CVV2 is the three- or four-digit security code printed on your credit card

CVV2 stands for Card Verification Value 2. It is a number printed on the back of your credit card (or sometimes the front, depending on the card type) that is separate from your card number. The code exists to verify that you physically hold the card when you make a purchase, especially online or over the phone.

Visa, Mastercard, and Discover cards show a three-digit CVV2 on the back, usually near the signature strip. American Express calls theirs a CID (Card Identification Number) and prints a four-digit code on the front, above the card number. The code is not stored in the card's magnetic stripe or chip — it only appears printed on the card itself.

When you enter your CVV2 during an online checkout or phone order, the merchant sends it to the card issuer (your bank) to confirm that you have the physical card in your possession. The merchant does not store this number after the transaction completes, which is why you have to enter it again the next time you shop.

Key Takeaways

  • CVV2 is a three- or four-digit code printed on your card that proves you physically hold it when making a purchase online or by phone.
  • Visa, Mastercard, and Discover use a three-digit code on the back; American Express uses a four-digit code on the front.
  • Never share your CVV2 over email, text, or with anyone who calls you claiming to be from your bank — legitimate companies will never ask for it that way.
  • Merchants are not allowed to store your CVV2 after a transaction, so you must enter it each time you shop.
  • A CVV2 protects you from fraud when your card number alone is compromised, because a thief without the physical card cannot complete most online purchases.

How CVV2 protects you from fraud

If someone steals your card number — through a data breach, a skimmed ATM, or a compromised website — they cannot use it to make online purchases without also having the CVV2. Because the code is printed on the card and not stored anywhere else, a thief who only has your number cannot guess or look up the code.

This protection has limits. A thief who physically steals your card has both the number and the CVV2, so this code alone will not stop them. A thief who calls a merchant pretending to be you can sometimes convince the merchant to process a transaction without asking for the CVV2. But for the most common fraud scenario — a stolen or leaked card number used for online shopping — the CVV2 requirement stops most unauthorized purchases.

Why merchants ask for CVV2 but cannot keep it

Payment card networks (Visa, Mastercard, Discover, and American Express) have strict rules about CVV2. Merchants are required to ask for it during online and phone transactions, but they are forbidden from storing it after the transaction is complete. This rule is part of the Payment Card Industry Data Security Standard (PCI DSS), a set of requirements that all merchants who handle credit cards must follow.

The reason for this rule is simple: if merchants stored CVV2 codes, a data breach at a merchant's computer system could expose millions of codes. Because merchants cannot keep the code, a breach of their database does not give a thief the CVV2. The merchant sends the code directly to the card network or payment processor, who verify it and then discard it.

When you should and should not give your CVV2

You should enter your CVV2 when you shop online, order by phone from a legitimate merchant, or use a payment app that asks for it. These are normal, expected requests.

You should never give your CVV2 to someone who calls you, texts you, or emails you claiming to be from your bank or a merchant. Legitimate banks and merchants will never ask for your CVV2 this way. If someone contacts you asking for it, hang up or delete the message and call your bank directly using the number on the back of your card.

Do not enter your CVV2 on a website unless the page is secure — look for a padlock icon in the address bar and a URL that starts with "https://" rather than "http://". Do not write down your CVV2 or store it anywhere, even in your phone or a password manager.

CVV2 versus other card security features

Your credit card has several security features that work together. Your card number (the 16-digit number on the front) identifies your account. Your expiration date shows when the card expires. Your CVV2 proves you have the physical card. Your name on the card is checked against the name on the order.

Chip technology (the small metal square on newer cards) adds another layer of security for in-person purchases. When you insert your card into a chip reader instead of swiping it, the chip creates a unique code for that transaction that cannot be reused. This protects you in stores better than the magnetic stripe does, but it does not apply to online or phone orders — that is where CVV2 comes in.

None of these features alone stops all fraud. Together, they make it much harder for a thief to use a stolen card number. If fraud does happen on your account, your bank's fraud protection (which varies by bank and card type) covers most unauthorized charges.

What to do if your CVV2 is compromised

If you believe someone has your card number and CVV2 — for example, because you entered them on a website that turned out to be fake, or because you lost your physical card — contact your bank or card issuer immediately. You can usually find the number on the back of your card or on your bank's website.

Your bank can cancel your current card and issue you a new one with a new number and a new CVV2. This stops anyone from using the old card number, even if they have the old CVV2. The process usually takes five to ten business days for a replacement card to arrive, though many banks can issue a temporary digital card number you can use online right away.

You are not responsible for fraudulent charges on your credit card if you report them promptly. Federal law (the Fair Credit Billing Act) limits your liability to $50 per card, and most banks waive even that if you report the fraud before the charge posts to your account. Debit cards have different protections, so if the compromised card is a debit card, call your bank even faster.

Frequently Asked Questions

Can someone use my card number without the CVV2?

In person, yes — a thief with your card number can swipe or insert the card at a store. Online or by phone, most merchants will decline the transaction without a CVV2, but some older or less secure websites may not ask for it. If you see a charge you did not make, report it to your bank regardless of whether the CVV2 was used.

Is it safe to save my CVV2 for faster checkout?

No. Merchants are not allowed to store your CVV2, so if a website offers to save it, that website is not following payment card rules. Do not use that site. Legitimate merchants like Amazon and Target do not store your CVV2 — they store your card number and expiration date, and ask you to enter the CVV2 each time or use a saved payment method that does not include it.

What if I forgot my CVV2?

Look at the back of your physical card — the three-digit number is printed there. If you do not have your card with you, you can log into your bank's website or app, which usually displays your card details including the CVV2. If you still cannot find it, call your bank and they can read it to you over the phone.

Do I need to memorize my CVV2?

No. You should never memorize it or write it down. Keep your card in a safe place and enter the CVV2 only when you are making a purchase on a secure website or calling a merchant you trust. The whole point of the CVV2 is that it is hard for a thief to get — do not make it easier by storing it anywhere.