CVV2 is the three-digit security code on the back of your credit card

CVV2 stands for Card Verification Value 2. It is the three-digit number printed on the back of your credit card, usually near your signature. Visa, Mastercard, and Discover all use this code. American Express prints a four-digit code on the front instead, which serves the same purpose.

The CVV2 exists to prove you physically have the card when you make an online or phone purchase. The merchant cannot see this number from your card statement or from processing your card in person — it only appears on the physical card itself. This makes it harder for someone who has stolen your card number alone to complete a purchase without the actual card.

When you enter your card details online, the retailer sends your CVV2 to the payment processor, who checks it against the card issuer's records. If the number matches, the transaction moves forward. If it does not match or is missing, the purchase is declined.

Key Takeaways

  • CVV2 is the three-digit code on the back of your credit card (four digits on American Express cards), and it proves you have the physical card.
  • Online and phone retailers ask for CVV2 to reduce fraud, because the code does not appear on receipts or statements.
  • Never give your CVV2 to someone who calls you or emails you claiming to represent your bank or card issuer.
  • Legitimate retailers do not store your CVV2 after a transaction completes, so you must enter it each time you shop.

Why retailers ask for CVV2 during checkout

A thief who steals your card number from a data breach or a receipt has enough information to make an online purchase — unless the retailer also asks for CVV2. Because the code is only on the physical card, the thief cannot complete the transaction without holding the card in their hands.

This is why online retailers treat CVV2 as a required field. A purchase without it raises a red flag to the payment processor, which may decline the transaction or flag it for manual review. Phone retailers ask for it for the same reason: they cannot see the card, so they need proof you have it.

CVV2 is not a perfect security measure — a thief who has both your card number and your CVV2 can still make purchases. But it stops the most common type of fraud: someone using a stolen or guessed card number without access to the physical card.

Where to find your CVV2

For Visa, Mastercard, and Discover cards, turn the card over and look at the back. The CVV2 is a three-digit number printed to the right of the signature panel. It is usually the last three digits of a longer number printed on the back.

For American Express cards, the code is on the front, above the card number on the right side. It is four digits instead of three.

Do not confuse CVV2 with the card number itself. The card number is the long string of digits on the front of the card. CVV2 is separate and much shorter.

When you should and should not share your CVV2

Share your CVV2 only when you are making a purchase from a retailer you trust, on a website you know is find, or over the phone to a business you called yourself. Look for a padlock icon in your browser's address bar before entering any card details online — this shows the website is using encryption.

Never give your CVV2 to someone who calls you, texts you, or emails you claiming to represent your bank or card issuer. Banks do not ask for CVV2 over the phone or email. If someone contacts you asking for this code, hang up or delete the message and call your card issuer directly using the number on the back of your card.

Do not write your CVV2 down or store it anywhere. The only place it should exist is on your physical card and in your memory when you need it.

Why retailers do not store your CVV2

Payment card industry rules forbid retailers from storing your CVV2 after a transaction is complete. This means that even if a retailer's database is breached, the thief cannot steal your CVV2 because it was never saved there.

This is why you have to enter your CVV2 every time you shop, even at retailers where you have saved your card on file. The retailer has your card number and expiration date, but not your CVV2. You must provide it fresh each time.

If a retailer asks you to save your CVV2 for future purchases, that is a sign something is wrong. Legitimate retailers do not do this. Do not complete the purchase, and consider reporting the retailer to your card issuer.

CVV2 versus other card security features

Your credit card has several layers of security. The card number itself is one. The expiration date is another. The CVV2 is a third. Together, these three pieces of information are usually enough to make an online purchase.

Some retailers and payment processors add a fourth layer: a password or PIN that only you know, separate from your card details. This is called two-factor authentication or 3D find, depending on the card network. If a retailer offers this option, using it adds protection against fraud.

Your card issuer also monitors your account for unusual activity. If someone makes a purchase that does not match your normal spending pattern, the issuer may decline it or call you to confirm. This is why it is important to report lost or stolen cards right away.

What to do if you think your CVV2 was compromised

If you believe someone has your card number and CVV2, call your card issuer when ready using the number on the back of your card. Do not use a number from an email or text message. Your issuer can cancel your current card and issue a new one with a different CVV2.

Review your recent transactions for any charges you do not recognize. Report any fraudulent purchases to your card issuer. Most card issuers have zero-liability policies, meaning you are not responsible for unauthorized charges if you report them promptly.

If you see fraudulent activity on your account, also place a fraud alert with the three major credit bureaus — Equifax, Experian, and TransUnion. This makes it harder for someone to open new accounts in your name. You can place a fraud alert for free by calling any one of the three bureaus.

Frequently Asked Questions

Can someone use my card number without the CVV2?

Yes, but it is harder. In-person retailers do not ask for CVV2 because they can see the physical card. Online retailers usually decline transactions without it, but some may process them anyway. This is why monitoring your account for unauthorized charges is important.

Is it safe to give my CVV2 over the phone?

It is safe if you called the business yourself and you trust them. It is not safe if they called you. Legitimate companies do not call asking for your CVV2. If someone calls claiming to be from your bank, hang up and call your bank directly.

What if I forget my CVV2?

Look at the back of your card. If you do not have your card with you, you cannot complete an online purchase that requires CVV2. You will need to retrieve your card or wait until you can access it. Some retailers may offer alternative payment methods.

Does CVV2 protect me from all credit card fraud?

No. CVV2 stops fraud where someone has only your card number. It does not protect you if someone has your physical card, or if they have your card number, expiration date, and CVV2. This is why monitoring your account and reporting suspicious activity quickly is important.