What CVV2 Is and Why Websites Ask for It

CVV2 is the three-digit security code on the back of your credit card

CVV2 stands for Card Verification Value 2. It's the three-digit number printed on the back of your credit card, usually near your signature. When you buy something online or over the phone, the merchant asks for this number to verify that you actually have the card in your hand — not just the card number.

The number is different from your card number and expiration date. Your card number is embossed on the front; your CVV2 sits by itself on the back. This separation matters: if someone steals your card number online, they still can't complete a purchase without the CVV2, because they can't see the back of your physical card.

Visa, Mastercard, and Discover all use CVV2. American Express calls theirs CID (Card Identification Data) and prints it on the front instead of the back, but it works the same way.

Key Takeaways

• CVV2 is the three-digit number on the back of your credit card that proves you have the physical card when you shop online or by phone.
• The merchant never stores your CVV2 after the transaction — they use it once to verify the card is real, then discard it.
• You should never give your CVV2 to anyone who calls you or emails you, even if they claim to be from your bank.
• Legitimate websites ask for CVV2 only during checkout; they do not ask for it in emails or text messages.

Why merchants ask for CVV2 during checkout

When you enter your card number, expiration date, and CVV2 at an online store, the merchant sends all three to their payment processor. The processor checks with your card issuer (your bank) to confirm that the CVV2 matches the card number. If it does, the transaction goes through. If it doesn't, the purchase is declined.

This check happens in seconds and you never see it. The point is simple: a scammer who has your card number and expiration date from a data breach still cannot complete a purchase without the CVV2. They would need to have seen your physical card or guessed a three-digit number, which is much harder.

Phone orders work the same way. When you call a store and read your card details over the phone, the employee asks for the CVV2 for the same reason — to confirm you have the card.

What happens to your CVV2 after you enter it

Legitimate merchants and payment processors do not store your CVV2. By law and by the rules of the card networks, they must delete it immediately after the transaction is approved or declined. This is different from your card number, which they may keep on file if you ask them to for future purchases.

Because CVV2 is not stored, a hacker who breaks into a store's database cannot steal it. They can steal your card number and expiration date, which is bad enough, but not the CVV2. This is why CVV2 exists: it protects you against fraud that happens after your card number has been compromised.

When you should never give your CVV2

Your bank, credit card company, or any legitimate merchant will never ask for your CVV2 in an email, text message, or phone call that you did not initiate. If someone contacts you claiming to be from your bank and asks for your CVV2, hang up or delete the message. This is a scam.

Real banks already have your card on file. They do not need you to read it to them. If your bank suspects fraud, they will ask you to verify recent transactions or confirm your identity — not to recite your CVV2.

The same rule applies to online forms. If a website asks for your CVV2 outside of checkout — for example, in a pop-up that appears before you've selected anything to buy — close the page. Legitimate checkout pages ask for CVV2 only when you are actually paying.

The difference between CVV2 and other card numbers

Your credit card has several numbers, and they do different jobs. Your card number (the 16 digits on the front) identifies your account. Your expiration date tells the merchant when the card stops working. Your CVV2 proves you have the physical card.

Your card number is the most valuable to a thief because it can be used for online purchases and to set up recurring charges. Your expiration date is useless without the card number. Your CVV2 is useful only for a single transaction and only if the thief also has your card number and expiration date.

If you see your card number or expiration date in an email receipt or confirmation, that is normal — merchants need to show you which card you used. But you should never see your CVV2 in an email or receipt. If you do, that merchant is breaking the rules and you should contact them to report it.

How to protect your CVV2

Treat your CVV2 like you treat your card itself. Do not write it down or take a photo of it. Do not text it or email it. Do not read it to someone who calls you, even if they say they are from your bank.

When you shop online, only enter your CVV2 on secure websites. Look for "https://" at the start of the web address (the "s" means secure) and a small padlock icon in your browser. These signs mean the website encrypts your information as it travels to their server.

If you are shopping on your phone, use the store's official app when possible. Apps are generally more secure than mobile websites because they are harder for scammers to fake.

What to do if someone has your CVV2

If you accidentally gave your CVV2 to someone you did not trust — for example, you fell for a phishing email or called a number you thought was your bank — contact your card issuer right away. Call the number on the back of your card, not a number from the email or text.

Your bank can cancel your card and issue a new one. They can also watch your account for fraudulent charges. Because CVV2 is not stored anywhere, a scammer who has it cannot use it again once your card is cancelled.

If fraudulent charges appear on your account, report them to your card issuer. You are not responsible for unauthorized charges, and your bank will investigate and remove them.

Frequently Asked Questions

Is CVV2 the same as the security code on the front of an American Express card?

No. American Express calls their code CID and prints it on the front of the card, usually above the card number. Visa, Mastercard, and Discover print their CVV2 on the back. Both serve the same purpose — to verify you have the physical card — but they are in different places and have different names.

Can someone use my card number without the CVV2?

They can try, but most online stores and phone merchants will decline the transaction if the CVV2 does not match. Some older or less secure merchants might not check CVV2, so it is still possible but less common. This is why you should monitor your account regularly for charges you did not make.

What if I forgot my CVV2 and need to make a purchase?

Look at the back of your card. The CVV2 is printed there and does not change unless you get a new card. If you do not have your card with you, you can call the merchant and complete the purchase over the phone instead, reading the number from your card.

Do I need to give my CVV2 to set up a subscription or recurring payment?

Yes. When you set up a subscription (like a streaming service or gym membership), you enter your card number, expiration date, and CVV2. The merchant verifies the CVV2 once, then stores your card number for future charges. They delete the CVV2 after that first verification.

Why do some websites ask for my CVV2 even though I have saved my card?

Some merchants ask for CVV2 again for security reasons, even if you have shopped with them before. This is especially common if you are making a large purchase or if your account looks different from usual. It is a legitimate security check and you should provide it.