CVV2 is the three-digit security code on the back of your credit card

CVV2 stands for Card Verification Value 2. It is a three-digit number printed on the back of your credit card, usually near the signature strip. Visa, Mastercard, and Discover all use CVV2. American Express calls theirs CID (Card Identification) and prints a four-digit code on the front instead.

The code exists to verify that you physically have the card in your hand when you make a purchase online or over the phone. A merchant or payment processor asks for it to confirm the card is real and that you are the person using it. The number is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also knowing this code.

CVV2 is different from the older CVV (Card Verification Value), which was the original security code. Most people use the terms interchangeably now, but CVV2 is the current standard.

Key Takeaways

  • CVV2 is a three-digit code on the back of your credit card that merchants use to verify you have the physical card.
  • You should never give your CVV2 to anyone who calls you or emails you, even if they claim to be from your bank.
  • Legitimate merchants ask for CVV2 only during online checkout or phone purchases, never after the sale is complete.
  • If someone has your card number and CVV2, they can make online purchases without your permission.

Where to find your CVV2 and what it looks like

On Visa, Mastercard, and Discover cards, the CVV2 is printed on the back of the card in the signature area. It is usually the last three digits on the right side, after a longer string of numbers. The code is printed in a different color or style than the card number itself, making it stand out slightly.

American Express cards have a four-digit code called the CID printed on the front of the card, above the card number on the right side. If you use an American Express card online, merchants will ask for this four-digit code instead of a three-digit CVV2.

The CVV2 is never embossed or raised like the card number. It is only printed on the surface. This design choice is intentional: it means the code cannot be read by the same machines that read the card number at a store checkout, adding another layer of security.

When merchants ask for CVV2 and when they should not

Merchants ask for CVV2 during online checkout when you enter your card details into a website. They also ask for it when you give your card number over the phone to make a purchase. In both cases, the merchant is trying to confirm that you have the card and are authorizing the transaction.

A legitimate merchant will never ask for your CVV2 in an email, text message, or phone call where you initiated contact. If someone calls you claiming to be from your bank or credit card company and asks for your CVV2, hang up. Your bank already has your card information and does not need to ask for it. This is a common fraud tactic.

After a purchase is complete, no merchant should ask for your CVV2 again. If a company contacts you asking for this code to "verify your account" or "confirm your identity," treat it as a red flag. Legitimate customer service representatives have other ways to verify who you are.

Why CVV2 matters for your security

CVV2 protects you in two ways. First, it prevents someone who has only stolen your card number from using it online. If a thief gets your 16-digit card number from a data breach or a skimming device, they still cannot complete an online purchase without the three-digit code. Second, it gives merchants a way to check that a transaction is legitimate before they process it, reducing fraud losses across the payment system.

However, CVV2 is not a complete security solution. If someone has both your card number and your CVV2, they can make online purchases. This is why you should treat your CVV2 as carefully as you treat your card number itself. Never write it down, never share it over email, and never give it to someone who contacts you unsolicited.

The code also does not protect you in person. When you swipe or insert your card at a store, the merchant does not ask for CVV2. This is why card-present fraud (theft of a physical card) is still possible, even though the card has a security code.

What to do if someone has your CVV2

If you believe someone has your CVV2 along with your card number, contact your credit card issuer right away. Call the number on the back of your card or log into your online account to find the fraud department's phone number. Do not use a number from an email or text message, as those could be fake.

Your card issuer can cancel your card and issue a new one with a new CVV2. They can also review your recent transactions and dispute any charges you did not make. Most credit card companies limit your liability for fraudulent charges to $50, and many waive that fee entirely if you report the fraud quickly.

Check your credit card statements regularly for charges you do not recognize. Many issuers offer free fraud monitoring or alerts that notify you when a large purchase is made. Setting up these alerts can help you catch fraud faster.

CVV2 versus other card security features

Your credit card has several security features working together. The card number itself is the primary identifier. The expiration date tells merchants when the card expires. The cardholder name is printed on the front. The CVV2 is the code on the back. Together, these pieces of information are what merchants ask for during online or phone purchases.

Newer cards also have a chip (EMV technology) embedded in the front. When you insert a chip card into a reader at a store, the chip generates a unique code for that specific transaction. This code cannot be reused, so even if a thief intercepts it, they cannot use it again. Chip technology is more secure than the magnetic stripe for in-person purchases, but it does not apply to online or phone transactions.

Some cards also offer tokenization or virtual card numbers for online shopping. These are temporary card numbers that work only once or for a single merchant, so your real card number is never shared with the website. If you use this feature, you would not need to enter your CVV2 at all.

Frequently Asked Questions

Is it safe to give my CVV2 to an online store?

Yes, if the website is legitimate and uses encryption to protect your data. Look for "https://" at the start of the web address and a padlock icon in your browser. These indicate the site is using secure technology. However, only enter your CVV2 during checkout on the merchant's official website, never on a link from an email or text message.

Can someone use my card online with just the card number and expiration date?

Most legitimate online merchants will not process a transaction without the CVV2, so having only the card number and expiration date makes fraud harder but not impossible. Some older or less secure websites may not ask for CVV2. This is why CVV2 is important — it adds a barrier that catches many fraudulent transactions.

What if I forgot my CVV2?

You can find it on the back of your physical card. If you do not have your card with you, you can log into your credit card company's website or app, which usually displays the CVV2 in your account settings. You can also call the customer service number on your statement.

Do I need to memorize my CVV2?

No. You should not memorize it or write it down. Keep it as secure as your card itself. The only time you need it is when you are making a purchase and the merchant asks for it. If you use the same online store repeatedly, most websites allow you to save your card information securely so you do not have to enter it each time.

Why do some merchants not ask for CVV2?

Older websites or merchants with less sophisticated payment systems may not request CVV2. Some in-person retailers also do not ask for it because they are using chip or contactless payment technology instead. However, any legitimate online merchant should ask for CVV2 as part of their fraud prevention process.