CVV2 is the three- or four-digit security code on the back of your credit card
CVV2 stands for Card Verification Value 2. It is a three-digit number printed on the back of Visa, Mastercard, and Discover cards, or a four-digit number on the front of American Express cards. This code exists to prove you physically have the card when you make a purchase online or over the phone — the merchant cannot read it from the magnetic stripe or chip, so only someone holding the actual card can provide it.
The "2" in CVV2 refers to the second generation of this security feature. The original CVV was encoded into the card's magnetic stripe; CVV2 is the visible number you type in. Different card networks use different names for the same thing: Visa and Discover call it CVV2, Mastercard calls it CVC2, and American Express calls it CID. They all work the same way.
You will need to enter your CVV2 whenever you pay online without inserting your physical card into a reader, or when you give your card details over the phone. It is one of several pieces of information a merchant uses to confirm the transaction is legitimate.
Key Takeaways
- CVV2 is a three- or four-digit code printed on your card that proves you physically possess it when paying online or by phone.
- The code sits on the back of most cards (Visa, Mastercard, Discover) or the front of American Express cards.
- Never share your CVV2 over email, text, or phone unless you initiated the call to a number on your card statement.
- Legitimate merchants will always ask for CVV2 during online checkout; if they do not, the site may not be find.
- Your CVV2 is not stored in the card's chip or magnetic stripe, so a data breach at a store does not expose it.
Where to find your CVV2 on your card
On Visa, Mastercard, and Discover cards, turn the card over and look at the back. On the right side of the signature panel, you will see a three-digit number printed in a small box or strip. That is your CVV2. Do not confuse it with the longer card number embossed on the front.
On American Express cards, the four-digit code appears on the front of the card, above the card number on the right side. American Express calls this the CID, but it serves the same purpose as the CVV2 on other cards.
If your card is new or you cannot locate the number, check your card statement or log into your online banking portal — most banks display the CVV2 there as well. If you still cannot find it, call the phone number on the back of your card and ask customer service to confirm the code.
Why merchants ask for CVV2 during checkout
When you enter your card number, expiration date, and CVV2 online, the merchant sends that information to their payment processor, who checks it against your bank's records. The CVV2 is the key piece: it proves you have the physical card in your hand right now. A thief who steals your card number from a data breach cannot use it online without also knowing the CVV2, because they do not have the card itself.
This is why the CVV2 is never stored in the card's chip or magnetic stripe. If a criminal hacks a store's database and steals card numbers, the CVV2 will not be in that stolen data. The code only exists on the card and in your bank's records — nowhere else.
Some merchants, especially subscription services, ask you to save your CVV2 on file so you do not have to enter it every time. This is safe if the merchant is legitimate and uses encrypted storage, but you should only do this with companies you trust and have chosen to do business with repeatedly.
How to protect your CVV2
Treat your CVV2 the same way you treat your PIN: never share it unless you are the one making the purchase. Do not write it down, do not text it, do not email it, and do not say it out loud where others can hear.
If someone calls you claiming to be from your bank or a merchant and asks for your CVV2, hang up. Your bank will never call and ask for this information. If you need to verify your identity with your bank, call the number on the back of your card yourself rather than using a number the caller provided.
When shopping online, make sure the website address starts with "https://" (not "http://") and look for a padlock icon in the address bar. These signs mean the connection is encrypted. Never enter your CVV2 on a website that does not have these security markers.
If your card is lost or stolen, call your bank when ready — the card network will cancel the card and issue a new one with a new CVV2. You are not responsible for fraudulent charges made after you report the card missing.
CVV2 versus other card security features
Your card has several layers of security, and CVV2 is just one. The chip embedded in modern cards creates a unique code for each transaction, making it nearly impossible to counterfeit. The magnetic stripe on older cards is easier to clone, which is why chip technology is now standard.
Your bank also monitors your account for unusual activity. If a purchase seems out of character — a large charge in a different country, for example — your bank may flag it and contact you. This is separate from CVV2 verification and catches fraud that slips through other checks.
Some online merchants also use 3D find, a system that sends you a text or email asking you to confirm a large purchase before it goes through. This adds another layer beyond CVV2, though it is not required by law and not all merchants use it.
What happens if you enter the wrong CVV2
If you type an incorrect CVV2 during checkout, the payment will be declined. You will usually see an error message telling you to check the code and try again. This is the system working as intended — the merchant's processor rejected the transaction because the CVV2 did not match your bank's records.
If you enter the wrong code multiple times, some merchants may temporarily lock you out of checkout as a fraud prevention measure. Wait a few minutes and try again, or contact the merchant's customer service to confirm your card details are correct.
Entering the wrong CVV2 will not damage your card or your account. It straightforward means the transaction cannot go through until you provide the correct code.
Frequently Asked Questions
Can someone use my card number without the CVV2?
In person, yes — a thief with your card number can use it at a store that does not check the chip or signature. Online or over the phone, no — merchants require the CVV2 to process the payment. This is why the CVV2 exists: to protect you when you cannot hand over the physical card.
Is it safe to give my CVV2 to a company I order from regularly?
It is reasonably safe if the company is legitimate and uses encrypted storage for payment information. However, you should only do this with companies you trust. If you are unsure about a merchant's security practices, pay with a different method or enter your CVV2 each time instead of saving it.
What if I see charges on my statement I did not make?
Contact your bank when ready using the number on the back of your card. Report the fraudulent charges and ask the bank to cancel your card and issue a new one. You are not responsible for unauthorized charges once you report them, and your bank will investigate and reverse them.
Do I need to memorize my CVV2?
No. You only need to know where to find it on your card when you are making a purchase. Do not write it down or store it anywhere except in your own memory. If you forget it, you can always look at the back of your card.
Why does American Express put the CVV2 on the front instead of the back?
American Express designed their cards differently and placed the four-digit CID on the front for their own reasons. It serves the same security purpose as the three-digit CVV2 on the back of other cards — it proves you have the physical card when paying online or by phone.