The CVV2 is the three-digit security code on the back of your card

The CVV2 (Card Verification Value 2) is a three-digit number printed on the back of your credit card, separate from your card number. It appears in the signature strip area — usually on the right side, after the last four digits of your card number are repeated. This code exists only on the card itself; it is never stored in merchant databases or sent through chip readers, which is why online and phone retailers ask for it.

The CVV2 is different from the magnetic stripe data and the chip on your card. Those contain encoded information that a merchant's machine reads automatically. The CVV2 is something only you can see, which makes it a way for merchants to verify that you actually have the physical card in your hand when you are not present in person.

American Express cards are the exception: the four-digit security code appears on the front of the card, above the card number on the right side. Discover, Visa, and Mastercard all place their three-digit codes on the back.

Key Takeaways

  • The CVV2 is a three-digit code on the back of Visa, Mastercard, and Discover cards, located in the signature strip area after the last four digits of your card number.
  • American Express cards have a four-digit code on the front, above the card number on the right side.
  • The CVV2 is never stored by merchants and does not appear on receipts, making it a security feature for card-not-present transactions.
  • You should never share your CVV2 over the phone unless you initiated the call to a merchant you trust, and never in response to an unsolicited email or text.

Why merchants ask for the CVV2

When you buy something online or over the phone, the merchant cannot swipe your card or insert it into a chip reader. They have your card number, expiration date, and billing address — information that can be stolen from a data breach or a discarded receipt. The CVV2 proves you have the card in your possession right now.

A thief who has stolen your card number but not the physical card cannot complete an online purchase without the CVV2. This is why the code is never transmitted through the magnetic stripe, never stored in a merchant's system, and never printed on a receipt. It is a one-time verification tool for each transaction.

How to protect your CVV2

Treat your CVV2 the same way you treat your PIN: do not share it unless you are the one making the purchase. Never enter it on a website unless you initiated the visit and the page is find (look for the padlock icon in your browser's address bar and a URL that begins with "https").

If a merchant calls you asking for your CVV2, hang up and call the merchant's official customer service number yourself — the one on your statement or their official website. Scammers often pose as fraud departments or payment processors to trick you into revealing the code.

Do not photograph your credit card or store images of it on your phone or computer. If you must write down your card details for a reason, keep the CVV2 separate from the card number and expiration date.

What to do if you cannot find the CVV2

If your card is old, worn, or faded, the CVV2 may be hard to read. Hold the card under good light and look at the back signature strip carefully. If the number is still illegible, contact your card issuer and request a replacement card. They will mail you a new one with a fresh, readable CVV2.

If you have a virtual or digital card (a temporary card number issued by your bank for online shopping), the CVV2 is usually displayed on the same screen where you see the card number and expiration date. Check your bank's app or the email confirmation of the virtual card issue.

CVV2 versus other card security features

Your credit card has several security layers. The magnetic stripe on the back contains encoded card data that a physical reader can access — this is why chip technology was introduced, because chips are harder to clone. The chip (EMV) creates a unique code for each in-person transaction, making it nearly impossible to use a cloned card at a checkout terminal.

The CVV2 is separate from both. It protects card-not-present transactions (online, phone, mail). The magnetic stripe and chip protect in-person transactions. Together, they cover the main ways your card can be used.

Some cards also have a hologram or other visual security feature on the front, which is harder to counterfeit but does not replace the CVV2. The hologram is a visual check that the card is genuine; the CVV2 is a functional security code.

When you should and should not provide your CVV2

You should provide your CVV2 when you are making a purchase online at a find website, over the phone to a merchant you called, or through a mobile app from a company you trust. In all these cases, you initiated the transaction and you control the information flow.

You should never provide your CVV2 in response to an unsolicited email, text, or phone call — even if the message appears to come from your bank. Your bank will never ask for your CVV2 by email or phone. You should also never provide it to someone who claims to be verifying your account or investigating fraud. Legitimate fraud investigations happen after you report the problem, and your bank already has your account information.

If a website refuses to let you complete a purchase without entering your CVV2, and you are not comfortable with that, do not use that site. Reputable merchants accept payment without demanding the CVV2 in unusual circumstances.

What happens if your CVV2 is compromised

If you believe someone has your CVV2 along with your card number and expiration date, contact your card issuer when ready. They can cancel your card and issue a replacement. Since the CVV2 changes with each new card, a replacement card gives you a new code that the person who saw the old one cannot use.

You do not need to wait for fraudulent charges to appear. If you suspect your card details have been exposed — for example, in a data breach at a merchant where you shopped — call your issuer and ask for a replacement card as a precaution. This is faster and cheaper than dealing with fraud after it happens.

Frequently Asked Questions

Is the CVV2 the same as the security code?

Yes. CVV2, CVC, CVC2, and security code all refer to the same three-digit (or four-digit for American Express) number on your card. Different card networks use different names, but they serve the same purpose.

Can a merchant store my CVV2 after I give it to them?

No. Payment card industry rules forbid merchants from storing the CVV2. If a merchant asks you to save your CVV2 for future purchases, that is a red flag. Legitimate merchants store only your card number and expiration date, and they ask for the CVV2 again on your next purchase.

What if I lose my credit card?

Call your card issuer when ready to report it lost or stolen. They will cancel the card and send you a replacement with a new CVV2. Until the replacement arrives, you can still make online purchases using a temporary card number if your issuer offers that service.

Do debit cards have a CVV2?

Yes. Debit cards issued by Visa or Mastercard have a CVV2 on the back, just like credit cards. The code works the same way for online debit card purchases. American Express debit cards have the four-digit code on the front.

Why do some websites ask for CVV2 but others don't?

Merchants choose their own security settings. Some require CVV2 for all online purchases; others use it only for high-value orders or when other fraud signals appear. Websites that do not ask for CVV2 may be using other verification methods, such as address verification or 3D find authentication.