The CVV2 is the three-digit code on the back of your card

The CVV2 (Card Verification Value 2) is a three-digit security code printed on the back of your credit card, separate from your card number. On Visa, Mastercard, and Discover cards, it appears in the signature panel on the back — usually to the right of the signature line. On American Express cards, it is a four-digit code printed on the front, above the card number on the right side.

This code exists so that when you make an online or phone purchase, the merchant can verify you actually have the physical card. The merchant never stores it; they use it only to confirm the transaction at that moment. It is not the same as your PIN, which you use at ATMs and in-store chip readers.

The CVV2 is different from the CVV (Card Verification Value) that appears on your card's magnetic stripe — that older code is used for in-person swipe transactions. Most online retailers now ask for CVV2 because it is printed on the card itself and harder to steal from a database breach.

Key Takeaways

  • On Visa, Mastercard, and Discover, the CVV2 is a three-digit code on the back of your card in or near the signature panel.
  • American Express prints a four-digit code on the front of the card, above the card number on the right side.
  • You should never share your CVV2 with anyone except a merchant you are actively paying, and legitimate companies will never ask for it by email or phone.
  • The CVV2 is not stored after a transaction, so if a website is breached, thieves cannot use a stolen CVV2 to make future purchases.

How to locate it on different card brands

Most cards follow the same layout. Flip your card over and look at the back. You will see a white or light-colored signature panel — a strip where cardholders sign their name. To the right of that panel, you will find a series of numbers. The last three digits of that series are your CVV2.

American Express works differently. Turn the card face-up and look at the front. Above your 15-digit card number, on the right side, you will see four digits printed in a smaller font. That four-digit code is American Express's version of the CVV.

Some older or specialty cards may print the code in a slightly different location, but the three-digit code on the back is the standard for the vast majority of cards in circulation. If you cannot find it, contact your card issuer — they can tell you where it is on your specific card.

Why merchants ask for it during online purchases

When you enter your card number, expiration date, and CVV2 into a website, the merchant sends that information to their payment processor, which contacts your card issuer to verify the transaction. The issuer checks whether the CVV2 matches the one on file for that card number. If it does not match, the transaction is declined.

This verification step proves you have the physical card in your hand at the moment of purchase. A thief who has only your card number and expiration date — stolen from a data breach or a skimmed ATM — cannot complete an online purchase without the CVV2. That is why it is printed on the card itself rather than encoded on the magnetic stripe: it cannot be stolen remotely.

Some merchants store your card information for future purchases (like subscription services or saved payment methods), but they are legally prohibited from storing the CVV2. Each time you make a purchase, you must provide it again, or the merchant must request it from you before charging your card.

What to do if someone asks for your CVV2 by email or phone

Do not give it to them. Legitimate companies — your bank, PayPal, Amazon, your utility company — will never ask for your CVV2 by email, text, or phone call. If someone contacts you claiming to be from your card issuer or a merchant and asks for this code, it is a scam.

Scammers use social engineering to trick you into revealing the code. They might claim there is a problem with your account, that you need to "verify" your card, or that you have won a prize. None of these are real reasons a company would ask for your CVV2 outside of an active purchase you initiated.

If you receive such a request, hang up or delete the message, then contact your card issuer directly using the number on the back of your card. Report the contact to your issuer's fraud department. Do not use a phone number or link provided in the suspicious message.

The difference between CVV2 and other card security features

Your card has several security codes, and it is worth knowing what each one does. The PIN (Personal Identification Number) is a four-digit code you create and use at ATMs and chip readers in stores. Only you should know it. The CVV on the magnetic stripe is an older code used for in-person swipe transactions; it is different from the CVV2.

The CVV2 is printed on the card and used for online and phone purchases. The 3D Secure code is a temporary code sent to your phone or email by your bank during certain online purchases — it is not printed on the card. Your card number and expiration date are the basic identifiers but do not prove you have the card.

When you shop online, you will typically be asked for your card number, expiration date, and CVV2. Some merchants also use 3D Secure, which adds an extra verification step. Your PIN is never needed for online purchases and should never be entered into a website.

What happens if your CVV2 is compromised

If your CVV2 is exposed in a data breach or you suspect someone has it, contact your card issuer immediately. They can issue you a new card with a new CVV2. The old code will no longer work for transactions, even if a thief has your card number and expiration date.

Because the CVV2 is not stored by merchants, a breach of a retailer's database will not expose your CVV2 unless the retailer was breaking the law by storing it. Most large data breaches expose card numbers and expiration dates but not CVV2 codes, which limits what a thief can do with the stolen information.

If you notice unauthorized charges on your card, report them to your issuer right away. You are not responsible for fraudulent charges, and your issuer will investigate and reverse them. Requesting a new card with a new CVV2 is a precaution, not a requirement for disputing fraud.

Frequently Asked Questions

Is the CVV2 the same as my card's PIN?

No. Your PIN is a four-digit code you create and use at ATMs and in-store chip readers. Your CVV2 is a three-digit code printed on the back of your card and used for online and phone purchases. You should never enter your PIN into a website.

Can a merchant store my CVV2 after I make a purchase?

No. Payment Card Industry (PCI) rules prohibit merchants from storing the CVV2. If a merchant stores it, they are breaking the law. Each time you make a purchase, you must provide the CVV2 again, or the merchant must request it from you before charging your card.

What if I cannot find the CVV2 on my card?

Contact your card issuer using the number on the back of your card. They can tell you where the CVV2 is located on your specific card. Some specialty or older cards may have it in a different location than the standard back-of-card placement.

Does the CVV2 change if I get a new card?

Yes. Each card has its own unique CVV2. If your issuer sends you a replacement card — whether because the old one was lost, damaged, or compromised — the new card will have a different CVV2.