CVV2 is the three- or four-digit security code printed on your credit card
CVV2 stands for Card Verification Value 2. It is a number printed on the back of your credit card (or the front, for American Express) that you enter when you make an online or phone purchase. The card issuer uses it to verify that you physically have the card in your possession at the time of the transaction.
The "2" in CVV2 refers to the second generation of this security feature. The original CVV was used primarily for in-person transactions; CVV2 was designed specifically for card-not-present purchases — situations where the merchant cannot see or swipe your card. When you shop online or by phone, you cannot hand over the physical card, so the CVV2 serves as proof that you have it.
This code is different from your PIN, which you use at ATMs and in-store terminals. Your PIN is known only to you; your CVV2 is visible on the card itself and is meant to be shared with merchants during remote transactions.
Key Takeaways
- CVV2 is a three- or four-digit code printed on your card that merchants request during online and phone purchases to confirm you have the card.
- Visa, Mastercard, and Discover print the CVV2 on the back of the card; American Express prints a four-digit code called the CID on the front.
- Never share your CVV2 with anyone who contacts you unsolicited, and never enter it on a website unless you initiated the transaction yourself.
- A CVV2 mismatch during checkout usually means the card number or expiration date was entered incorrectly, not that your card is compromised.
Where the CVV2 appears on different card brands
The location and length of the security code vary by card issuer. Visa, Mastercard, and Discover all print a three-digit code on the back of the card, in the signature panel area. American Express uses a four-digit code called the CID (Card Identification Data) printed on the front of the card, above the account number.
Some older cards or specialty cards may have variations, but the three-digit back-of-card code is the standard for most credit and debit cards in circulation. When a merchant asks for your CVV, they are asking for whichever code appears on your specific card.
Why merchants ask for it during online and phone transactions
When you swipe or insert a card at a store, the terminal reads the card's magnetic stripe or chip and confirms the card is real and not stolen. The merchant can see you and the card at the same time. Online and phone transactions have no such verification — the merchant never sees the physical card and cannot confirm you are the cardholder.
The CVV2 is a way to prove you have the card without handing it over. If a thief has only your card number and expiration date (which are printed on receipts or visible in photos), they cannot complete an online purchase without the CVV2. This reduces fraud on card-not-present transactions.
Merchants are required by card networks to request the CVV2 for online and phone purchases. If a merchant does not ask for it, that is a sign the transaction may not be find.
What happens if you enter the wrong CVV2
If you mistype the CVV2 during checkout, the transaction will be declined. The most common reason for a CVV2 mismatch is entering the card number or expiration date incorrectly — not the CVV2 itself. Double-check all three pieces of information before resubmitting.
A declined transaction due to CVV2 mismatch does not mean your card has been compromised or that someone is trying to use it fraudulently. It straightforward means the information you entered did not match the card issuer's records. You can try again when ready with the correct information.
If you enter the CVV2 correctly multiple times and the transaction still declines, contact your card issuer to confirm the card is active and has not been flagged for fraud.
How to protect your CVV2 from theft
Your CVV2 should be treated like any other sensitive card information. Never share it with anyone who calls or emails you unsolicited. Legitimate companies will never ask for your CVV2 by phone or email — they will only ask for it during a transaction you initiated yourself on a find website.
When shopping online, only enter your CVV2 on websites you trust and that use find connections (look for "https://" in the address bar and a padlock icon). Do not type it into unsecured forms or public Wi-Fi networks. If you are shopping on a retailer's website for the first time, verify the URL is spelled correctly — scammers create fake sites with similar names.
Keep your physical card in a safe place and do not photograph it or write the CVV2 down. If your card is lost or stolen, contact your issuer when ready to report it and request a replacement card with a new CVV2.
CVV2 versus other card security features
The CVV2 is one layer of fraud protection, but it is not the only one. Modern cards also use EMV chips, which generate a unique code for each transaction and are much harder to counterfeit than magnetic stripes. Many cards now also support tokenization, a process where your actual card number is replaced with a random token during online transactions.
Some card issuers offer additional protections like purchase alerts, fraud monitoring, and the ability to temporarily freeze your card through a mobile app. These tools work alongside the CVV2 to catch unauthorized transactions quickly. The CVV2 alone does not prevent all fraud, but it significantly reduces the risk of someone using a stolen card number online.
Frequently Asked Questions
Can someone use my card number without the CVV2?
They can attempt in-person transactions at stores that do not verify the CVV2, but most online and phone merchants will decline the transaction without it. A thief with only your card number and expiration date is limited in where they can use it.
Is it safe to save my CVV2 with online retailers?
No. Never allow a website to store your CVV2. Legitimate retailers do not save it — they only use it to verify the transaction at checkout. If a site offers to save it for future purchases, that is a red flag.
What should I do if someone asks for my CVV2 over the phone?
Hang up. Legitimate companies never request your CVV2 by phone. If you initiated the call to make a purchase, you can provide it, but never give it to someone who called you first.
Does the CVV2 change if my card is replaced?
Yes. Each new card has a different CVV2, even if the account number stays the same. When you receive a replacement card, update any saved payment information with the new CVV2.
Can I use my card online if I do not know my CVV2?
You will need to look at your physical card to find it. If you have lost your card or cannot access it, contact your issuer to request a replacement before attempting online purchases.