What a CVV2 code is
CVV2 is the 3-digit code printed on the back of Visa, Mastercard, and Discover cards. American Express prints a 4-digit code, called CID, on the front. Visa introduced CVV2 in 1999. The code sits apart from the 16-digit account number and from the data on the magnetic stripe.
Why a card shop asks for CVV2
A greeting card or gift shop that takes orders online cannot see the card. The shop asks for the CVV2 to check that the buyer holds the physical card. A stolen account number alone does not produce the code. Card networks treat the CVV2 as one fraud signal among several, along with the billing address and the address verification system result.
What a "CVV2 shop" search returns
Some search results point to sites that sell card numbers with codes attached. Those sites trade in stolen payment data. The data comes from skimmers on fuel pumps and terminals, phishing pages, and breaches of merchant systems.
Legal status
- In the United States, 18 U.S.C. § 1029 covers trafficking in unauthorized access devices, a category that includes card numbers and CVV2 codes.
- The UK Fraud Act 2006 covers possession of articles for use in fraud.
- Card network rules bar merchants from storing CVV2 after a transaction is authorized.
Rules merchants follow
PCI DSS Requirement 3.2 forbids storage of sensitive authentication data, including CVV2, after authorization. The code may pass through a payment processor during the sale. It may not be written to a database, a receipt, or a paper order form. A shop that keeps CVV2 numbers breaks the rule and raises the risk of a breach.
What to do if a code is exposed
Call the card issuer. The issuer can block the card and send a replacement. Report card-data sales to the FBI Internet Crime Complaint Center or the national fraud line. In the US, the FTC collects reports at ReportFraud.ftc.gov.
Common questions
Does a CVV2 code prove a card is valid?
No. It shows the person holds the physical card. The issuer still approves or declines the charge.
Can a gift shop require CVV2?
Card network rules allow merchants to ask for the code on card-not-present sales. Some issuers do not take part, so the field can be optional.
Is CVV2 the same as a PIN?
No. A PIN authorizes a debit or ATM transaction at a terminal. CVV2 applies to card-not-present orders.