What the CVV2 on Your Credit Card Actually Does

The CVV2 is a three- or four-digit security code printed on the back of your card

The CVV2 (Card Verification Value 2) is a short number on your credit card that proves you physically have the card in your hand. It sits on the back, usually in the signature strip area. On American Express cards, it appears on the front. The number is never stored in the card's magnetic stripe or chip — it only exists on the card itself and in the card issuer's records.

When you enter your card details online or over the phone, the merchant asks for this code to confirm the transaction is legitimate. A scammer who has only your card number and expiration date cannot complete a purchase without it, because they would need the physical card to read the code.

The CVV2 is different from the CVV (the code used at in-person terminals) and different from the CVC (Mastercard's name for the same thing). For your purposes, they all work the same way: they are security codes that prove you have the card.

Key Takeaways

• The CVV2 is a three- or four-digit code on the back of your card that merchants use to verify you have the physical card during online or phone purchases.
• Never share your CVV2 with anyone except the merchant you are actively paying, and never enter it on a website unless you initiated the transaction yourself.
• The CVV2 is not the same as your PIN — your PIN is for ATMs and debit card cash withdrawals, while the CVV2 is for credit card purchases.
• If someone asks for your CVV2 via email, text, or phone call claiming to be from your bank, it is a scam — your bank already has this information.

Where the CVV2 appears on different card types

On Visa and Mastercard, the CVV2 is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express, it is a four-digit code printed on the front, above the card number on the right side. Discover cards also have a three-digit code on the back.

The location matters because scammers sometimes ask you to read the code over the phone or describe where it is — a legitimate merchant will never ask you to do this. If someone calls claiming to be from your bank and asks you to read the back of your card, hang up and call your bank directly using the number on your statement.

Why merchants ask for the CVV2 during online purchases

When you shop online, the merchant cannot swipe or insert your card into a terminal. They have no way to verify you have the card except by asking for information only the cardholder would know. The CVV2 serves that purpose — it proves you are holding the card right now.

This is why checkout pages ask for it. The merchant sends your CVV2 to your card issuer (Visa, Mastercard, your bank) to verify it matches their records. If it does not match, the transaction is declined. The merchant never stores the CVV2 — they check it once and discard it. This is a legal requirement under payment card industry rules.

What the CVV2 does not protect

The CVV2 protects against card-not-present fraud — when someone has your card number but not the physical card. It does not protect against someone who steals your actual card, because they have the code right there on the back. It also does not protect against data breaches at large retailers, where hackers steal card numbers from company databases.

If your card is lost or stolen, call your card issuer immediately. They will cancel the card and issue a new one. If your card number is compromised in a data breach, your issuer will usually notice unusual activity and contact you, or they will send you a new card as a precaution.

How to keep your CVV2 safe

Never write down your CVV2 or store it anywhere — not in your phone, not in a password manager, not in an email. The only time you should enter it is during an active purchase on a website you trust, or when you are speaking directly to a merchant you called yourself.

Do not enter your CVV2 on a website unless you started the transaction. If you clicked a link in an email or text message, do not use it — go directly to the merchant's website by typing the address into your browser instead. Phishing emails often look identical to real merchant sites but steal your information.

If a website asks you to save your CVV2 for future purchases, decline. Legitimate merchants do not need it stored. Some payment systems (like Apple Pay or Google Pay) do store your card details securely, but they use encryption and tokenization — your actual CVV2 is never stored in plain text.

CVV2 versus PIN: what is the difference

Your PIN (Personal Identification Number) is a four-digit code you create when you open a debit account or request a debit card. You use it at ATMs to withdraw cash and at store terminals when you choose "debit" instead of "credit." Your PIN is secret and should never be shared.

Your CVV2 is printed on your credit card by the issuer and is used for online and phone purchases. You share it with merchants during checkout. Both are security codes, but they protect different types of transactions and work in different ways.

If you have a debit card, it has both a PIN and a CVV2. The PIN protects debit transactions at terminals and ATMs. The CVV2 protects debit card purchases online or over the phone, just like it does for credit cards.

What happens if your CVV2 is compromised

If someone has your CVV2 but not your card, they still need your full card number and expiration date to make a purchase. If someone has all three pieces of information, they can attempt online purchases. Call your card issuer immediately if you believe your CVV2 has been exposed.

Your card issuer will likely cancel your current card and send a new one with a different CVV2. Any fraudulent charges made before you reported the issue may be reversed under your card's fraud protection policy — most issuers cover unauthorized charges, though you may have a small deductible depending on your card agreement.

If you notice charges you did not make, report them to your card issuer right away. Do not wait to see if they reverse on their own. The sooner you report fraud, the faster your issuer can investigate and protect your account.

Frequently Asked Questions

Can I use my credit card online without entering the CVV2?

Most online merchants require it, but some do not — particularly if you have an account with them and have made purchases before. Older or smaller websites may not ask for it. However, reputable merchants almost always require the CVV2 for security reasons, so if a major retailer does not ask for it, double-check that you are on the correct website.

Is it safe to give my CVV2 to a customer service representative?

Only if you called the merchant directly using a phone number from your receipt or their official website. Never give your CVV2 to someone who called you, even if they claim to be from your bank or the merchant. Your bank already has this information and will never ask you for it over the phone.

What if I accidentally shared my CVV2 with a scammer?

Contact your card issuer immediately and report the incident. They will cancel your card and send a replacement. Monitor your account for unauthorized charges over the next few weeks. Most card issuers offer fraud protection that covers unauthorized purchases, so you should not be liable for fraudulent charges if you report them promptly.

Does the CVV2 change if I get a new card?

Yes. Every time your card issuer sends you a new card — whether because yours expired, was lost, or was compromised — the new card will have a different CVV2. This is why you cannot save the CVV2 for future purchases; it becomes invalid as soon as your old card is replaced.

Can merchants store my CVV2 for recurring payments?

No. Payment card industry rules prohibit merchants from storing the CVV2. If a company asks you to save it for recurring charges, they are either not following the rules or they are a scam. Legitimate subscription services store your card number and expiration date but never the CVV2.