CVV2 is the three-digit security code on the back of your credit card

CVV2 stands for Card Verification Value 2. It's the three-digit number printed on the back of your credit card, usually in or near the signature strip. Visa, Mastercard, and Discover all use this same format. American Express prints a four-digit code on the front instead, which serves the same purpose.

The number exists to prove you physically have the card in your hand. When you shop online or over the phone, the merchant can't see your card, so they ask for the CVV2 to verify you're the real cardholder. It's a basic security check — one that catches a lot of fraudulent transactions because someone who only has your card number (from a data breach, for example) won't have this code.

The CVV2 is not the same as the PIN you use at an ATM or in-store. It's also not stored on the card's magnetic stripe or chip, which is why thieves who clone your card number can't easily get it.

Key Takeaways

  • CVV2 is the three-digit code on the back of your credit card that proves you have the physical card when you can't show it in person.
  • Merchants ask for CVV2 during online and phone purchases because it's harder to steal than your card number alone.
  • Never share your CVV2 with anyone except the merchant you're actively paying, and never type it into a link someone sends you.
  • If someone asks for your CVV2 in person, at an ATM, or via email or text, it's a scam — legitimate businesses never ask this way.

When merchants ask for CVV2 and why it matters

Online retailers ask for your CVV2 at checkout because they're processing a "card-not-present" transaction. Your card number alone isn't enough proof you authorized the charge — the CVV2 adds a second layer. If a thief has only stolen your card number from a database breach, they can't complete the purchase without this code.

Phone orders work the same way. When you call a company to place an order, they'll ask for the CVV2 before charging your card. This is standard and legitimate.

In-store purchases don't require CVV2 because the cashier can see your physical card and check your signature or ID. The code is only useful when the merchant can't verify you in person.

Where to find your CVV2 and how to read it

For Visa, Mastercard, and Discover, flip your card over to the back. Look at the signature strip — the white or light-colored panel where you sign your name. To the right of that strip, you'll see a series of numbers printed in a different font or color. The last three digits of that sequence are your CVV2.

American Express is different. The code is on the front of the card, above the card number on the right side. It's four digits instead of three.

The CVV2 is printed, not embossed, so you can't feel it. If you can't find it, your card issuer can tell you what it is over the phone — they'll verify your identity first.

CVV2 is not the same as other card security features

Your card has several numbers on it, and it's easy to confuse them. Your card number is the long sequence on the front — usually 16 digits for Visa and Mastercard, 15 for American Express. This is what you use to make purchases and what gets stored when you save a card to an online account.

The expiration date is the two-digit month and two-digit year (like 03/27) printed on the front. It tells you when the card stops working.

The CVV2 is only the three or four digits on the back or front, depending on your card brand. It's meant to be temporary — when your card expires and you get a new one, the CVV2 changes even if your card number stays the same.

Your PIN is something you create and memorize. You use it at ATMs and sometimes at in-store terminals. It's not printed anywhere on your card, and you should never share it with anyone.

How to protect your CVV2 from theft

The biggest risk is typing your CVV2 into a fake website or email link. Scammers create lookalike sites or send phishing emails that look like they're from your bank or a store you trust. If you click the link and enter your CVV2, they have it.

Never type your CVV2 into a link someone sent you by email, text, or social media — not even if it looks official. Legitimate companies never ask you to enter sensitive information through a link they send. If you're unsure, hang up or close the email, then call the company directly using the number on your card or their official website.

Don't take photos of your card or write down your CVV2. Don't share it over email or text. Don't say it out loud where others can hear. The only time you should type or say your CVV2 is directly to the merchant you're paying, on a secure website (look for the padlock icon in your browser) or over the phone to a number you called yourself.

If you think your CVV2 has been compromised, call your card issuer right away. They can cancel your card and send you a new one with a different CVV2. You're not responsible for fraudulent charges if you report them quickly.

Red flags that someone is trying to scam you for your CVV2

Legitimate businesses never ask for your CVV2 in certain situations. If any of these happen, it's a scam:

  • Someone asks for your CVV2 in person, at an ATM, or through a drive-up window.
  • Your bank or card issuer texts or emails asking you to "verify" your CVV2.
  • A company asks for your CVV2 before you've initiated a purchase or given them your card number.
  • Someone calls claiming to be from your bank and asks for your CVV2 to "update your account" or "confirm your identity."
  • A pop-up appears on a website asking for your CVV2 before you've clicked checkout.

If you get a call, email, or text asking for your CVV2 in any of these ways, hang up or delete it. Then call your card issuer directly using the number on the back of your card to report it.

Frequently Asked Questions

Can someone use my card if they have my card number but not my CVV2?

They can try to make in-store purchases if they clone your card, but online and phone purchases are much harder without the CVV2. Many merchants require it, and payment processors flag transactions that are missing it. Your best protection is to monitor your account and report any charges you don't recognize.

Is it safe to save my CVV2 when I save a card to a website?

Most secure websites don't let you save your CVV2 — they ask for it every time you make a purchase. If a site offers to save it, that's a warning sign. Only enter your CVV2 directly into the checkout form, not into a separate "save card" field.

What should I do if I accidentally shared my CVV2 with someone?

Call your card issuer immediately and tell them what happened. They can cancel your card and issue a new one with a different CVV2. Watch your account closely for the next few months and report any charges you didn't make.

Do I need to give my CVV2 to my bank or credit card company?

No. Your bank already has your CVV2 on file — they issued the card. If someone claiming to be from your bank asks for it, it's a scam. Hang up and call your bank directly using the number on your card.

Why does American Express use four digits instead of three?

American Express prints the security code on the front of the card instead of the back, and they use four digits for extra security. The code works the same way — merchants ask for it during online and phone purchases to verify you have the card.