**Your concern is reasonable. Don’t send your CVV in an email reply.** The message alone doesn’t establish whether it’s fraud or a merchant handling payments poorly.

A legitimate merchant can request a CVV to authorize an online purchase. One possible explanation is that they’re processing your order manually and discovered the missing code. [PCI Security Standards Council](https://www.pcisecuritystandards.org/faqs/are-merchants-allowed-to-request-card-verification-codes-values-from-cardholders/) confirms that requesting it for payment authorization is allowed.

Asking you to email it raises a security concern. Payment information sent through email requires appropriate safeguards; you can’t establish those from this message. [PCI guidance](https://www.pcisecuritystandards.org/faqs/1310/)

Here’s what I’d do:

- Contact the merchant through a phone number or website you independently know is genuine. Avoid links or contact details supplied in the email. This follows [FTC phishing guidance](https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams).
- Ask whether they sent the request and whether your payment has been attempted.
- If you proceed, ask for a secure payment page accessed through their verified website. If they insist on an ordinary email reply, cancel the order.

The absence of a charge doesn’t authenticate the email. If you’ve already emailed the code, call your card issuer using the number on your card and explain what happened.