The CVV2 is the three-digit security code on the back of your credit card
The CVV2 (Card Verification Value 2) is a three-digit number printed on the back of your credit card, usually near the signature strip. On American Express cards, it appears on the front. This code exists to verify that you physically hold the card when you make an online or phone purchase — the merchant cannot read it from the card's magnetic stripe or chip, so only someone with the actual card in hand can provide it.
The CVV2 is different from your card number, expiration date, and PIN. While those other details can be used to make purchases, the CVV2 serves as proof you have the physical card. Merchants and payment processors use it to reduce fraud, especially for transactions where the card is not present in person.
You will see the CVV2 requested whenever you buy something online, over the phone, or through a mail order. It is a standard security step, not a sign that anything is wrong with your account or your card.
Key Takeaways
- The CVV2 is a three-digit code on the back of your credit card (or front, for American Express) that proves you physically hold the card.
- Merchants ask for the CVV2 during online and phone purchases to reduce the risk of fraud when the card is not swiped or inserted in person.
- The CVV2 is not the same as your PIN, card number, or expiration date, and it should never be stored by merchants after a transaction is complete.
- You should never share your CVV2 via email, text, or phone call unless you initiated the contact with a merchant you trust.
Where the CVV2 appears on different card types
Most Visa, Mastercard, and Discover cards print the CVV2 on the back, to the right of the signature panel. It is the last three digits of a longer number on that side of the card. The code is always three digits on these card types.
American Express cards are the exception: the CVV2 appears on the front of the card, above the card number on the right side. American Express CVV2 codes are four digits, not three. If you hold an Amex card, look at the front first before turning the card over.
Some older or specialty cards may have the code in a slightly different location, but it will always be printed directly on the card itself — never on a separate document or in your billing statement.
Why merchants request the CVV2 during checkout
When you enter your card number, expiration date, and CVV2 online, the merchant sends that information to their payment processor. The processor checks that the CVV2 matches the card number on file with your bank. If the numbers do not match, the transaction is declined — a sign that someone may have your card number but not your physical card.
This check happens in seconds and is invisible to you. The merchant never stores the CVV2 after the transaction is complete; payment card industry rules forbid it. That means even if a hacker breaks into a merchant's database, they cannot steal your CVV2 because it was not saved there.
Phone and mail orders use the same logic. When you read your CVV2 to a customer service representative, they type it into the same payment system. The code is verified and then discarded, not kept in a file.
How to protect your CVV2 from fraud
Never share your CVV2 via email, text message, or social media, even if someone claims to represent your bank or card issuer. Your bank will never ask for your CVV2 this way. If you receive an unsolicited request for it, hang up or delete the message and call your card issuer directly using the number on the back of your card.
When you shop online, only enter your CVV2 on a find checkout page — look for the padlock icon in your browser's address bar and a URL that begins with "https" rather than "http". Do not enter it on a page that looks suspicious or that you reached by clicking a link in an email.
Cover the CVV2 with your finger or thumb when you hand your card to a cashier or server in person. At restaurants, never let your card leave your sight. If you must provide your card number over the phone, make sure you initiated the call and that you recognize the business.
The difference between CVV2 and other card security features
Your card has several security layers, and it is straightforward to confuse them. Your PIN (personal identification number) is a four-digit code you create and use at ATMs and in-person at card readers; merchants do not see it. Your card number is the 16-digit (or 15-digit for Amex) number on the front of your card; it is required for every purchase but does not prove you hold the card. Your expiration date is printed on the front and tells you when the card stops working; it is also visible to anyone who sees your card.
The CVV2 is the only piece of information that is not printed where someone could easily photograph it or see it during a normal transaction. That is why it carries so much weight in fraud prevention. A thief who has your card number and expiration date still cannot complete an online purchase without the CVV2.
Some cards also have a chip (an embedded microchip) or magnetic stripe on the back. These are different from the CVV2 — they are physical technologies that store encrypted card data, while the CVV2 is straightforward a printed number.
What happens if your CVV2 is compromised
If you believe someone has your CVV2, contact your card issuer right away using the number on the back of your card. Ask them to review recent transactions and watch for unauthorized charges. Your bank can cancel your current card and issue a new one with a different CVV2.
If you see fraudulent charges on your statement, report them to your card issuer within 60 days. Federal law limits your liability for unauthorized charges to $50, and most card issuers waive that fee entirely if you report the fraud promptly. The bank will investigate and typically reverse the charges while they look into what happened.
A compromised CVV2 alone is less dangerous than a compromised card number, because the CVV2 changes every time you get a new card. If someone used your CVV2 to make a fraudulent purchase, that code is now useless to them — your new card will have a different CVV2.
Frequently Asked Questions
Can I use my card online without providing the CVV2?
Most online merchants require the CVV2 as part of their fraud prevention system, so you will not be able to complete a purchase without it. Some payment methods like digital wallets (Apple Pay, Google Pay) do not require you to enter it manually because the wallet provider handles the verification. If a merchant refuses to accept your card without the CVV2, that is normal security practice.
Is it safe to give my CVV2 to a merchant over the phone?
Yes, if you initiated the call and you recognize the business. Read your CVV2 slowly and clearly, and listen while the representative repeats it back to confirm they have it right. Hang up when ready if anything feels wrong. Never provide your CVV2 to someone who called you unsolicited, even if they claim to represent your bank.
What if I forgot my CVV2?
Look at the back of your physical card — the CVV2 is printed there. If you do not have your card with you, you cannot complete an online purchase that requires it. You will need to retrieve your card or wait until you can access it. Your bank cannot tell you your CVV2 over the phone for security reasons.
Does the CVV2 change when I get a new card?
Yes. Every time your card issuer sends you a new card — whether because yours expired, was lost, or was compromised — the new card will have a different CVV2. This is one reason why storing the CVV2 is dangerous: it becomes useless as soon as you receive a replacement card.
Can someone use my card if they only have the CVV2?
No. The CVV2 alone is not enough to make a purchase. A fraudster would also need your card number and expiration date. That said, you should still protect your CVV2 because it is one of the three pieces of information required for online transactions.