Card Verification Value 2, or CVV2, is a three-digit number printed on the back of credit cards that adds another layer of security in phone and online transactions, where the merchant is not able to physically inspect the card. Major credit cards employ similar codes, although they use different names for the feature.
The term CVV2 applies to Visa cards. MasterCard calls its version CVC2, for "Card Verification Code 2." Discover uses the term "CID," for "Card Identification Number." American Express refers to it variously as the CID, "Card Security Code" or "Verification Number." You may see any of these terms applied to any card, as they're essentially interchangeable.
Visa, MasterCard and Discover all use three-digit security codes. American Express uses a four-digit code. On Visa, MasterCard and Discover cards, the code appears on the signature panel on the back of the card. The panel has two number blocks: one with four digits and one with three digits. The first number is the last four digits of the account number. The second is the CVV2, CVC2 or CID. On American Express cards, the code appears on the front of the card, near the end of the account number. The security code is printed flat on the card, not raised like the account number, expiration date and other information.
The CVV2 and similar codes are designed for use in "card is not present" transactions, such as sales made over the phone or Internet. The number is printed on the card, but it is not stored on the card's magnetic strip, so using a card reader to capture information from the strip will not reveal the security code. The only way to know the code, then, is to have the card in your possession. Retailers ask phone and Internet customers to provide the code, which the retailers then submit to the credit card company for verification.
The security feature is called "CVV2" or "CVC2" because it's one of two verification codes on the card. The first, which is the CVV1 or CVC1, is stored on the card's magnetic strip but is not printed anywhere on the card. This is designed to ensure that in transactions in which the card should be present, such as a purchase in a store, the buyer is using the actual credit card, not just giving the merchant information copied down from looking at the card.
Merchants are not required to ask for the CVV2 when taking a phone or Internet order. If they don't, Visa warns that they are at greater risk of "chargebacks," where the sale is refunded due to fraud. Also, credit card companies' standard agreement with merchants prohibits them from storing cards' security codes in their computers, where they could be compromised. Visa's CVV2 guide for merchants says that they can be fined if they're found to be storing the security codes.
Should I Give Out My Credit Card Security Code?
If you give out your credit card security code -- called a CVC2, CVV2, CID2 or CID code -- a thief may...