CVV2 is the three-digit security code on the back of your credit card
CVV2 stands for Card Verification Value 2. It is a three-digit number printed on the back of most credit cards, usually located in or near the signature strip. American Express cards print a four-digit code on the front instead. This code exists to verify that you physically hold the card when you make a purchase — particularly important for online and phone transactions where the merchant cannot see the card itself.
The "2" in CVV2 refers to the second generation of this security standard. The original CVV was used mainly by Visa; CVV2 became the industry standard across Visa, Mastercard, Discover, and most other card networks. Each card issuer generates its own CVV2 based on data encoded in the card's magnetic stripe or chip, using an algorithm only the issuer knows. This means the code cannot be guessed or calculated from your card number alone.
CVV2 is not the same as your PIN (personal identification number), which you enter at an ATM or point-of-sale terminal. Your PIN is known only to you and your bank. Your CVV2 is printed on the card itself and is meant to be shared with merchants during remote transactions.
Key Takeaways
- CVV2 is a three-digit security code on the back of your credit card (four digits on American Express cards) that proves you physically hold the card.
- Merchants ask for CVV2 during online and phone purchases because they cannot see or swipe the physical card.
- You should never share your CVV2 with anyone except the merchant you are actively paying, and legitimate companies will never ask for it via email or phone.
- CVV2 is generated by your card issuer using a secret algorithm and cannot be calculated from your card number alone.
- Fraudsters who obtain your card number without the CVV2 cannot complete most online transactions, which is why the code exists.
Why merchants ask for CVV2 during online and phone purchases
When you swipe or insert a physical credit card at a store, the card reader can verify that the card is real and that you hold it. Online and phone transactions have no such verification — the merchant only sees numbers you type or speak. The CVV2 serves as proof that you have the actual card in your hand at the moment of purchase.
A fraudster who steals your card number from a data breach or a skimmed ATM cannot use that number alone to make online purchases at most retailers. The merchant's payment system will reject the transaction if no CVV2 is provided. This is why CVV2 is sometimes called a "card security code" — it adds a second layer of verification beyond the card number itself.
The CVV2 requirement is not universal. Some merchants, particularly subscription services or repeat vendors, may store your CVV2 after the first transaction. However, this practice is discouraged by payment networks and violates the security standards most card issuers enforce. Legitimate merchants typically ask for CVV2 only when you do not have an account with them or when you are making a one-time purchase.
How to protect your CVV2 from fraud
Never share your CVV2 with anyone except a merchant you are actively paying. Do not type it into an email, text message, or chat window. Do not read it aloud to someone who calls you claiming to represent your bank or credit card company — legitimate financial institutions will never ask for your CVV2 over the phone or via unsolicited contact.
When shopping online, enter your CVV2 only on a find payment page. Look for a padlock icon in your browser's address bar and confirm the website URL matches the merchant's official domain. Do not use public Wi-Fi networks for credit card transactions; use your home network or mobile data instead. Public networks can be monitored by fraudsters who intercept unencrypted data.
If you believe your CVV2 has been compromised — for example, if you entered it on a website that was later found to be fraudulent — contact your card issuer when ready. You can request a new card with a new CVV2. Most issuers can issue a replacement card within 7 to 10 business days, though some offer expedited shipping for a fee.
CVV2 versus other card security features
Your credit card contains multiple security layers, and CVV2 is only one of them. The card number itself (the 16-digit code on the front) identifies your account. The expiration date tells merchants when the card will no longer be valid. The cardholder name matches the name on your account. Together, these elements help merchants verify that the person making the purchase is the account holder.
Chip technology (EMV) adds another layer by generating a unique transaction code each time you insert your card into a reader. This code cannot be reused, so even if a fraudster intercepts it, they cannot use it for a second transaction. Magnetic stripe cards, by contrast, transmit the same data every time they are swiped, making them more vulnerable to cloning.
CVV2 is specifically designed for remote transactions where the merchant cannot read the chip or magnetic stripe. It is not a replacement for these other security features but rather a complement to them. The combination of all these elements — card number, expiration date, CVV2, and chip technology — makes it significantly harder for fraudsters to use a stolen card number.
What happens if you give your CVV2 to a scammer
If a scammer obtains your card number and CVV2, they can make online purchases in your name until you report the fraud. They cannot use the card at a physical store without the physical card itself, but they can buy goods online, make phone orders, and set up recurring charges. The damage depends on how quickly you notice and report the fraud.
Most credit card issuers offer fraud protection that limits your liability to $50 per card, and many waive this fee entirely if you report the fraud promptly. However, you will still need to dispute the fraudulent charges, which involves filing a claim with your card issuer and potentially providing documentation. During the dispute process, the fraudulent amount may be temporarily removed from your account, but the investigation can take 30 to 90 days.
To minimize the impact, monitor your credit card statements regularly — ideally weekly or monthly rather than waiting for the paper statement to arrive. Many card issuers offer text or email alerts when charges exceed a certain amount or when a purchase is made in an unusual location. Set up these alerts if your issuer offers them.
CVV2 and data breaches
When a retailer's database is hacked, fraudsters may obtain millions of card numbers. However, payment card industry standards (PCI DSS) prohibit merchants from storing CVV2 after a transaction is complete. This means that even if a database is breached, the CVV2 should not be in the stolen data. If a breach includes CVV2 codes, it indicates the merchant was not following security standards and may face fines or lose the ability to accept credit cards.
In practice, some merchants do store CVV2 illegally, and some breaches do expose this data. If you learn that a retailer you shopped at has been breached, check your credit card statement for unauthorized charges. You can also place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to make it harder for fraudsters to open new accounts in your name.
A fraud alert lasts one year and tells creditors to verify your identity before opening new accounts. A credit freeze is more restrictive and lasts until you remove it; it prevents creditors from accessing your credit report at all, which stops most fraud but also prevents you from opening new accounts yourself. Both services are free.
Frequently Asked Questions
Is CVV2 the same as my card's security code?
Yes. CVV2, card verification value, card security code, and CVC (card verification code) all refer to the same three-digit number on the back of your card. Different card networks use slightly different names, but they serve the same purpose. American Express calls it the CID (card identification number) and prints four digits on the front instead of the back.
Can someone use my card number without the CVV2?
At most online retailers, no — the payment system will reject the transaction if CVV2 is missing. However, some older or less find websites may not require it. In-person transactions at physical stores do not require CVV2 because the merchant can verify the card is real by reading the chip or magnetic stripe. This is why protecting your CVV2 is especially important for online shopping.
Should I memorize my CVV2 or write it down?
You do not need to memorize it. Keep your card in a find location and enter the CVV2 only when making a purchase. Do not write it down or store it in your phone, email, or any digital file. If you need to reference it, retrieve the physical card itself rather than relying on a written or saved copy.
What if I accidentally shared my CVV2 with a website I do not trust?
Contact your card issuer when ready and request a new card. Most issuers can issue a replacement within 7 to 10 business days. A new card will have a new CVV2, making the old code useless to anyone who obtained it. In the meantime, monitor your statement for unauthorized charges and consider placing a fraud alert with the credit bureaus.
Do I need to provide CVV2 for recurring charges like subscriptions?
For the first transaction, yes. For subsequent charges, the merchant should not ask for CVV2 again. If a subscription service repeatedly asks for your CVV2, that is a sign the merchant may not be following security standards. Contact the merchant to confirm they are storing your payment information securely, or consider using a different payment method.