The CVV2 is the three- or four-digit security code on the back of your card
The CVV2 (Card Verification Value 2) is a three-digit number printed on the back of most credit cards, usually in or near the signature strip. American Express cards have a four-digit CVV2 printed on the front, above the account number. This code exists to verify that you physically possess the card when you make a purchase — the merchant or payment processor asks for it to confirm the card is real and in your hands.
The CVV2 is not encoded in the magnetic stripe or chip on your card. It is printed only on the card itself, which means a merchant who has only your card number and expiration date — from a data breach, for example — cannot complete a transaction without the CVV2. This makes it a basic fraud prevention tool for online and phone purchases, where the merchant cannot see the physical card.
The CVV2 is different from the CVC (Card Verification Code), which is the same thing by a different name depending on your card issuer. Visa calls it CVV2, Mastercard calls it CVC, and Discover calls it CID. American Express calls theirs CID as well. They all serve the same purpose.
Key Takeaways
- The CVV2 is a three-digit code on the back of your card (or four digits on the front of an American Express card) that proves you have the physical card.
- You must provide the CVV2 when making online or phone purchases, but never share it via email, text, or unsecured channels.
- The CVV2 is not stored in your card's magnetic stripe or chip, so it cannot be stolen through a data breach of a merchant's system.
- Legitimate companies will never ask for your CVV2 by phone or email — if someone does, it is a scam.
Where the CVV2 appears on different card types
On Visa, Mastercard, and Discover cards, the CVV2 is a three-digit number printed on the back of the card, to the right of the signature strip. It is the last three digits of a longer number that appears in that area. Look for a small box or area where the number is printed separately from the rest of the card design.
On American Express cards, the CVV2 is a four-digit number printed on the front of the card, above and to the right of the main account number. It is easier to spot because it appears on the face of the card rather than the back.
If your card is damaged or the CVV2 is worn away, you can contact your card issuer and request a replacement card. The issuer will mail you a new card with a new CVV2. You cannot change or request a specific CVV2 — the number is generated when the card is produced.
When merchants ask for your CVV2 and when they should not
Merchants ask for the CVV2 during online checkout, over the phone when you place an order, or when you use a payment processor that does not have your card on file. This is normal and expected. You should provide it in these situations because it is part of the standard payment process.
You should never provide your CVV2 in an email, text message, or through an unsecured channel. You should never provide it to someone who calls you claiming to be from your bank or card issuer — legitimate financial institutions will never ask for your CVV2 by phone. If someone asks for it this way, hang up and call your card issuer directly using the number on the back of your card to report the contact.
Merchants are not supposed to store your CVV2 after a transaction is complete. Payment Card Industry (PCI) standards prohibit storing the CVV2 in a database. If a merchant's system is breached, the CVV2 should not be in the stolen data because it should never have been saved. This is why the CVV2 is more secure than your card number alone — even if your number is compromised, a thief cannot use it without the CVV2.
How the CVV2 protects you in online and phone transactions
The CVV2 is a verification tool, not a may provide of protection. When you provide it during a purchase, the payment processor checks it against the card issuer's records to confirm it matches the card number you provided. If the CVV2 does not match, the transaction is declined. This catches many fraudulent transactions where someone has your card number but not the physical card.
The CVV2 does not protect you in person at a store or gas pump. In those situations, the merchant can see the card and verify it is real. The CVV2 is most useful for online shopping, phone orders, and mail orders — any transaction where the merchant cannot physically inspect the card.
If your card is lost or stolen, the thief has the CVV2 because it is printed on the card. This is why you should report a lost or stolen card immediately to your issuer. Your issuer will cancel the card and issue a replacement with a new CVV2. Once the card is cancelled, transactions using the old CVV2 will be declined.
What happens if someone has your CVV2
If someone has your CVV2 along with your card number and expiration date, they can attempt to make online or phone purchases. However, many merchants and payment processors now require additional verification beyond the CVV2 — such as your billing address, a one-time code sent to your phone, or a password. These extra steps make it harder for a thief to complete a transaction even if they have the CVV2.
If you believe your CVV2 has been compromised — for example, you gave it to a website you later realized was fraudulent — contact your card issuer immediately. Ask them to cancel the card and issue a replacement. Do not wait to see if fraudulent charges appear. Your card issuer can monitor for suspicious activity and will investigate any charges you report as unauthorized.
You are not responsible for fraudulent charges on your credit card if you report them promptly. Federal law limits your liability to $50 if someone uses your card without permission, and most card issuers waive this fee entirely. The key is reporting the fraud as soon as you notice it or suspect it.
CVV2 versus other card security features
The CVV2 is one layer of fraud prevention, but it is not the only one. Your card also has a magnetic stripe and a chip (on newer cards) that contain encrypted data. The chip is more secure than the magnetic stripe because it is harder to counterfeit. When you insert your chip card at a store or ATM, the chip generates a unique code for that transaction, which makes it nearly impossible for a thief to reuse the data from one transaction for another.
Online, the CVV2 is often paired with 3D Secure (also called Verified by Visa, Mastercard SecureCode, or Discover Secure), which sends a one-time code to your phone or email during checkout. This adds a second layer of verification beyond the CVV2. Some merchants also ask for your billing address as a verification step.
None of these tools are perfect. The CVV2 is effective against basic card-not-present fraud, but it does not protect you if you enter your information on a fake website or if a merchant's system is breached. This is why monitoring your statements regularly and reporting suspicious charges quickly is important.
Frequently Asked Questions
Can I use my card online without providing the CVV2?
Most online merchants require the CVV2 as part of their standard checkout process. Some payment systems, like Apple Pay or Google Pay, do not require you to enter the CVV2 because the payment processor handles verification differently. If a merchant does not ask for the CVV2, it does not mean your transaction is less secure — it means they are using a different verification method.
Is it safe to give my CVV2 to a website?
It is safe to provide your CVV2 to legitimate, secure websites. Look for "https://" in the address bar and a padlock icon, which indicate the connection is encrypted. Reputable merchants use secure payment processors that do not store the CVV2. If you are unsure about a website's legitimacy, do not enter your card information.
What should I do if I accidentally shared my CVV2 in an email?
Contact your card issuer immediately and ask them to cancel the card and issue a replacement. Do not assume nothing will happen — act quickly to prevent unauthorized charges. Your issuer can monitor the card for suspicious activity while a replacement is being mailed to you.
Does the CVV2 change if I use my card?
No. The CVV2 stays the same for the life of the card. It only changes when you receive a replacement card from your issuer. If your card is damaged, lost, stolen, or compromised, your issuer will send you a new card with a new CVV2.
Can I look up my CVV2 online if I do not have my card?
No. Your card issuer will not provide your CVV2 over the phone, through their website, or through their app. This is intentional — the CVV2 is meant to be known only to you and the card issuer's system. If you need to make a purchase and do not have your card, you can request a replacement card or use a different payment method.