CVV2 is the three-digit security code on the back of your credit card

CVV2 stands for Card Verification Value 2. It's a three-digit number printed on the back of your card, usually near the signature strip. American Express cards have a four-digit code in the same spot, but it works the same way. This number is not embossed into the card like your account number — it's printed on top, which matters for security reasons you'll see in a moment.

The number exists to prove you physically have the card in your hand. When you shop online or over the phone, you can't swipe your card or insert it into a reader, so the merchant asks for this code. If you have the CVV2, you have the physical card. If you don't, you're probably not the real cardholder.

Visa, Mastercard, and Discover all use the term CVV2. American Express calls theirs CID (Card Identification Data), but the purpose is identical. Most people just call all of them "the security code" or "the three-digit code," and that's fine — merchants understand what you mean.

Key Takeaways

  • CVV2 is a three-digit number on the back of your card that proves you physically have it when you can't swipe or insert it.
  • The code is printed, not embossed, so it doesn't appear on your receipt or bank statement, keeping it more private than your account number.
  • You should never share your CVV2 with anyone except the merchant you're paying right then, and never save it in a browser or app.
  • A merchant who asks for your CVV2 over the phone or email is following security rules, not being suspicious.

Why merchants ask for it during online and phone purchases

When you swipe or insert your card in person, the card reader talks directly to your bank. The bank checks that the card is real, that you have money, and that the card hasn't been reported stolen. The merchant never sees your full account number during that conversation.

Online and phone purchases don't work that way. The merchant types your full card number into their system, and your bank has to trust that the merchant really has your permission. The CVV2 is the proof. If someone stole your card number but doesn't have the physical card, they can't produce the CVV2. So the merchant asks for it, sends it to your bank along with the card number, and your bank says "yes, this person has the card" or "no, they don't."

This is why the code is printed on the card instead of embossed: embossed numbers show up on receipts and statements, but CVV2 doesn't. Your bank and the merchant see it for that one transaction, then it's gone from the record. If someone hacks into a merchant's computer and steals card numbers, the CVV2 won't be there.

Where to find your CVV2 and how to read it

Turn your card over. On the back, you'll see a white or light-colored strip where you sign your name. To the right of that strip (or sometimes below it), there's a three-digit number printed in small type. That's your CVV2. On American Express, the four-digit code is on the front, above your account number on the right side.

The number is always just numbers — no letters. It's small and easy to miss if you're not looking for it. If you can't find it, call the customer service number on the back of your card. They can read it to you over the phone, though they'll ask security questions first to make sure you're the cardholder.

When you should and shouldn't share your CVV2

Share your CVV2 only when you're making a purchase from a merchant you trust, right then. That means online checkout, phone orders, or in-person transactions where the card reader asks for it. After the transaction is done, you're finished with it.

Never share your CVV2 in an email, text, or chat. Never save it in your browser's autofill or in a password manager. Never give it to someone who calls you claiming to be from your bank — your bank already has your card information and will never ask for the CVV2 over the phone. If someone emails you asking for it, that's a scam. Delete it and report it to your bank.

If a merchant's website asks you to save your CVV2 for future purchases, that's a red flag. Legitimate merchants don't store CVV2 codes. They store your card number and other details, but the security rules of the payment industry (called PCI compliance) forbid them from keeping the CVV2. If a site says it will save the code, don't use that site.

What happens if someone has your CVV2 but not your card

If a scammer has your card number and CVV2 but doesn't have the physical card, they can still make online and phone purchases. They have everything they need. This is why you should treat your CVV2 as seriously as your card number — they're a team.

The good news is that your bank's fraud protection covers unauthorized charges, whether the scammer had your CVV2 or not. If you spot a charge you didn't make, call your bank right away. They'll investigate, and you usually won't be responsible for the fraudulent amount. The process takes a few weeks, but your money comes back.

To lower the risk, don't use the same card for every online purchase. If you have multiple cards, rotate them. Watch your statements every week, not just once a month. And never use public WiFi to shop online — use your home network or your phone's data connection instead.

How CVV2 differs from other card numbers and codes

Your card has several numbers, and they do different things. Your account number (the long number on the front) identifies which account the card is tied to. Your expiration date tells you when the card stops working. Your CVV2 proves you have the card. Your PIN (if you set one up) proves you're the cardholder when you use an ATM or debit card.

The account number and expiration date show up on receipts, statements, and anywhere you've saved your card. The CVV2 and PIN do not. That's the key difference. If someone sees your full card number and expiration date, they still can't shop online without the CVV2. If they have all three, they can — which is why you protect the CVV2 like you protect the card itself.

Some cards also have a CVC or CVC2 code, which is the same thing as CVV2 — just different names for the same security feature. Visa uses CVV2, Mastercard uses CVC2, Discover uses CVV2, and American Express uses CID. They all work the same way.

Frequently Asked Questions

Is it safe to type my CVV2 into a website?

Yes, if the website is legitimate and uses encryption. Look for a padlock icon in your browser's address bar before you enter any card information. That padlock means the site is encrypted, so your CVV2 travels safely. Never enter it on a site without the padlock, and never enter it if the web address starts with "http" instead of "https."

Can my bank see my CVV2?

Your bank sees it when you make a purchase, but they don't store it. They use it to verify the transaction, then it disappears from their records. If you call your bank and ask them to read your CVV2 back to you, they can't — they don't have it on file.

What if I accidentally shared my CVV2 with someone?

Call your bank right away and tell them. They can't change the CVV2 on your current card, but they can watch for fraudulent charges and issue you a new card if needed. The sooner you report it, the sooner they can protect your account.

Do I need to memorize my CVV2?

No. You only need it when you're making a purchase, so you can look at your card at that moment. Don't write it down or save it anywhere. The only time you should have it memorized is if you use the same card so often that you naturally remember it — but even then, it's not necessary.

Why does my debit card have a CVV2?

Debit cards work the same way as credit cards for online and phone purchases. The CVV2 proves you have the card. The difference is that a fraudulent debit card charge comes directly from your bank account instead of a credit line, so report it even faster — within two business days if you want full protection under federal law.