CVV2 is the three- or four-digit security code printed on the back of your credit card

The CVV2 (Card Verification Value 2) is a number you'll find on the back of nearly every credit card, usually printed to the right of the signature strip. It's typically three digits, though American Express cards print a four-digit code on the front instead. This number exists for one reason: to prove you physically have the card when you're making a purchase online or over the phone.

The card issuer — your bank or credit union — prints this code during manufacturing, but they don't store it in the card's magnetic stripe or chip. That separation is intentional. When a merchant asks for your CVV2, they're asking for proof that you're holding the actual card, not just using a stolen card number they found online.

CVV2 is different from the older CVV (Card Verification Value) that was used in earlier card systems. You don't need to worry about that distinction — your card has CVV2, and that's what merchants will ask for.

Key Takeaways

  • CVV2 is the three- or four-digit security code on your card that proves you physically possess it during online or phone purchases.
  • The code is printed on the card but not stored in the magnetic stripe or chip, so a stolen card number alone cannot be used without it.
  • Never share your CVV2 with anyone except the merchant you're paying, and never enter it on a website unless you initiated the transaction.
  • Legitimate merchants always ask for CVV2 during checkout; if someone asks for it in an email or unsolicited call, it's a scam.

Where to find your CVV2 on different card types

On Visa, Mastercard, and Discover cards, the CVV2 is printed on the back of the card, usually in small numbers to the right of the signature panel. You'll see it as a standalone three-digit code with no other text around it.

American Express works differently. The four-digit code appears on the front of the card, above the account number on the right side. American Express calls this the CID (Card Identification Number), but it serves the same purpose as CVV2 on other cards.

If you can't find the code on your physical card, contact your card issuer directly — never trust a website or email that offers to tell you what it is. Your issuer can confirm the code exists and help you locate it.

Why merchants ask for CVV2 during checkout

When you buy something online, the merchant's payment system collects your card number, expiration date, and CVV2. The merchant sends this information to their payment processor, who forwards it to your card issuer for approval. Your issuer checks whether the CVV2 matches the one they printed on your card — if it doesn't, the transaction is declined.

This check happens in seconds and is invisible to you. A thief who has your card number and expiration date (information that appears on receipts or can be seen in person) still cannot complete an online purchase without the CVV2. That's why the code exists: it's a barrier between a stolen number and an actual fraudulent charge.

Phone orders work the same way. When you call a merchant to place an order, they'll ask for your CVV2 before processing the payment. This is normal and expected.

When you should and should not share your CVV2

Share your CVV2 only when you are the one initiating a purchase — you're buying something from a merchant you chose, at a time you chose. This includes online checkouts, phone orders you called in, and in-person transactions where you hand your card to a cashier (though most modern stores now use chip readers that don't require you to say the code aloud).

Never share your CVV2 in these situations: an unsolicited email asking for it, a phone call from someone claiming to be from your bank or a merchant, a text message with a link, or any website you didn't navigate to yourself. Your bank will never ask for your CVV2 by email or phone. A legitimate merchant will never ask for it outside of checkout.

If someone contacts you asking for your CVV2, it's a scam. Hang up, delete the email, or close the browser tab. Do not call the number they provided — look up the merchant's or bank's number yourself and call that instead.

What happens if someone gets your CVV2

If your CVV2 is exposed — for example, through a data breach at a merchant — the risk is real but limited. A thief with your card number and CVV2 can attempt online purchases, but they cannot use your card in a physical store or at an ATM. They also cannot change your account settings or access your bank account.

If you notice unauthorized charges on your statement, contact your card issuer when ready. Most card issuers cover fraudulent charges under their zero-liability policies, meaning you won't pay for purchases you didn't make. The process usually takes a few days to a few weeks, and you'll receive a replacement card with a new CVV2.

If you're concerned about a specific breach or exposure, ask your card issuer whether they recommend canceling the card and ordering a replacement. Many issuers will do this for free if there's been a known breach affecting their customers.

CVV2 versus other card security features

Your card has multiple layers of security, and CVV2 is just one of them. The chip embedded in modern cards (called EMV) creates a unique code for each transaction, making it nearly impossible to counterfeit. The magnetic stripe on the back contains encrypted data that's harder to clone than it used to be. Your card issuer also monitors your account for unusual spending patterns and can block suspicious transactions automatically.

CVV2 protects online and phone purchases specifically. The chip protects in-person purchases. Together, they make it much harder for a thief to use a stolen card number. No single security feature is perfect, which is why card issuers combine them and why they monitor your account for fraud.

Frequently Asked Questions

Is CVV2 the same as the security code on the back of my card?

Yes. CVV2, security code, card verification value, and CVC (Card Verification Code) are all names for the same three- or four-digit number on your card. Different card issuers and merchants use different names, but they're referring to the same thing.

Can I use my card online without providing the CVV2?

Most online merchants require it, but some may not ask if you're using a digital wallet like Apple Pay or Google Pay. These services store your card information securely and don't expose your CVV2 to the merchant. For traditional checkout forms, you'll almost always need to enter it.

What should I do if I see my CVV2 printed on a receipt?

This is a mistake by the merchant and a security problem. Contact the merchant and ask them to remove the receipt from their system. You can also report it to your card issuer. Merchants are not supposed to print the CVV2 on receipts, and doing so violates payment card industry rules.

Does my CVV2 change if I get a replacement card?

Yes. Every card has a unique CVV2, even if it's a replacement for an old card with the same account number. When your card issuer sends you a new card, the new CVV2 will be different from the old one.

Can someone steal my CVV2 just by looking at my card?

Yes, which is why you should keep your card out of sight when you're not using it and never leave it unattended. If someone photographs your card or writes down the number, they have your CVV2. This is why it's important to monitor your statements regularly and report any unauthorized charges when ready.