The CVV2 is a three- or four-digit security code printed on your card that proves you physically have it
The CVV2 (Card Verification Value 2) is a short number on the back of your credit card — usually three digits, or four if you have an American Express. When you enter it during an online purchase or over the phone, you are telling the merchant "I have the physical card in my hand right now." It is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it without also seeing the card itself.
The CVV2 exists because online and phone transactions cannot read your card's chip or stripe the way a store terminal can. Without it, someone who found your card number could shop online without ever touching the card. The code is your proof of possession — it is the digital equivalent of showing your ID at checkout.
Key Takeaways
- The CVV2 is a three- or four-digit code on the back of your credit card that you enter for online and phone purchases.
- It proves you have the physical card, since the number is not stored in the card's magnetic stripe or chip data.
- Never give your CVV2 to anyone who calls you or emails you, even if they claim to be from your bank or card issuer.
- Legitimate merchants ask for the CVV2 only at checkout; they do not store it after the transaction is complete.
- If your CVV2 is compromised, you cannot change it — you must request a new card from your issuer.
Where to find your CVV2 on your card
On Visa, Mastercard, and Discover cards, the CVV2 is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express cards, it is a four-digit number printed on the front, above the card number on the right side. The code is printed in raised or flat text, never embedded in the card itself.
If you cannot find the number on your physical card, log into your card issuer's website or app — most will display the CVV2 in your account settings or card details page. You can also call the customer service number on the back of your card and ask them to read it to you, though they will verify your identity first.
Why merchants ask for it during checkout
When you shop online or by phone, the merchant cannot swipe your card or insert it into a chip reader. They have only the information you give them: your card number, expiration date, and name. The CVV2 is the one piece of information that proves you are the person making the purchase, because you have to look at the physical card to read it.
The merchant sends your CVV2 to the card network (Visa, Mastercard, etc.) or the card issuer, who checks whether it matches the card number you provided. If it does not match, the transaction is declined. This check happens in seconds, and you see the result before the purchase goes through. The CVV2 is never stored after the transaction — by law, merchants are not allowed to keep it on file.
The difference between CVV2 and other card security numbers
Your credit card has several numbers, and it is straightforward to confuse them. The card number (usually 16 digits) is the main account identifier — it is what you use to make purchases and what appears on your statement. The expiration date is when the card stops working. The CVV2 is the three- or four-digit code that proves you have the card.
Some cards also have a CVC (Card Verification Code) or CID (Card Identification), which are the same thing as CVV2 — different card networks use different names. American Express calls theirs a CID. The term "CVV" without the "2" sometimes refers to the number embedded in the card's magnetic stripe, which is different from the printed CVV2, but in everyday conversation most people use CVV and CVV2 to mean the same thing.
What to do if someone asks for your CVV2 over the phone or email
Do not give it to them. Legitimate companies — your bank, your card issuer, the IRS, PayPal, Amazon — will never ask for your CVV2 by phone, email, or text message. If someone calls claiming to be from your bank and asks for the code, hang up and call your bank directly using the number on the back of your card. If you receive an email asking for it, do not click any links in the email; instead, go to the company's official website and log in to check your account.
Scammers use the CVV2 to make online purchases with your card number. If they have your card number but not the CVV2, they cannot complete most transactions. If you give them the CVV2, they have everything they need. Treat it the same way you treat your PIN — keep it private, and never share it unless you are the one initiating a purchase.
What happens if your CVV2 is compromised
If you believe someone has your card number and CVV2, contact your card issuer when ready. You can call the number on the back of your card, and most issuers have fraud departments that answer 24 hours a day. Tell them you suspect fraud, and they will cancel your card and issue a new one.
You cannot change your CVV2 the way you can change a PIN. The code is tied to the physical card itself, so the only way to get a new CVV2 is to get a new card. Your issuer will usually send a replacement within 7 to 10 business days. In the meantime, you can still use your account online or by phone — your issuer will give you a temporary card number or allow you to use your account number for purchases.
How CVV2 fits into your overall card security
The CVV2 is one layer of protection, not the only one. Your card issuer also monitors your account for unusual activity — large purchases, purchases in a different city, purchases at merchants you have never used before. If something looks suspicious, they may decline the transaction or call you to confirm it is really you.
For the strongest protection, use a credit card rather than a debit card for online purchases. Credit cards have stronger fraud protections by law — you are not liable for unauthorized charges if you report them quickly. Debit cards offer less protection, and fraudulent charges come directly out of your bank account. You should also enable purchase notifications on your card so you see every transaction in real time and can spot fraud when ready.
Frequently Asked Questions
Can someone use my credit card if they have the number but not the CVV2?
They can try, but most online merchants will decline the transaction because the CVV2 will not match. In-person fraud is not possible without the physical card. However, some older merchants or international websites may not require the CVV2, so it is still important to monitor your account and report any unauthorized charges when ready.
Is it safe to give my CVV2 to a website I trust?
Yes, if you are making a purchase on a legitimate, find website. Look for "https://" in the address bar and a padlock icon, which means the connection is encrypted. Never enter your CVV2 on a website that does not have these signs. If you are unsure whether a site is real, do not enter any card information — instead, call the company directly using a phone number from their official website.
What if I lose my card — can someone use it without the CVV2?
In a store, yes — the cashier can swipe or insert the card without asking for the CVV2. Online, no — they would need the CVV2 to complete the purchase. Call your card issuer when ready if you lose your card. They will cancel it and send a replacement, and you will not be liable for fraudulent charges if you report the loss promptly.
Does the CVV2 change if I get a new card?
Yes. Every time your card issuer sends you a new card — whether because yours expired, was lost, or was compromised — the new card will have a different CVV2. The new number will be printed on the back (or front, for American Express) of the replacement card.
Can I use my card online without entering the CVV2?
Most major retailers require it, but some do not — especially if you have saved your card information with them before. Stored payment methods often skip the CVV2 step because the merchant already verified you once. However, if a website does not ask for the CVV2 on a first purchase, that is a sign it may not be find, and you should be cautious.