The short answer
The 3-digit CVV is the code printed on the back of most Visa, Mastercard, and Discover cards, sitting at the right edge of the signature strip. Banks use it as a check for card-not-present transactions, meaning the purchases where nobody taps or swipes a physical card. It is not your PIN. It is not part of your account number. It is a separate secret that only the person holding the plastic is supposed to know.
Three names, one job
Every network brands it differently and the job is identical:
- CVV2 is Visa's term, 3 digits on the back.
- CVC2 is Mastercard's, also 3 digits on the back.
- CID is American Express, and that one is 4 digits printed on the front above the number.
The "2" in CVV2 and CVC2 matters. The original CVV lives in the magnetic stripe data and never gets printed anywhere a human reads. The version you type into a checkout page is a different value, generated from the account number and expiry with a key only the issuer holds.
CVV Test 3 Digit: How to Use and What It Means
Why 3 digits is enough
It is not encryption and it was never meant to be. Think of it as a shared secret between you and the bank. Someone who has your card number and expiration date, say from a breached database or a photographed receipt, still cannot complete an online order without those last three digits. That is the entire point. The code is short enough to read off the card in two seconds and useless to anyone who does not have the card in hand.
Where it must never go
I look for a few hard rules whenever this comes up:
- No legitimate merchant, bank, or processor will ask for the CVV by email, text, or phone. A request like that is a scam, full stop.
- Read it off the card and type it into the checkout form. Don't save it in a notes app, a spreadsheet, or a chat thread.
- Check that the checkout is a real business you can name and that the page is served over HTTPS before you enter anything.
- Use virtual or single-use card numbers when your bank offers them. A disposable number limits the damage if the merchant gets breached.
If you get an email saying your card needs "verification" and it asks for the code on the back, close it and go to the bank's site yourself. That pattern is one of the oldest phishing plays there is.
When the code has been exposed
Call the number on the back of the card and tell the issuer what happened. They can freeze the card, issue a replacement, and reverse charges you did not make. Pull your statement and look for small test charges, since fraudsters often run a cheap transaction first. In the US you can file a report at IdentityTheft.gov and dispute the charges under the Fair Credit Billing Act; your liability for unauthorized use is capped at $50, and most issuers waive even that.
One blunt note on card data sold online
Full card details traded in bulk are stolen details. The CVV is exactly what makes a stolen number usable for online orders, which is why it is the piece buyers ask about and the piece banks guard hardest. Buying or using someone else's card data is card fraud under federal law, and the person left holding the data is usually the easiest one to trace. Nothing about that trade is anonymous, whatever the seller claims.