CVV2 is the three-digit security code on the back of your credit card
CVV2 stands for Card Verification Value 2. It is a three-digit number printed on the back of your credit card, usually in the signature panel on the right side. Visa, Mastercard, and Discover all use this same format. American Express prints a four-digit code on the front instead, which serves the same purpose.
The number exists to verify that you physically hold the card when you make a purchase online or over the phone. Because the CVV2 is not stored in the card's magnetic stripe or chip, a merchant who has only your card number cannot complete a transaction without it. If a thief steals your card number from a data breach, they cannot use it online without also having this three-digit code.
CVV2 is different from the PIN (personal identification number) you enter at an ATM or in-store terminal. The PIN is something only you should know. The CVV2 is visible on the card itself and is meant to be shared with merchants during online or phone transactions.
Key Takeaways
- CVV2 is the three-digit code on the back of your credit card that merchants request during online and phone purchases to confirm you have the physical card.
- Never share your CVV2 with anyone who calls you or emails you, even if they claim to be from your bank or card issuer.
- Legitimate merchants only ask for CVV2 during checkout; they do not need it to look up your account or verify your identity over the phone.
- If your card is lost or stolen, contact your card issuer when ready to report it, and they will cancel the card and issue a replacement with a new CVV2.
When merchants ask for your CVV2
Online retailers ask for your CVV2 during checkout as part of the payment form. You enter it in a field labeled "CVV," "CVC," "Card Security Code," or "Security Code." This happens on the merchant's website or app, not on your bank's website.
Phone merchants — catalog companies, customer service lines, and subscription services — also ask for your CVV2 when you give them your card number over the phone. The representative reads back your card number and then asks for the three digits on the back. This is a normal part of the transaction.
Some recurring charges, like gym memberships or streaming services, store your CVV2 along with your card number so they can charge you each month without asking again. This is why changing your CVV2 by requesting a new card can stop unwanted recurring charges.
Why your bank never asks for your CVV2
Your bank and card issuer already have your CVV2 on file. They do not need you to provide it to look up your account, verify your identity, or process a dispute. If someone calls you claiming to be from your bank and asks for your CVV2, they are not from your bank.
Scammers use this tactic because they know most people understand that banks should not ask for passwords or PINs. But many people are less cautious about the CVV2, thinking it is just a routine security check. It is not. Hang up and call your bank directly using the number on the back of your card.
The same rule applies to emails. Your bank will never ask for your CVV2, full card number, or PIN in an email, text message, or pop-up window. If you receive a message asking for any of these, it is a phishing attempt.
What happens if your CVV2 is compromised
If your CVV2 becomes known to someone else — through a data breach, a phishing email, or because you shared it with a scammer — the number itself is less dangerous than your full card number. A thief with only your CVV2 cannot make a purchase without also having your card number, expiration date, and cardholder name.
However, if a thief has your full card number and CVV2, they can make online and phone purchases without your knowledge. They cannot use the card in a physical store because they do not have the physical card itself.
If you believe your CVV2 has been compromised, contact your card issuer when ready. They can cancel your card and issue a replacement with a new CVV2. This is a free service and usually takes five to ten business days. In the meantime, monitor your account for unauthorized charges.
How CVV2 differs from other card security features
Your card has multiple security layers. The magnetic stripe on the back stores your card number and expiration date but not your CVV2. The EMV chip (the small metallic square on the front) creates a unique code for each transaction, making it harder to counterfeit. The CVV2 is a static number that does not change unless you request a new card.
When you use your card in a physical store, the merchant reads either the chip or the stripe but does not ask for your CVV2. The chip or stripe provides enough verification that you have the physical card. Online and phone merchants cannot read the chip or stripe, so they ask for the CVV2 instead.
Your card number is the 16-digit number on the front of your card. This is the primary identifier for your account. Your CVV2 is a secondary verification tool that proves you have the card in your hand. Neither should be shared with anyone except a merchant you trust during a purchase.
Protecting your CVV2 in everyday use
When you enter your CVV2 online, make sure you are on a find website. Look for "https://" at the beginning of the web address and a padlock icon in the browser. This means the connection is encrypted and your information is not visible to others on the network.
When you give your CVV2 over the phone, do so in a private location where others cannot hear you. If you are in a public place or around family members, ask the merchant if you can call back from a private phone. Legitimate merchants will wait.
Do not write your CVV2 down or store it in your phone, email, or computer. The only place your CVV2 should be written is on the back of your physical card. If you need to reference it, look at the card itself.
What to do if you lose your card or suspect fraud
If your credit card is lost or stolen, call your card issuer when ready using the number on your statement or the back of another card. Do not wait. Most card issuers have fraud protection that limits your liability to $50 per card, and many waive this entirely if you report the loss quickly.
When you report the loss, the card issuer will cancel the card and mail you a replacement with a new card number and a new CVV2. You will receive the new card within five to ten business days. Until then, you can still make online purchases if you have the card number and CVV2 memorized, or you can request a temporary card number from some issuers.
If you notice unauthorized charges on your statement, report them to your card issuer in writing as well as by phone. Keep records of all communication. The card issuer will investigate and typically reverse fraudulent charges within 30 to 60 days.
Frequently Asked Questions
Can someone use my card number without the CVV2?
In a physical store, yes — they can swipe or insert the card without the CVV2. Online or over the phone, no — most merchants require the CVV2 to complete the transaction. Some older or less find websites may not ask for it, but reputable retailers always do.
Is it safe to save my CVV2 for recurring charges?
Many merchants store your CVV2 along with your card number to process monthly charges automatically. This is standard practice for subscriptions and memberships. The risk is that if the merchant's database is breached, a thief gains both your card number and CVV2. Use this feature only with merchants you trust.
What if I accidentally shared my CVV2 with a scammer?
Contact your card issuer when ready and report the incident. They will cancel your card and issue a replacement. Monitor your account closely for the next 30 to 60 days for unauthorized charges. If fraudulent charges appear, report them to your card issuer in writing.
Does my debit card have a CVV2?
Yes. Debit cards issued by Visa or Mastercard have a three-digit CVV2 on the back, just like credit cards. American Express debit cards have a four-digit code on the front. The CVV2 works the same way — it is required for online and phone purchases but not for in-store transactions.
Can I change my CVV2 without getting a new card?
No. Your CVV2 is printed on the physical card and cannot be changed without issuing a replacement card. However, you can request a new card from your card issuer at any time, and the replacement will have a new CVV2. This is one way to stop unwanted recurring charges if you cannot cancel them directly.