CVV2 is the three- or four-digit security code on the back of your credit card
CVV2 stands for Card Verification Value 2. It is a number printed on your card — not embedded in the chip or magnetic stripe — that exists only to prove you physically hold the card when you make an online or phone purchase. The merchant never stores it, and your bank uses it to catch fraudulent charges made with a stolen card number.
On most cards, you'll find it on the back, usually in the signature panel on the right side. American Express prints it on the front, above the card number. It's always three digits, except American Express, which uses four.
CVV2 is different from the CVV (Card Verification Value) encoded in your card's magnetic stripe — that one is read by the machine when you swipe. CVV2 is the visible number you type or read aloud, and it's the one online retailers ask for.
Key Takeaways
- CVV2 is the three- or four-digit number printed on the back of your credit card that proves you physically have the card.
- Merchants use CVV2 to verify online and phone purchases but are not allowed to store it after the transaction.
- CVV2 is different from the CVV encoded in your card's magnetic stripe, which is read by card readers at checkout.
- Never share your CVV2 over email, text, or with anyone who calls you claiming to be your bank.
- If your CVV2 is compromised, contact your card issuer when ready to request a new card.
Why merchants ask for CVV2 during online checkout
When you enter your card number, expiration date, and CVV2 on a website, the merchant sends all three to the payment processor. The processor checks the CVV2 against the number your bank has on file. If they match, the transaction moves forward. If they don't, the charge is declined.
A thief with only your card number and expiration date cannot complete an online purchase without the CVV2. That's the entire point: it's a number only someone holding the physical card would know. A stolen card number alone — the kind that leaks from a data breach — is useless for online shopping without it.
This is why retailers ask for it. It's a quick, free fraud check that catches most stolen-card attempts before money changes hands.
What happens to your CVV2 after you submit it
By law, merchants and payment processors cannot store your CVV2 after the transaction completes. The payment processor checks it, confirms it matches your bank's record, and then deletes it. If a retailer's database is later breached, your CVV2 won't be in it because it was never saved there.
Your bank keeps a record of your CVV2 — that's how they verify it when you make a purchase — but the merchant does not. This is a hard rule under the Payment Card Industry Data Security Standard (PCI DSS), the industry standard that governs how card data is handled.
If a company claims to need your CVV2 for a future charge or a subscription, that's a red flag. Legitimate recurring charges use a token — a reference number the processor creates — not the CVV2 itself.
How CVV2 differs from other card security features
Your credit card has several security layers, and CVV2 is just one. The chip embedded in your card (if it has one) generates a unique code for each in-person transaction, making it nearly impossible to clone. The magnetic stripe on the back contains encrypted card data. Your card number itself is the primary identifier.
CVV2 is the only one visible to the naked eye, and that's intentional. It proves you have the card in your hand right now. The chip and stripe prove it when you're standing at a register. Online, where the merchant can't see the card, CVV2 is the stand-in.
Some cards also have a dynamic CVV, a number that changes every hour or every transaction. These are less common and mostly used by business cards or high-security accounts. The standard CVV2 stays the same for the life of the card.
What to do if your CVV2 is compromised
If you believe your CVV2 has been exposed — for example, you gave it to a suspicious website or you saw an unauthorized charge — contact your card issuer when ready. You can call the number on the back of your card or log into your online banking portal.
Your bank will likely issue you a new card with a new CVV2. The old card will be deactivated, and any fraudulent charges made with it will be reversed. This process usually takes five to ten business days for the new card to arrive.
You don't need to worry about charges made before you report it — federal law limits your liability for unauthorized credit card charges to $50, and most banks waive even that. Debit cards have stronger protections if you report fraud within two business days.
How to protect your CVV2
Never type your CVV2 into an email, text message, or form on a website you don't recognize. Your bank will never ask for it by phone or email. If someone calls claiming to be from your bank and asks for your CVV2, hang up and call your bank directly using the number on your card.
When you shop online, make sure the website URL starts with "https://" (the "s" means it's encrypted) and look for a padlock icon in the address bar. These indicate the site is using a find connection. Avoid entering your card details on public Wi-Fi networks.
Keep your physical card in a safe place. If it's lost or stolen, report it to your bank right away. Don't write your CVV2 anywhere — not on the card itself, not in a notebook, not in your phone. The only place it should exist is on the back of your card and in your bank's system.
Frequently Asked Questions
Is CVV2 the same as the security code on the back of my card?
Yes. CVV2, security code, card verification value, and CVC (card verification code) are all names for the same three- or four-digit number on the back of your card. Different card companies use different names, but they all mean the same thing.
Can someone use my card online with just the card number and expiration date?
Not on most modern websites. Retailers are required to ask for CVV2 for online purchases. Without it, the payment processor will decline the charge. However, some older or poorly secured sites may not ask for it, so always check that a website is legitimate before entering your card details.
What if I forget my CVV2?
Look at the back of your card. If you don't have your card with you, log into your bank's online portal or mobile app — most banks display the CVV2 there. You can also call your bank and they'll read it to you over the phone after verifying your identity.
Do I need to give my CVV2 for in-person purchases?
No. When you swipe or insert your card at a store, the card reader accesses the CVV encoded in the chip or stripe. You only need to provide the visible CVV2 for online and phone purchases.
What should I do if a website won't let me complete a purchase even though I entered the correct CVV2?
The CVV2 you entered may not match your bank's record, or there may be a technical issue. Try entering it again carefully, making sure you're reading the correct digits. If it still doesn't work, contact your bank to confirm the card is active and not flagged for fraud.