What CVV2 Is and Why Websites Ask for It

CVV2 is the three-digit security code on the back of your credit card

The CVV2 (Card Verification Value 2) is a three-digit number printed on the back of your credit card, usually near the signature strip. Visa, Mastercard, and Discover all use this same format. American Express prints a four-digit code on the front instead, but it serves the same purpose.

When you buy something online or over the phone, the merchant asks for this number to verify that you physically have the card in your hand. It is a basic security check — the merchant cannot process the payment without it, and the number is not stored on the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online.

The CVV2 is different from your card number, expiration date, and cardholder name. Those four pieces of information together are what a merchant needs to charge your card. The CVV2 is the extra step that proves you own the card.

Key Takeaways

• CVV2 is the three-digit code on the back of your credit card that merchants request during online and phone purchases to confirm you have the physical card.
• Never share your CVV2 with anyone except the merchant you are actively paying, and never enter it on a website unless you initiated the transaction yourself.
• If a website or caller asks for your CVV2 without you starting the purchase, it is a sign of fraud and you should hang up or close the browser tab.
• Your CVV2 is not the same as your card number — it is a separate security layer that makes it harder for stolen card numbers to be used online.

Why merchants ask for CVV2 during online and phone purchases

Online and phone transactions are riskier for merchants than in-person purchases because they cannot see your card or check your ID. The CVV2 is one way to reduce that risk. When you type it in, the payment processor checks it against the number on file with your bank. If it matches, the merchant knows you have the physical card.

This does not prevent all fraud — a thief who has your card number, expiration date, and CVV2 can still make a purchase. But it does stop someone who only has your card number from using it online, because they do not have the three-digit code. It is a speed bump, not a wall.

Merchants are also required by their payment processors to ask for CVV2 on certain types of transactions. Visa, Mastercard, and Discover have rules about when the code must be collected. If a merchant does not ask for it when they should, they may be liable if the charge turns out to be fraudulent.

Where CVV2 appears on different card types

On Visa, Mastercard, and Discover cards, the CVV2 is always on the back, printed to the right of the signature strip. It is usually the last three digits of a longer number. Look for it on the back of your card — it will be a standalone three-digit code, not part of your main card number.

American Express is different. The four-digit code, called the CID (Card Identification Data), is printed on the front of the card, above the card number on the right side. If you have an Amex, look there instead of the back.

Some cards do not have a visible CVV2 printed on them at all. Virtual cards, temporary card numbers issued by your bank for online shopping, may have a CVV2 that appears only in your bank's app or online portal. If you cannot find it printed on the card, log into your bank's website or app and look for the card details section.

When you should and should not share your CVV2

Share your CVV2 only when you are actively making a purchase from a merchant you trust. This means you initiated the transaction — you went to their website, found the item you wanted, and clicked checkout. At that point, entering your CVV2 is normal and expected.

Never share your CVV2 if someone calls you, texts you, or emails you asking for it. Your bank will never ask for your CVV2 by phone or email. If a caller claims to be from your bank or credit card company and asks for this code, hang up immediately. This is a common fraud tactic.

Do not enter your CVV2 on a website unless you started the purchase yourself. If you clicked a link in an email or text message and landed on a checkout page, close the browser and go directly to the merchant's website by typing the address yourself. Phishing emails often look real but lead to fake checkout pages designed to steal your card information.

How CVV2 protects you and what it does not protect against

CVV2 protects you against one specific type of fraud: someone using your card number online without having the physical card. If a thief steals your card number from a data breach or a skimmed ATM, they cannot use it to shop online because they do not have the three-digit code.

CVV2 does not protect you if someone has all four pieces of information: your card number, expiration date, cardholder name, and CVV2. A thief with all four can make online purchases just as easily as you can. It also does not protect you against in-person fraud — if someone steals your physical card, they can use it at a store or ATM without needing the CVV2.

Your credit card company and your bank offer fraud protection that goes beyond CVV2. If someone makes an unauthorized charge on your card, you can dispute it and usually get your money back. Federal law limits your liability to $50 if you report the fraud quickly, and most card companies waive that $50 as well. CVV2 is just one layer of security in a larger system.

What to do if your CVV2 has been compromised

If you believe your CVV2 has been stolen — for example, you entered it on a website that turned out to be fraudulent — call your credit card company right away. The number is on the back of your card. Tell them what happened and ask them to cancel your current card and issue a new one.

Your card company will send you a replacement card with a new card number and a new CVV2. This usually takes five to ten business days. In the meantime, you can still use your old card for in-person purchases if you want, but the card company may disable it for online transactions as a precaution.

Check your credit card statement for unauthorized charges. If you see any, report them to your card company immediately. You are not responsible for fraudulent charges if you report them promptly, but the sooner you call, the faster the investigation moves.

CVV2 versus other card security features

Your credit card has several security features working together. The chip (the small metal square on the front) protects you during in-person purchases by creating a unique code for each transaction that cannot be reused. The magnetic stripe on the back is older and less secure, but some older card readers still use it. The CVV2 protects online and phone purchases.

None of these features work alone. A thief with your card number and expiration date still cannot shop online without the CVV2. A thief with your card number, expiration date, and CVV2 still cannot use your card in a store if the chip is working properly. Together, they create multiple barriers to fraud.

Newer security methods are emerging, like tokenization (where your card number is replaced with a random code for each purchase) and biometric verification (using your fingerprint or face to confirm a purchase). But CVV2 remains the standard for online shopping and is not going away soon.

Frequently Asked Questions

Is it safe to type my CVV2 into a website?

Yes, if you initiated the purchase and you are on the real merchant's website. Look at the web address to make sure it starts with "https://" (the "s" means it is encrypted) and matches the merchant's official domain. If you are unsure whether you are on the real website, close the browser and go directly to the merchant by typing their address yourself.

Can someone use my card if they only have my card number and expiration date?

They can try, but most online merchants will reject the transaction if the CVV2 is missing or wrong. In-person purchases do not require CVV2, so a thief with your card number could potentially use it at a store if they also have a physical card or if the store's reader is not working properly. This is why monitoring your statement is important.

What if I forget my CVV2?

Look at the back of your card. If you cannot find it or your card is damaged, call your credit card company and they can tell you the code over the phone. They will verify your identity first. You can also log into your bank's website or app — many banks display your CVV2 in the card details section.

Do I need to memorize my CVV2?

No. You should not memorize it or write it down. Keep it as secure as your physical card. If you use the same merchant repeatedly, most websites allow you to save your card information so you do not have to enter the CVV2 every time — the merchant stores it securely on their end.

Why does American Express use four digits instead of three?

American Express designed their system differently from Visa and Mastercard. The four-digit code on Amex cards provides the same security function as the three-digit CVV2 on other cards. Both serve to verify that you have the physical card during online and phone purchases.