What That 3-Digit Code on Your Credit Card Actually Does
The CVV2 is a three-digit security code printed on the back of your credit card that proves you physically have the card when you make an online or phone purchase.
The code sits on the signature strip on the back of most credit cards, usually after the last four digits of your card number. It stands for "Card Verification Value 2" — the "2" distinguishes it from an older version used only between banks. Visa calls it the CVV, Mastercard calls it the CVC, and American Express prints a four-digit version on the front. They all do the same job: they tell the merchant you have the actual card in your hand, not just the number.
When you buy something online or over the phone, you type in your card number, expiration date, and that three-digit code. The merchant sends all three to the card network to verify. If the CVV2 matches what the card issuer has on file, the transaction moves forward. If it doesn't match or is missing, the purchase gets declined. This is why a thief who steals your card number alone cannot easily use it online — they would need to guess or obtain the CVV2 as well.
Key Takeaways
- The CVV2 is a three-digit code on the back of your card that merchants ask for during online and phone purchases to verify you have the physical card.
- Never share your CVV2 in an email, text, or over the phone unless you initiated the call to a number you know is legitimate.
- Legitimate companies will never ask for your CVV2 via email or unsolicited phone call — that is a common fraud tactic.
- The CVV2 is not stored in the magnetic stripe or chip on your card, so it cannot be stolen by a card reader or skimmer.
Why Merchants Ask for It During Online Purchases
Online merchants cannot see your card in person, so they have no way to know whether you actually own it. The CVV2 acts as proof. When you enter it, the merchant's payment processor sends it to your card issuer, who checks whether that code matches the one they have printed on your physical card. If it matches, the issuer signals back that you likely have the card.
This check happens in seconds and is invisible to you. The merchant never stores your CVV2 — payment card rules forbid it. They only use it once, during that single transaction, to verify the card is real and in your possession. This is why you have to enter it every time you shop online, even at the same store. Each purchase requires a fresh verification.
How It Differs From Your Card Number
Your 16-digit card number is printed on the front of your card and appears on receipts, statements, and anywhere you use the card. It is the primary identifier that links the transaction to your account. The CVV2, by contrast, is printed only on the physical card itself — not on receipts, not in your email confirmations, not in your online account.
This separation is intentional. If someone steals your card number from a receipt or a data breach, they still cannot complete an online purchase without the CVV2. And if someone photographs your card or skims the magnetic stripe, they get the number but not the CVV2, because the code is not stored in the stripe or the chip. The CVV2 lives only on the printed surface of the card.
When You Should and Should Not Share It
Share your CVV2 only when you are making a purchase and the merchant is asking for it as part of the checkout process. This includes online stores, phone orders you initiated, and subscription services where you are setting up a recurring payment. In all these cases, you are in control of the transaction and you know what you are paying for.
Never share your CVV2 in response to an unsolicited email, text, or phone call — even if the message appears to come from your bank or a company you recognize. Legitimate banks and merchants will never ask for your CVV2 via email or an incoming call. If someone contacts you asking for it, hang up or delete the message and call the company directly using a phone number from your statement or their official website. This is one of the most common fraud tactics, and it works because the CVV2 is the one piece of information that proves you have the card.
What Happens If Your CVV2 Is Compromised
If your CVV2 becomes known to a fraudster — through a phishing email, a fake website, or because you shared it with someone you thought was legitimate — contact your card issuer immediately. Tell them you believe your CVV2 has been compromised. Most issuers will cancel your current card and send you a replacement with a new CVV2.
The good news is that a CVV2 alone is not enough to make a purchase. A fraudster would need your card number, expiration date, and CVV2, plus a billing address that matches what the issuer has on file. Even with all of that, many merchants and payment processors run additional fraud checks. If you catch the compromise quickly and report it, your card issuer can block any unauthorized charges before they post to your account.
American Express and Other Card Networks Use Different Formats
Visa and Mastercard print a three-digit CVV2 on the back of the card, after the last four digits of your card number. American Express prints a four-digit code on the front of the card, to the right of the card number. This four-digit code is called the CID (Card Identification Data), but it serves the same purpose as the CVV2 — it verifies you have the physical card.
Discover cards also use a three-digit code on the back, similar to Visa and Mastercard. When you are shopping online, the checkout form will ask for whichever code applies to your card type. If you are unsure where to find it, look at the back of your card first — that is where most codes are printed. For American Express, check the front.
How to Protect Your CVV2
Treat your CVV2 like you would your PIN at an ATM — keep it private and never write it down or store it anywhere. Do not take photos of your card that show the CVV2, and do not email it to anyone. When you are shopping online, make sure you are on a secure website — the URL should start with "https://" and there should be a small padlock icon in the address bar.
If you shop on your phone or computer, use a secure network, not public WiFi at a coffee shop or airport. Public networks are easier for fraudsters to intercept. Also, be cautious about saving your card information on websites, even if they offer the convenience. The more places your card details are stored, the more opportunities there are for a breach. If a website offers to save your CVV2, decline — no legitimate site should store it.
Frequently Asked Questions
Can someone use my card number without the CVV2?
They can attempt to, but most online merchants and payment processors will decline the transaction if the CVV2 is missing or incorrect. In-person purchases do not require a CVV2 because the merchant can see your card. But for online and phone orders, the CVV2 is a required security check.
Is the CVV2 the same as my PIN?
No. Your PIN is a number you create and memorize to withdraw cash or check your balance at an ATM. Your CVV2 is printed on your card by the issuer and is used only to verify online and phone purchases. You should never share your PIN with anyone, and you should never share your CVV2 either.
What if I enter the wrong CVV2 by accident?
The transaction will be declined. You can try again with the correct code. If you enter an incorrect CVV2 multiple times in a short period, your card issuer may temporarily block the card as a fraud precaution. If this happens, call your issuer to confirm the legitimate attempts and have the block removed.
Do I need to memorize my CVV2?
No. You only need to know where to find it on your card when you are making a purchase. Keep your card with you or nearby when you shop online. Never memorize it or write it down — that increases the risk of someone else finding it.
Will my CVV2 change if I get a replacement card?
Yes. Every time your card issuer sends you a new card — whether because the old one expired, was lost, or was compromised — the new card will have a different CVV2. This is why you cannot save your CVV2 for future purchases; you have to enter it fresh each time.