purchases, that is a red flag. Use a digital wallet or let the merchant store only your card number and expiration date, which they can use with a new CVV2 you provide each time.
What if I give my CVV2 to a scammer?
Contact your card issuer immediately and report the fraud. Your liability is limited to $50 under federal law, and most issuers waive that. The issuer will cancel your card, investigate the charges, and send you a replacement with a new CVV2. Monitor your statements for the next few months to catch any delayed fraudulent charges.
Do I need to enter CVV2 when I use my card in person at a store?
No. In-person transactions use either the magnetic stripe or the EMV chip, both of which are encoded on your card. The merchant does not need CVV2 because they can verify you have the physical card. CVV2 is only for online and phone purchases.
Why does American Express put the CVV2 on the front of the card?
American Express uses a four-digit code called CID instead of a three-digit CVV2, and prints it on the front above the account number. This is a design choice by American Express; Visa and Mastercard print their codes on the back. The function is identical: both verify you have the card during a remote transaction.