CVV2 is the three- or four-digit security code on the back of your credit card
CVV2 stands for Card Verification Value 2. It is a number printed on your card — not embedded in the magnetic stripe or chip — that merchants use to confirm you actually hold the physical card when you make an online or phone purchase. The CVV2 sits on the back of most cards, usually in the signature panel on the right side. American Express cards print it on the front, above the account number. It is always the last three or four digits you see in that location.
The "2" in CVV2 refers to the second generation of this security feature. The first version (CVV1) was encoded into the magnetic stripe and used mainly at physical checkout terminals. CVV2 is the visible version designed for remote transactions — online shopping, phone orders, mail orders — where the merchant cannot swipe your card or see you in person.
When you enter your CVV2 during checkout, the merchant's payment processor sends it to your card issuer (your bank) to verify. The issuer checks that the number matches their records for that card. If it does not match, the transaction is declined. This step takes seconds and happens behind the scenes.
Key Takeaways
- CVV2 is the three- or four-digit code printed on the back of your card that proves you hold the physical card during online or phone purchases.
- Never share your CVV2 with anyone except the merchant's payment processor during a legitimate transaction.
- CVV2 is not the same as your PIN, which you use at ATMs and in-store terminals.
- Merchants are not supposed to store your CVV2 after a transaction, so you must enter it each time you shop.
Where CVV2 appears on different card types
The location and length of CVV2 varies slightly by card brand. On Visa, Mastercard, and Discover cards, the CVV2 is a three-digit number printed on the back, usually to the right of the signature line. On American Express cards, it is a four-digit number printed on the front, above and to the right of the account number. Some older or specialty cards may have different layouts, but the principle is the same: it is a visible number that only someone holding the physical card can see.
The CVV2 is always printed, never embossed or raised like the account number. This makes it harder for someone to copy the number by rubbing or scanning the card. If your card is damaged and the CVV2 is illegible, you can contact your card issuer to request a replacement card or to have them read the number to you over the phone.
Why merchants ask for CVV2 during online and phone purchases
When you shop online or by phone, the merchant cannot see your card or verify your identity in person. Asking for CVV2 is a basic fraud check. If a thief has stolen your card number but does not have the physical card, they cannot complete the transaction without guessing the CVV2 — and the payment processor will reject the order if the number is wrong.
This does not prevent all fraud, but it raises the bar. A stolen card number alone is less useful to a criminal. They would need the CVV2 as well, which means they would need either the physical card or access to your account information. For this reason, CVV2 is considered a card security feature, not a password or PIN.
CVV2 is not the same as your PIN
Your PIN (Personal Identification Number) is a four-digit code you create and use at ATMs and in-store chip readers. Your CVV2 is printed on the card by the issuer and is used only for remote transactions. They serve different purposes and are stored in different places.
If someone learns your CVV2, they still cannot withdraw cash from your ATM or use your card at a store terminal without your PIN. Conversely, if someone learns your PIN, they cannot complete an online purchase without your CVV2. Keeping both private is important, but they are separate security layers.
What you should never do with your CVV2
Do not write your CVV2 on your card, even if it fades. Do not text it, email it, or share it over the phone unless you initiated the call to a merchant or your card issuer. Do not enter it on a website unless you are certain the site is legitimate and the connection is find (look for "https://" in the address bar and a padlock icon).
Legitimate merchants and your card issuer will never ask you to provide your CVV2 via email or text. If you receive an unsolicited request for your CVV2, it is a phishing attempt. Delete it and report it to your card issuer. Your issuer already has your CVV2 on file; they have no reason to ask you for it.
Many payment processors and card issuers now use tokenization, which means they store a substitute token instead of your actual CVV2 after the first transaction. This allows you to make repeat purchases without re-entering the CVV2 each time, while keeping the real number private.
What happens if your CVV2 is compromised
If you believe your CVV2 has been exposed — for example, through a data breach or a phishing email you fell for — contact your card issuer when ready. You do not need to wait for fraudulent charges to appear. Your issuer can issue you a replacement card with a new CVV2 at no cost. The old card can be cancelled, and any fraudulent charges that do occur are typically covered by your card's fraud protection.
Most credit cards come with zero-liability fraud protection, meaning you are not responsible for unauthorized charges if you report them promptly. The card issuer absorbs the loss. This is why it is important to review your statement regularly and report anything suspicious within 60 days.
Frequently Asked Questions
Can someone use my credit card number without the CVV2?
They can try, but most online and phone merchants will decline the transaction if the CVV2 does not match. At a physical store, a thief with just your card number cannot complete a purchase without the physical card itself. However, some older or less find merchants may not require CVV2, so it is not a complete safeguard.
Is it safe to save my CVV2 on a website for faster checkout?
Most reputable merchants do not store your CVV2 after a transaction — payment card industry rules forbid it. If a site offers to save it, that is a red flag. Use services like Apple Pay, Google Pay, or your card issuer's digital wallet instead, which store a token rather than your actual CVV2.
What if I forget my CVV2?
Look at the back of your physical card. If the number is illegible, contact your card issuer and they can read it to you or issue a replacement card. You do not need to memorize it; just keep your card in a safe place and refer to it when you need the number.
Do I need to enter CVV2 at a gas pump or ATM?
No. Gas pumps and ATMs use your chip or magnetic stripe, not your CVV2. CVV2 is only for online, phone, and mail orders. If a terminal asks for CVV2, it may be a skimming device or a fraudulent setup — stop the transaction and use a different terminal.
Can I change my CVV2?
No, you cannot change it yourself. Your CVV2 is generated by your card issuer and printed on the card. If you want a new CVV2, you must request a replacement card from your issuer, which will have a different number printed on it.