CVV2 is the three-digit security code on the back of your credit card

CVV2 stands for Card Verification Value 2. It is a three-digit number printed on the back of your credit card, usually in the signature panel on the right side. The card issuer (your bank or credit union) generates this code based on your card number and expiration date using an encryption method, but they do not store it in the card's magnetic stripe or chip. This means a merchant who swipes or reads your card cannot see the CVV2 without you telling them.

The purpose of CVV2 is to verify that you physically have the card in your hand when you make a purchase. When you enter it during an online or phone transaction, the merchant sends it to your card issuer, who checks whether it matches what they have on file. If it does not match, the transaction is declined. This protects you against fraud when someone has your card number but not the physical card itself.

CVV2 is different from the CVV (Card Verification Value) encoded in your card's magnetic stripe, which is why it has a "2" in the name. The stripe version is read automatically when your card is swiped; the CVV2 is something only you can provide by looking at the card.

Key Takeaways

  • CVV2 is the three-digit code on the back of your credit card that proves you have the physical card when making online or phone purchases.
  • Your card issuer generates CVV2 from your card number and expiration date but does not store it in the card's magnetic stripe or chip.
  • Never share your CVV2 with anyone except the merchant you are buying from, and never enter it on a website unless you initiated the transaction.
  • CVV2 protects you against fraud when your card number is stolen, because a thief cannot complete a transaction without the physical card.
  • American Express calls this code CID (Card Identification Number) and prints it on the front of the card instead of the back.

Where CVV2 appears on different card types

Most credit cards print CVV2 on the back in the signature panel. Visa, Mastercard, and Discover all follow this format. The code sits to the right of the signature line, usually after the last four digits of your card number are repeated.

American Express is the exception. Amex prints a four-digit code called CID (Card Identification Number) on the front of the card, above the card number on the right side. If you are making a purchase with an Amex card and a merchant asks for CVV2, enter the four-digit CID from the front.

Some debit cards also print a CVV2 on the back, even though they are not credit cards. The code works the same way — it verifies you have the physical card during online or phone transactions.

How CVV2 protects you during online and phone purchases

When you buy something online, you type your card number, expiration date, and CVV2 into a form. The merchant does not store the CVV2 after the transaction completes — payment processors are required by law to delete it. This means even if a hacker breaks into the merchant's database and steals card numbers, the CVV2 is not there to steal.

If someone obtains your card number through a data breach or by copying it down, they cannot complete an online purchase without the CVV2. They would need to have your physical card or know the three-digit code, which is much harder to guess or intercept than a card number alone. This is why CVV2 is required for "card not present" transactions — situations where the merchant cannot see or swipe your card in person.

Phone purchases work the same way. When you call a company to order something, you read your CVV2 to the representative. The representative enters it into their system, which verifies it before the charge goes through. Again, the representative and the company do not keep a record of the CVV2 after the transaction.

What CVV2 does not protect against

CVV2 does not protect you if someone steals your physical card. If a thief has the card itself, they have the CVV2 and can use it to make purchases in person or online. This is why you should report a lost or stolen card to your issuer when ready — they can cancel it and issue a replacement.

CVV2 also does not protect you against phishing scams where you voluntarily give your information to a fraudster. If you enter your card number and CVV2 into a fake website that looks like a real retailer, you have given away both pieces of information. The scammer can then use them to make purchases. Always check that you are on a legitimate website (look for "https" and a lock icon in the address bar) before entering your card details.

If you call a company to make a purchase, be sure you initiated the call. Never give your CVV2 to someone who called you, even if they claim to be from your bank or a retailer. Legitimate companies do not call you asking for this information.

Why merchants ask for CVV2 but cannot store it

Payment Card Industry Data Security Standard (PCI DSS) rules forbid merchants from storing CVV2 after a transaction completes. The rule exists because CVV2 is meant to be a one-time verification tool, not a permanent record. If merchants could store it, a data breach would expose millions of CVV2 codes, and the entire security feature would become useless.

When you make a purchase, your CVV2 travels to the payment processor (the company that handles the transaction between the merchant and your card issuer). The processor checks it against what your issuer has on file. If it matches, the transaction is approved. Then the processor deletes the CVV2 from their system. The merchant receives only a confirmation that the transaction went through — not the CVV2 itself.

This is why you need to enter your CVV2 every time you make an online purchase with a new merchant, even if you have saved your card number to their website. The merchant cannot retrieve the CVV2 from their files because they are not allowed to keep it.

Keeping your CVV2 safe

Treat your CVV2 like you treat your PIN at an ATM — do not write it down, do not text it, and do not email it. The only time you should enter it is when you are making a purchase you initiated yourself, on a website or over the phone with a company you trust.

Never enter your CVV2 on a website unless you see "https" in the address bar and a padlock icon, which means the connection is encrypted. If you are shopping on a public WiFi network, use a VPN (virtual private network) to encrypt your connection before entering any card details.

If a merchant asks you to provide your CVV2 in person (at a store or restaurant), that is unusual and potentially a sign of fraud. In-person transactions should use your card's chip or magnetic stripe, not the CVV2. Politely decline and ask to use a different payment method or store.

Frequently Asked Questions

Can someone use my card number without the CVV2?

For online and phone purchases, no — most merchants require the CVV2 before processing the transaction. However, someone with your card number could attempt in-person purchases at stores that do not check the CVV2, or they could try to use it for recurring charges if they have already made one purchase with you. Report any unauthorized charges to your card issuer when ready.

What if I give my CVV2 to a scammer?

Contact your card issuer right away. They can cancel your card and issue a replacement. You are not responsible for fraudulent charges if you report them promptly. Your issuer will investigate and reverse any unauthorized transactions. In the future, only enter your CVV2 on websites you trust and that you visited by typing the address yourself, not by clicking a link in an email.

Is it safe to save my CVV2 when shopping online?

No. Websites that ask you to save your CVV2 are not following PCI DSS rules. Do not save it. Legitimate retailers only ask you to save your card number, expiration date, and billing address — never the CVV2. If a site insists on saving your CVV2, use a different retailer.

Why does American Express use a different code?

American Express uses a four-digit CID instead of a three-digit CVV2 because Amex cards have a different structure and security design than Visa, Mastercard, and Discover. The CID serves the same purpose — it verifies you have the physical card — but it is longer and printed on the front. Enter all four digits when a merchant asks for CVV2.

Can I use my card online if I do not have the physical card with me?

No, not safely. If you do not have your card in front of you, you cannot see the CVV2. If you need to make a purchase and your card is not nearby, wait until you can retrieve it. Never guess at the CVV2 or use one you think you remember — entering an incorrect code will decline the transaction and may trigger a fraud alert on your account.