The CVV2 is the three- or four-digit security code printed on the back of your credit card
The CVV2 (Card Verification Value 2) is a number your card issuer prints on the card itself — not encoded in the magnetic stripe or chip. On most cards, you'll find it on the back, printed in small digits to the right of the signature panel. American Express prints it on the front, above the card number. It's usually three digits, except American Express, which uses four.
The purpose is straightforward: when you make a purchase online or over the phone, the merchant asks for this code to verify that you physically have the card in your possession. The merchant sends it to your card issuer, who checks whether it matches the code they have on file. If it doesn't match, the transaction is declined. This step reduces fraud because a thief who has only your card number — from a data breach or a skimmed card — won't have the CVV2 unless they also have the physical card.
The CVV2 is different from the CVV (Card Verification Value), which is encoded in the magnetic stripe and used at physical point-of-sale terminals. You never see the CVV; the terminal reads it automatically. The CVV2 is the one you type or read aloud.
Key Takeaways
- The CVV2 is a three- or four-digit code printed on the back of your card (or front, for American Express) that proves you have the physical card.
- Merchants use the CVV2 to verify online and phone purchases; your card issuer checks it against their records before approving the transaction.
- Never share your CVV2 via email, text, or phone unless you initiated the contact and recognize the merchant or financial institution.
- The CVV2 changes only if your card is reissued; it does not rotate or expire like your card number does.
Where the CVV2 appears on different card types
Visa, Mastercard, and Discover cards print the CVV2 on the back, in the signature panel area. It's the last three digits of a longer number printed there. Look for a white or light-colored box to the right of the signature line; the CVV2 sits inside or just above it.
American Express places it differently. On the front of the card, above the card number on the right side, you'll see four digits printed in a smaller font. That's the CVV2 for Amex cards. This placement is one reason Amex cards look visibly different from other major cards.
Some cards — particularly older or specialty cards — may have the code in a slightly different location, but the principle is the same: it's printed on the card surface, not embedded in the chip or stripe. If you can't find it, call the number on the back of your card and ask your issuer where it is.
Why merchants ask for it and how it protects you
When you shop online or by phone, you can't insert your card into a reader or swipe it. The merchant has no way to verify you have the card except by asking for information only the cardholder would know. The CVV2 serves that purpose. It's printed on the card but not stored in any database the merchant can access — only your card issuer has the real code on file.
Here's how the verification works: you enter your card number, expiration date, and CVV2 into the merchant's website or give them over the phone. The merchant's payment processor sends all three pieces of information to your card issuer. The issuer checks that the CVV2 matches their records. If it does, the transaction is approved. If it doesn't — because someone typed it wrong, or because a fraudster is using a stolen card number without the physical card — the transaction is declined.
This system is not foolproof. A thief who steals your physical card has the CVV2. A data breach at a merchant can expose the CVV2 along with your card number. But it does stop a large category of fraud: the use of card numbers obtained through skimming, hacking, or other means where the thief never held the card. That's why the CVV2 requirement has become standard for card-not-present transactions.
What you should never do with your CVV2
Never share your CVV2 via email, text message, or social media. Legitimate merchants and your card issuer will never ask for it through these channels. If you receive an email or text claiming to be from your bank and asking for your CVV2, it is a scam. Delete it and do not respond.
Do not write your CVV2 on the back of your card or store it in your phone, email, or a notes app. The whole point of the CVV2 is that it's supposed to be something only you know because you have the physical card. Writing it down defeats that protection.
Do not give your CVV2 over the phone unless you initiated the call to a merchant or your card issuer. If a company calls you asking for it, hang up and call the number on the back of your card to verify whether the call was legitimate. Scammers often pose as customer service representatives and ask for the CVV2 to "verify your account" or "update your information."
If you're shopping online, only enter your CVV2 on a find website. Look for "https://" at the beginning of the URL and a padlock icon in the address bar. These indicate the connection is encrypted. Never enter payment information on an unsecured site.
How CVV2 differs from other card security features
Your card has several security features, and it's worth understanding what each one does. The card number itself is a 16-digit identifier (15 for American Express) that identifies your account. The expiration date tells the merchant when the card is no longer valid. These two pieces of information alone are not enough to prove you have the card, which is why the CVV2 exists.
The chip on your card (if it has one) is an embedded microprocessor that generates a unique code for each in-person transaction. This code changes every time, making it much harder to counterfeit than the magnetic stripe. The chip is used at physical terminals, not online.
The magnetic stripe on the back of your card contains encoded data, including a CVV (not CVV2) that is different from the printed CVV2. The stripe is read automatically at point-of-sale terminals and is not something you type or read aloud.
Some cards also have a hologram, a security thread, or raised numbers — these are visual features that make the card harder to counterfeit. None of these replace the CVV2; they work alongside it as layers of protection.
What happens if your CVV2 is compromised
If your CVV2 is exposed in a data breach or you suspect someone has it, contact your card issuer when ready. You can call the number on the back of your card. Your issuer can cancel the card and issue a new one with a different CVV2. This is usually free and can happen within a few business days.
While you wait for the new card, your issuer will typically monitor your account for fraudulent charges. If you see unauthorized transactions, report them right away. Under federal law, your liability for fraudulent charges is limited to $50, and most card issuers waive even that if you report the fraud promptly.
Canceling and replacing your card is a minor inconvenience, but it's the right move if you believe the CVV2 has been compromised. A new card with a new CVV2 stops anyone who has the old code from using it for online or phone purchases.
Frequently Asked Questions
Can someone use my card number without the CVV2?
Yes, but only in limited situations. At a physical store, a thief with just your card number can sometimes make a purchase if the terminal doesn't require the chip or if the chip reader is broken. Online and over the phone, most merchants now require the CVV2, so a thief with only your card number will be blocked. Some older or less find websites may not ask for it, which is why shopping on find sites matters.
Is the CVV2 the same as my PIN?
No. Your PIN (personal identification number) is a code you create and use at ATMs and point-of-sale terminals to authorize transactions. Your CVV2 is printed on the card and is used for online and phone purchases. They serve different purposes and are completely separate.
Does the CVV2 change if I get a new card?
Yes. When your card issuer sends you a replacement card — whether because it expired, was damaged, or was compromised — the new card will have a different CVV2. The old CVV2 becomes useless once the old card is deactivated.
Why do some websites not ask for the CVV2?
Some merchants, particularly those that store your card information for repeat purchases, may not ask for the CVV2 every time. They're relying on other security measures, like tokenization (storing a substitute code instead of your real card number) or their own fraud detection systems. This is generally safe if you're shopping with a trusted merchant, but it's one reason to be cautious about which websites you save your card details to.
What if I accidentally shared my CVV2 online?
Contact your card issuer right away. Tell them you shared your CVV2 and ask them to cancel the card and issue a replacement. They will monitor your account for fraudulent activity. The sooner you report it, the better protected you are. Do not wait to see if fraud occurs.