Where to Find the CVV2 on Your Credit Card
The CVV2 is the three-digit security code on the back of your card
The CVV2 (Card Verification Value 2) is a three-digit number printed on the back of your credit card, usually in or near the signature strip. It sits to the right of the card number and is separate from any other numbers on the card. This code exists only on the physical card — it never appears on your statement or receipt, and the merchant never stores it after the transaction.
The CVV2 is different from the older CVV (used on some older systems) and different from the CVC or CID codes that appear on American Express cards. But they all serve the same purpose: to verify that you actually have the card in your hand when you're making an online or phone purchase.
Visa, Mastercard, and Discover all use the term CVV2. American Express calls theirs the CID, and it's a four-digit code located on the front of the card, above the card number on the right side.
Key Takeaways
- The CVV2 is a three-digit code on the back of your credit card, positioned to the right of the signature strip.
- American Express cards have a four-digit code called the CID on the front of the card instead.
- You need the CVV2 when making online purchases or paying by phone, but never when using your card in person at a store.
- Never share your CVV2 with anyone except the merchant you're actively paying, and never enter it on a website unless you initiated the transaction.
- The CVV2 is not stored after a transaction, so it cannot be used to charge your card without your permission later.
Why merchants ask for the CVV2
When you buy something online or over the phone, the merchant cannot see you or swipe your card. The CVV2 proves you have the physical card in your possession. Without it, someone who only knows your card number and expiration date could make a purchase.
The CVV2 is a security layer that sits outside the normal card processing system. Your bank and the payment processor never store it after the transaction is complete. This means even if a merchant's database is hacked, the CVV2 cannot be stolen from their records — it was never saved there.
In-person purchases at a store do not require the CVV2 because the cashier can see the card and verify it's real. Some merchants also skip it for recurring charges (like a gym membership) after the first payment, since they already confirmed you had the card once.
How to spot the CVV2 on different card types
On Visa, Mastercard, and Discover cards, flip the card over and look at the back. The CVV2 is a three-digit number printed to the right of the signature strip — the white or gray area where you sign your name. It's usually printed in a slightly different color or font than the card itself, making it stand out a little.
On American Express cards, the code is on the front. Look above the card number on the right side — you'll see a four-digit number. This is the CID. Amex cards do not have a signature strip on the back.
If your card is brand new or the numbers have worn off over time, contact your card issuer and they can tell you the CVV2 over the phone. Never search for it online or ask someone else to read it to you.
When you should and should not enter your CVV2
Enter your CVV2 when you are making an online purchase on a website you trust, paying by phone with a merchant you called, or setting up a one-time payment. It should only be entered during checkout, in the payment section of the transaction you started.
Do not enter your CVV2 if someone emails or texts you asking for it, even if they claim to be from your bank or a store. Your bank will never ask for your CVV2 by email or phone. Do not enter it on a website unless you clicked a link you typed yourself or found through a search engine — not a link from an email or text message.
If you're unsure whether a website is real, call the merchant directly using a phone number from their official website or a bill you received. Never use a phone number from an email or text message.
What happens if someone gets your CVV2
If someone obtains your CVV2 along with your card number and expiration date, they can make online or phone purchases. However, they cannot use it repeatedly — the CVV2 is not stored after each transaction, so they would need the code again for a second purchase.
If you notice unauthorized charges on your statement, contact your card issuer immediately. Most credit cards offer fraud protection, meaning you are not responsible for charges you did not make. Your bank will investigate and typically reverse the charge within a few business days while they look into it.
To reduce the risk, never write your CVV2 down, never text it to anyone, and never enter it on a website you reached through an email link. If you think your card information has been compromised, ask your issuer to send you a new card with a new CVV2.
CVV2 versus other card security features
The CVV2 is one layer of security, but not the only one. Your card also has an expiration date, which limits how long the card can be used. Chip technology (the small square on the front of most cards) creates a unique code for each in-person transaction, making it harder to clone your card.
Online, many merchants now use 3D Secure or similar systems that send you a text or app notification to confirm a purchase before it goes through. This adds another step beyond just entering the CVV2. Some card issuers also let you set spending limits or turn your card on and off through an app.
The CVV2 alone is not enough to prevent fraud, which is why your card issuer monitors for suspicious activity and why you should check your statement regularly.
Frequently Asked Questions
Can I use my card online without entering the CVV2?
Some merchants skip the CVV2 for repeat customers or stored payment methods, but most online retailers require it for security. If a website asks for your CVV2, it's a sign they're taking security seriously. If a site never asks for it, that doesn't mean it's unsafe — it just means they've chosen a different verification method.
Is it safe to save my CVV2 on a website for faster checkout?
No. Legitimate payment processors and retailers should never store your CVV2. If a website offers to save it, that's a red flag. Use saved payment methods only if the site stores your card number and expiration date but asks you to enter the CVV2 each time.
What if I can't read the CVV2 on my card?
Call your card issuer's customer service number (on the back of your card or on your statement) and they can read it to you over the phone. They may ask you to verify your identity first. Never share your CVV2 with anyone except during an active purchase with a merchant you trust.
Do I need the CVV2 to use my card at an ATM?
No. ATMs only require your PIN (Personal Identification Number). The CVV2 is only for online and phone purchases where the merchant cannot physically see your card.
Can someone use my card if they only have the CVV2?
Not without also having your card number and expiration date. The CVV2 alone is not enough to make a purchase — a fraudster would need all three pieces of information. This is why the CVV2 is kept separate from the card number on your statement and receipt.