CVV2 is the three- or four-digit security code printed on the back of your credit card, separate from your card number

The CVV2 (Card Verification Value 2) is a number you'll find on the back of most credit and debit cards, usually printed to the right of the signature strip. On American Express cards, it appears on the front. It's typically three digits, though American Express uses four. This code exists because the card issuer — your bank or credit card company — uses it to verify that you physically possess the card when you're making a purchase, especially online or over the phone.

The CVV2 is not encoded in the magnetic stripe or chip on your card the way your card number is. It's printed only on the physical card itself. That separation is intentional: if a merchant's database is breached and your card number is stolen, the thief still cannot complete an online transaction without the CVV2, because they don't have access to the printed number on your actual card.

Card networks like Visa, Mastercard, and Discover created the CVV2 standard in the 1990s as online shopping grew and merchants needed a way to reduce fraud on card-not-present transactions — situations where you're not handing your card to someone in person.

Key Takeaways

  • CVV2 is a three- or four-digit code printed on your card that merchants request during online and phone purchases to confirm you have the physical card.
  • The code is not stored in your card's magnetic stripe or chip, so a stolen card number alone cannot be used to make online purchases without it.
  • Visa, Mastercard, Discover, and American Express all require merchants to request CVV2 for card-not-present transactions to reduce fraud.
  • You should never share your CVV2 with anyone except the merchant you're actively paying, and legitimate companies will never ask for it via email or phone.

Why merchants ask for CVV2 during checkout

When you buy something online or over the phone, you're not handing your physical card to the merchant. The merchant has your card number, expiration date, and billing address — but they don't have the card itself. The CVV2 serves as proof that you're the person making the purchase, because only someone holding the actual card can read the number off the back.

Merchants are required by their payment processor to request the CVV2 for these transactions. If a merchant processes a card-not-present transaction without requesting CVV2, they accept more liability if the transaction is later disputed as fraudulent. In other words, the merchant bears the financial loss, not the card issuer. That creates a strong incentive for merchants to always ask for it.

The card networks — Visa, Mastercard, Discover, and American Express — set these rules as part of their operating agreements with banks and merchants. A merchant who doesn't follow the rules risks losing the ability to accept that card brand altogether.

How CVV2 differs from other card security features

Your credit card carries several pieces of information, and it's worth understanding what each one protects against. Your card number (the 16 digits on the front) identifies your account. Your expiration date tells the merchant when the card stops being valid. Your billing address is used for address verification, especially in online transactions. Your CVV2 is the only piece of information that proves you have the physical card.

The card's chip (if your card has one) is a different security layer. It creates a unique encrypted code for each in-person transaction, making it nearly impossible to clone the card or reuse a transaction. The chip protects you at a gas pump or checkout counter. The CVV2 protects you online and over the phone.

Some cards also carry a CVC or CID — these are the same thing as CVV2, just different names used by different card networks. Visa calls it CVV2. Mastercard calls it CVC. American Express calls it CID. They all serve the same purpose.

What happens if your CVV2 is compromised

If someone obtains your card number but not your CVV2, they cannot complete an online purchase without it. They would need to either steal your physical card, find another way to get the CVV2, or attempt a transaction at a merchant who doesn't properly request it (which is rare for legitimate businesses).

If someone has both your card number and CVV2, they can make online purchases in your name. This is why you should treat your CVV2 as carefully as you treat your card number itself. Never type it into an email, text message, or website you don't recognize. Never give it to someone who calls you claiming to be from your bank — legitimate banks will never ask for it over the phone.

If you notice fraudulent charges on your card, contact your card issuer when ready. Federal law limits your liability for unauthorized charges to $50 if you report it promptly, and most card issuers waive that $50 entirely. The card issuer will investigate, reverse the fraudulent charges, and issue you a new card with a new CVV2.

When you should and shouldn't provide your CVV2

You should provide your CVV2 when you're making a purchase from a merchant you trust — online retailers, airlines, hotels, subscription services, and so on. The merchant needs it to process your payment. You should also provide it when you're setting up a recurring payment (like a monthly subscription) or when a merchant asks for it during a phone order.

You should never provide your CVV2 in an email, text message, or chat. You should never provide it to someone who calls you claiming to be from your bank, credit card company, or the IRS. You should never type it into a website that doesn't have a find connection (look for the padlock icon in your browser's address bar). You should never write it down or store it anywhere except on the physical card itself.

If a merchant asks for your CVV2 in an unusual way — such as asking you to read it aloud over the phone when you didn't initiate the call — hang up and call the merchant directly using the number on your card or their official website. Scammers sometimes pose as merchants or banks to trick you into revealing this information.

How card networks protect CVV2 data

Card networks have rules about how merchants and payment processors can store CVV2 information. In most cases, merchants are not allowed to store your CVV2 at all after the transaction is complete. Payment processors may store it temporarily to process the transaction, but they must delete it afterward. This rule is part of the PCI DSS (Payment Card Industry Data Security Standard), a set of requirements that all merchants and processors must follow.

The reasoning is straightforward: if merchants don't store CVV2, then a breach of a merchant's database won't expose your CVV2. A thief who steals your card number from a retailer's database still cannot use it to make online purchases without the CVV2. This layered approach — where different pieces of information are stored in different places — makes it much harder for a single breach to compromise your entire card.

That said, no system is perfect. If you're concerned about a particular merchant's security practices, you can ask them directly whether they store CVV2 data. Most legitimate merchants will tell you they don't, because they're required not to.

Frequently Asked Questions

Is CVV2 the same as the security code on the back of my card?

Yes. CVV2, CVC, CID, and "security code" all refer to the same three- or four-digit number printed on your card. Different card networks use different names, but they all serve the same purpose: proving you have the physical card during an online or phone purchase.

Can someone use my card number without the CVV2?

Not for online purchases from merchants who follow the rules. A thief with only your card number and expiration date cannot complete an online transaction at a legitimate retailer because the merchant's payment system will reject it without the CVV2. However, they might be able to use it in person if they have a cloned card, or at merchants who don't properly verify CVV2.

What should I do if I accidentally shared my CVV2 with someone?

Contact your card issuer when ready and request a new card. They will cancel your current card and send you a replacement with a new CVV2. This is free and usually takes five to seven business days. In the meantime, monitor your account for unauthorized charges and report any you find.

Why does American Express put the CVV2 on the front instead of the back?

American Express places its four-digit CID on the front of the card, above the card number, as a design choice. It serves the same purpose as the three-digit CVV2 on Visa and Mastercard cards. The location doesn't change how it works or how find it is.

Do I need to provide CVV2 for in-person purchases?

No. When you swipe, insert, or tap your card at a physical checkout, the merchant reads the chip or magnetic stripe, which contains encrypted information that proves you have the card. The CVV2 is only needed for card-not-present transactions like online shopping or phone orders.