CVV2 is the three-digit security code on the back of your credit card

The CVV2 (Card Verification Value 2) is a three-digit number printed on the back of your credit card, usually near your signature. It exists to prove you physically have the card when you make a purchase online or over the phone — the merchant cannot see this number from your card statement or billing records, so if someone has stolen your card number alone, they cannot complete most transactions without it.

The number changes depending on your card issuer. Visa and Mastercard call it CVV2. American Express prints a four-digit code on the front instead and calls it CID (Card Identification Data). Discover uses CVV2 as well. The purpose is the same across all of them: to add a second layer of verification beyond your card number and expiration date.

Key Takeaways

  • CVV2 is the three-digit code on the back of your credit card that proves you have the physical card when making online or phone purchases.
  • You should never share your CVV2 with anyone except the merchant you are actively paying, and legitimate companies will never ask for it via email or phone.
  • If someone has your card number but not your CVV2, they cannot complete most online transactions, which is why the code exists.
  • American Express uses a four-digit code on the front of the card instead of a three-digit code on the back.

Why merchants ask for CVV2 during checkout

When you buy something online, the merchant's payment system asks for your card number, expiration date, and CVV2 before processing the charge. The CVV2 is sent to your card issuer (your bank or credit card company) to verify, but the merchant is not supposed to store it after the transaction completes. This means if a hacker breaks into a merchant's database and steals card numbers, the CVV2 should not be in that stolen data.

Over the phone, a customer service representative may ask for your CVV2 for the same reason — to confirm you have the card. However, you should be cautious: legitimate companies rarely ask for CVV2 over the phone unless you initiated the call and are making a purchase. If someone calls you asking for your CVV2, hang up and call the company directly using the number on your statement or their official website.

The difference between CVV2 and other card security features

Your credit card has several numbers on it, and they serve different purposes. Your card number (the 16 digits on the front) is the main identifier — merchants see this and use it to charge your account. Your expiration date tells the system when the card stops being valid. Your CVV2 is the verification code that proves you have the physical card.

Some cards also have a PIN (Personal Identification Number), which you use at ATMs and in-person at stores. The PIN is different from CVV2 and is not printed on the card — only you know it. If your card is lost or stolen, the thief can use the card number and expiration date for online purchases, but they cannot complete most transactions without the CVV2, and they cannot use the card in person without the PIN.

When you should and should not share your CVV2

Share your CVV2 only when you are actively making a purchase from a merchant you trust. This includes online checkouts, phone orders you initiated, and in-person transactions where the card reader asks for it (though this is less common). After the transaction, the merchant should not ask for it again — if they do, that is a sign something is wrong.

Never share your CVV2 via email, text message, or social media, even if someone claims to be from your bank or a company you do business with. Your bank will never ask for your CVV2 by email or phone. If you receive a message asking for it, do not respond — contact the company directly using a phone number or website you know is legitimate. Scammers often pose as customer service representatives to steal this information.

What happens if someone gets your CVV2

If your CVV2 is exposed but your card number is not, the damage is limited — a thief cannot use the CVV2 alone to make purchases. However, if both your card number and CVV2 are stolen (which can happen if a merchant's database is breached), a thief can make online purchases until you report the card stolen.

If you suspect your CVV2 has been compromised, contact your card issuer when ready. They can cancel your current card and issue a new one with a new CVV2. You are not responsible for fraudulent charges if you report them promptly, but the sooner you act, the better. Check your statement regularly for charges you do not recognize, and set up account alerts if your card issuer offers them.

How CVV2 protects you in online shopping

CVV2 is one of several tools designed to reduce fraud. When you enter it during checkout, the payment processor sends it to your card issuer for verification. If the CVV2 does not match the card number, the transaction is declined. This stops many fraudulent purchases because a thief who has stolen your card number from a data breach usually does not have the CVV2.

However, CVV2 is not foolproof. If a thief has both your card number and CVV2 (because they stole them from a merchant or phishing scam), they can make purchases. This is why you should also monitor your statements, use strong passwords for online accounts, and be cautious about where you enter your card information. Reputable websites use encryption (look for "https://" and a lock icon in your browser) to protect your data during transmission.

Frequently Asked Questions

Is CVV2 the same as the security code on the front of my American Express card?

No. American Express prints a four-digit code on the front of the card and calls it CID. Visa, Mastercard, and Discover print a three-digit code on the back and call it CVV2. The purpose is the same — to verify you have the physical card — but the location and length differ by card type.

Can a merchant store my CVV2 after I make a purchase?

No. Payment card industry rules prohibit merchants from storing CVV2 after a transaction completes. If a merchant asks you to save your CVV2 for future purchases, that is a red flag. Legitimate merchants store only your card number and expiration date, and they ask for the CVV2 again the next time you shop.

What should I do if I accidentally shared my CVV2 with someone?

Contact your card issuer right away and explain what happened. They can monitor your account for fraudulent activity and may issue you a new card with a new CVV2. Do not panic — you are protected against unauthorized charges if you report them, but the faster you act, the better.

Does CVV2 protect me if my card is stolen in person?

Partially. A thief with your physical card can use it at stores and ATMs if they know your PIN, but they cannot complete most online purchases without your CVV2 (unless they also have your expiration date and card number memorized). Report a lost or stolen card when ready so your issuer can cancel it.

Why do some websites not ask for CVV2?

Some merchants, especially those you have shopped with before, may store your card information and skip the CVV2 step on repeat purchases. Others use different security methods. However, most reputable online retailers ask for CVV2 every time as an extra security layer. If a site never asks for it, that does not necessarily mean it is unsafe, but it is one less verification step.