**Your concern is reasonable. Don’t reply with your CVV.** The email alone doesn’t prove fraud: a merchant could have discovered missing payment information while processing your order. Merchants can legitimately request a CVV for an online purchase. [PCI Security Standards Council](https://www.pcisecuritystandards.org/faqs/1319/)

The concern is asking you to send sensitive payment information through ordinary email. The two-day delay and absence of a charge don’t establish whether the sender is legitimate.

Here’s what to do:

- Contact the merchant using contact details from the website you originally purchased from, accessed independently—not links or phone numbers in the email. This follows [FTC phishing guidance](https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams).
- Ask whether they sent the request and whether your payment failed. If they need your CVV, request a secure payment page.
- If they insist on an email reply, cancel the order.
- If you already sent the CVV, call your card issuer using the number on your card and explain what happened. They can advise whether to replace the card.

A legitimate merchant should be able to provide a secure way to complete payment.