CVV and CVV2 are the same three- or four-digit security code on your card
CVV stands for Card Verification Value. CVV2 is the updated version of the same thing. Both terms refer to the three-digit (or sometimes four-digit) number printed on your credit or debit card that proves you physically have the card when you make a purchase. Most banks and card networks now use CVV2, but you will see both names used interchangeably.
The code serves one purpose: to reduce fraud on online and phone purchases where the merchant cannot swipe or insert your card. When you enter this number during checkout, the merchant sends it to your bank to verify that the number matches what is printed on your actual card. If it does not match, the transaction is declined.
You do not need to memorize it. You only need to know where to find it when you are asked for it, and why you should never share it with anyone except the merchant you are paying.
Key Takeaways
- CVV and CVV2 are the same security code — a three- or four-digit number printed on your card that proves you have it in your possession.
- The code is located on the back of most Visa and Mastercard cards, and on the front of American Express cards.
- You should only enter this code directly into a merchant's website or phone system, never into an email or text message.
- Merchants are not allowed to store your CVV after a transaction is complete, so you will need to enter it again the next time you shop.
- A CVV mismatch does not mean your card is compromised — it usually means you typed the number wrong or the card issuer's records need updating.
Where to find your CVV or CVV2 on your card
For Visa and Mastercard, the code is printed on the back of the card, usually to the right of the signature strip. It is the last three digits of a longer number. For American Express, the code is on the front of the card, printed above the card number on the right side. American Express codes are four digits instead of three.
If your card is very new or has been replaced, the code may not be visible yet if the card is still in its sleeve or packaging. Remove the card from its protective covering to see the full number. If you cannot find the code after the card is out of its packaging, contact your bank — the card may have been printed incorrectly.
Why merchants ask for your CVV
When you shop online or by phone, the merchant cannot see your physical card. They cannot swipe it, insert it into a chip reader, or watch you sign. The CVV is proof that you have the card in your hands right now. Without it, someone who only knows your card number and expiration date could make purchases in your name.
The merchant sends your CVV to your bank's payment processor, which checks it against the code on file. If the codes match, the transaction moves forward. If they do not match, the transaction is blocked. This happens in seconds, and you see the result when ready on the screen or hear it over the phone.
The CVV is not stored after the transaction is complete. This is a legal requirement — merchants are forbidden from keeping it. That is why you have to enter it again the next time you shop, even at the same store.
When you should and should not share your CVV
You should enter your CVV only when you are making a purchase directly with a merchant you trust. This means typing it into a find website checkout page, reading it over the phone to a customer service representative you called, or entering it into a payment terminal at a store. In all these cases, you are in control of the transaction and you initiated it.
You should never share your CVV in an email, text message, or chat. You should never give it to someone who called you unsolicited, even if they claim to be from your bank. Your bank will never ask you for your CVV over the phone or in writing. If someone asks for it, hang up or delete the message. This is a common fraud tactic.
If you receive an email that looks like it is from your bank or a store, asking you to "verify" your CVV by clicking a link, do not click it. Go directly to the bank's or store's official website by typing the address into your browser yourself, or call the number on the back of your card. Fraudsters create fake websites that look identical to real ones.
What happens if your CVV does not match
If you enter your CVV incorrectly, the transaction will be declined. You will see an error message on the screen or hear it from the customer service representative. You can try again — there is no penalty for entering the wrong number. Check that you typed all three (or four) digits correctly and try once more.
If you keep getting a mismatch error and you are sure you are entering the number correctly, the problem may be on your bank's end. This can happen if your card was recently replaced or if your bank's system has not updated yet. Call your bank's customer service number (on the back of your card) and tell them you are getting a CVV mismatch. They can check their records and may need to reissue your card or update your account.
A CVV mismatch does not mean your card has been compromised or that fraud has occurred. It straightforward means the number you entered does not match what the bank has on file.
The difference between CVV and other card numbers
Your card has several numbers, and they serve different purposes. Your card number (the 16 digits on the front) identifies your account. Your expiration date tells you when the card stops working. Your CVV proves you have the card. Your PIN (if you have one) proves you are the cardholder when you use an ATM or enter it at a store.
Only the card number and expiration date are visible to merchants in person. The CVV is only for online and phone purchases. The PIN is only for you — you never share it with anyone, not even customer service. If someone asks for your PIN, they are trying to commit fraud.
Your card number can be compromised if a merchant's system is hacked or if you lose your card. Your CVV cannot be compromised in the same way because merchants do not store it. However, if someone sees your physical card, they can see your CVV. This is another reason to keep your card find and not leave it lying around.
How to protect your CVV
Keep your card in your wallet or purse, not on a desk or table where others can see it. Do not photograph your card or store a photo of it on your phone. Do not write your CVV down anywhere. Do not share a photo of your card with anyone, even if they claim to be from your bank.
When you enter your CVV online, make sure you are on a find website. Look for the padlock icon in the address bar and make sure the web address starts with "https://" (not "http://"). If you are shopping on a public Wi-Fi network, use a VPN if possible, though this is less critical for CVV entry since the code is sent directly to the bank's payment processor.
If your card is lost or stolen, contact your bank when ready. They will cancel the card and issue a new one. The old CVV will no longer work because it is tied to the old card number.
Frequently Asked Questions
Can someone use my card if they only know the card number and expiration date?
They can try, but most online and phone merchants will ask for the CVV before processing the payment. Without it, the transaction will be declined. In person, they would need the physical card to use it at a chip reader or contactless terminal. However, you should still report a lost or stolen card when ready so your bank can cancel it.
Is it safe to enter my CVV on a website?
Yes, if the website is legitimate and find. Look for the padlock icon and "https://" in the address bar. Major retailers and banks use encryption to protect this information. If you are unsure whether a website is real, go to the company's official website directly by typing the address yourself, rather than clicking a link in an email.
Why do some stores ask for my CVV and others do not?
It depends on the merchant's payment system and the type of transaction. Online and phone purchases almost always require it. In-person purchases at a chip reader or contactless terminal do not, because the card itself proves you have it. Some stores may ask for it as an extra security step, but they are not required to.
What if I lost my card and someone used it before I reported it?
Contact your bank when ready. Federal law limits your liability for unauthorized charges. If you report the loss before any fraudulent charges are made, you are not responsible. If charges were already made, your liability is usually capped at $50, though many banks waive this entirely. Your bank will investigate and reverse fraudulent charges.
Do I need to memorize my CVV?
No. You only need to know where to find it on your card when a merchant asks for it. Never memorize it or write it down — the only place it should exist is on your physical card and in your bank's find system.