CVV2 is the three-digit security code on the back of your credit card

CVV2 stands for Card Verification Value 2. It is a three-digit number printed on the back of your credit card, usually located in or near the signature panel. The digits appear after your card number and are not embossed into the plastic the way your account number is — they are printed on the surface only.

The purpose of CVV2 is to verify that you physically possess the card when you make a purchase. When you enter this code during an online or phone transaction, the merchant sends it to your card issuer, who checks whether the number matches their records. If it does not match, the transaction is declined. This protects you and the merchant from fraud, because someone who has only your card number — from a data breach or a stolen receipt — cannot complete a purchase without the CVV2.

CVV2 is different from the older CVV (Card Verification Value), which was used in earlier card systems. The "2" indicates the current version. You will see the terms used interchangeably, but they refer to the same three-digit code on your card.

Key Takeaways

  • CVV2 is the three-digit security code printed on the back of your credit card, separate from your account number.
  • You must provide CVV2 when making online or phone purchases, but never when swiping or inserting your card in person.
  • CVV2 is not stored in the magnetic stripe or chip on your card, so a stolen card number alone cannot be used without it.
  • Never share your CVV2 with anyone except the merchant you are paying, and never enter it on a website unless you initiated the transaction yourself.

Where CVV2 appears on different card types

On Visa, Mastercard, and Discover cards, the CVV2 is a three-digit number printed on the back of the card, to the right of the signature panel. The digits are in a separate box or printed directly on the card surface.

American Express cards are different. The CVV2 on an Amex card is a four-digit number printed on the front of the card, above the account number on the right side. This four-digit code is sometimes called the CID (Card Identification Number) instead of CVV2, but it serves the same purpose.

The location matters because it confirms you have the physical card in your hand. A merchant or website asking for CVV2 is asking for something that cannot be read from a receipt, a statement, or a stolen card number alone.

When you need to provide CVV2

You provide CVV2 during card-not-present transactions — purchases where the merchant cannot see or swipe your card. This includes online shopping, phone orders, and mail orders. When you enter your card details on a website checkout page, you will see a field labeled "CVV," "CVV2," "Security Code," or "Card Code." That is where you enter the three digits from the back of your card.

You do not provide CVV2 when you swipe your card at a gas pump, insert it into a chip reader at a store, or hand it to a cashier in person. The card itself proves you have it. Some in-person terminals may ask for your zip code instead, which serves a similar verification purpose.

Recurring payments — subscriptions, automatic bill payments, or saved payment methods — may store your CVV2 after the first transaction, so you do not have to enter it every time. However, if your card is replaced or expires, you will need to provide the new CVV2 for those recurring charges to continue.

How CVV2 protects you from fraud

CVV2 is a fraud prevention tool that works in both directions. It protects you because someone who obtains your card number through a data breach or by photographing a receipt cannot use it to make online purchases without the CVV2. It protects merchants because they can verify that the person making the purchase has the physical card.

When you enter CVV2 during checkout, the merchant does not store it. Payment processors and card networks are required by law to delete CVV2 immediately after the transaction is authorized. This means that even if a merchant's database is breached, the CVV2 is not there to steal. Your card number might be compromised, but the CVV2 remains secure in your possession.

This is why you should never enter your CVV2 on a website you did not navigate to yourself, and never provide it in response to an email or text message. Legitimate merchants will never ask for CVV2 outside of the checkout process, and your card issuer will never ask for it at all.

What happens if your CVV2 is compromised

If someone obtains both your card number and your CVV2 — for example, through a data breach at a merchant or a phishing email — they can make online purchases with your card. However, this is less common than card-number-only fraud because CVV2 is harder to steal. It is not stored in databases the way account numbers are, and it is not printed on receipts.

If you notice unauthorized charges on your statement, contact your card issuer immediately. Most issuers offer fraud protection that limits your liability to $50 or $0, depending on your card and when you report the fraud. Your issuer will investigate the charge, and if it is confirmed as fraudulent, they will reverse it and issue you a new card with a new CVV2.

You do not need to change your CVV2 yourself. When your card is replaced — whether due to fraud, expiration, or damage — the issuer sends you a new card with a new number, new expiration date, and new CVV2. The old CVV2 becomes useless because it no longer matches the card number.

CVV2 and your account security

CVV2 is one layer of security, not the only one. It prevents someone with your card number from making online purchases, but it does not protect against someone who has your full card details including the CVV2. That is why you should treat your CVV2 the same way you treat your card number: keep it private and never share it except during a transaction you initiated.

If you save your card to a website for future purchases — for example, on Amazon or your utility company's payment portal — that site may ask you to enter your CVV2 again when you update your payment method or when a significant time has passed. This is normal and is another security measure to confirm you still have the card.

Your card issuer's online portal or mobile app will never display your full CVV2. You may see the last four digits of your card number, but the CVV2 will not appear anywhere in your account. If a website or app shows you your CVV2, it is not legitimate.

CVV2 versus other card security features

CVV2 works alongside other security features to protect your card. Your card number identifies your account. Your expiration date confirms the card is still valid. Your cardholder name matches the person using the card. Your CVV2 confirms you have the physical card. Together, these pieces of information are required to complete most online transactions.

Chip technology (EMV) added another layer by making it harder to counterfeit cards in person. Contactless payments and mobile wallets (Apple Pay, Google Pay) add encryption so your actual card number is not shared with the merchant at all. But for traditional online shopping, CVV2 remains the standard verification method.

Some merchants also use Address Verification Service (AVS), which checks whether the billing address you enter matches the address on file with your card issuer. This catches some fraud but is not foolproof, because billing addresses can be updated or guessed. CVV2 is more reliable because it is something only you should know.

Frequently Asked Questions

Is it safe to give my CVV2 to a merchant?

Yes, it is safe to provide CVV2 to a merchant during checkout on a website you navigated to yourself or a phone order you initiated. The merchant is required to delete it immediately after the transaction. Never provide CVV2 in response to an unsolicited email, text, or phone call, even if the sender claims to be from your bank.

What if I lose my card before I memorize the CVV2?

You do not need to memorize your CVV2. It is printed on the card itself, so you look it up each time you need it. If your card is lost or stolen, contact your issuer immediately to report it. They will cancel the card and send you a new one with a new CVV2. Any recurring payments will need to be updated with the new card details.

Can someone use my card number without the CVV2?

For online and phone purchases, no — CVV2 is required. For in-person purchases, your card number alone is not enough; the merchant needs the physical card to swipe or insert. However, someone with your full card details including CVV2 can make online purchases, which is why you should protect both pieces of information equally.

Does my bank store my CVV2?

Your card issuer knows what your CVV2 is, but they do not store it in a way that appears in your online account or statements. Merchants and payment processors are forbidden from storing it. If you see your CVV2 displayed anywhere other than on the physical card itself, that is a security red flag.

What should I do if I accidentally shared my CVV2?

Contact your card issuer immediately and report that your CVV2 may be compromised. They can monitor your account for unauthorized activity and issue you a new card if necessary. In most cases, if you report it before any fraudulent charges appear, your liability is zero.