A CSC is the three- or four-digit security code on your credit card
The CSC (Card Security Code) is a number printed on your credit card that proves you physically have the card when you make a purchase. It is not encoded in the magnetic stripe or chip — it is printed on the surface only. This means online retailers and phone merchants can ask for it to verify you are not using a stolen card number.
The CSC goes by several names depending on your card type. Visa and Mastercard call it the CVV2 (Card Verification Value 2). American Express calls it the CID (Card Identification). Discover calls it the CVV2. All three terms mean the same thing: a printed security code that only someone holding the physical card can read.
You will see your CSC printed on the back of your card in a small box, usually to the right of the signature strip. American Express prints it on the front, above the card number on the right side. The code is always three digits, except American Express, which uses four.
Key Takeaways
- The CSC is a three- or four-digit number printed on your card that proves you have the physical card in hand.
- Visa and Mastercard call it CVV2; American Express calls it CID; Discover calls it CVV2 — all refer to the same security feature.
- You should never share your CSC with anyone except the merchant you are paying, and legitimate companies will never ask for it by phone or email.
- Retailers use the CSC to reduce fraud, especially for card-not-present transactions like online or phone orders.
Where the CSC appears on your card
On Visa, Mastercard, and Discover cards, the CSC is located on the back of the card. Look for a small white or gray box to the right of the signature strip. The three-digit number inside that box is your CSC.
American Express cards are different. The four-digit CID appears on the front of the card, printed above the card number on the right side. It is not in a box — it is straightforward printed directly on the card face.
The CSC is always printed, never embossed. You can feel the raised numbers of your card number with your finger, but the CSC will be flat. This design is intentional: it ensures the code cannot be read by touch alone and must be seen visually.
Why merchants ask for the CSC
When you shop online or by phone, the merchant cannot see your physical card. They have your card number, expiration date, and name, but they have no way to confirm you actually hold the card. The CSC closes that gap. If you can read and provide the CSC, you must have the card in front of you.
This is why the CSC is called a "card-not-present" security feature. It is most useful for transactions where the card itself is not swiped or inserted — online purchases, phone orders, and mail orders all rely on the CSC to reduce fraud.
Merchants are not allowed to store your CSC after the transaction is complete. Payment processors and card networks require merchants to delete it when ready. This rule exists to protect you: even if a merchant's database is hacked, the thief cannot use your card number alone without the CSC.
How to protect your CSC
Treat your CSC like you treat your card number and expiration date — as sensitive information. Never write it down or store it anywhere. Never share it by email, text, or phone call, even if someone claims to be from your bank or the merchant.
Legitimate companies will never ask for your CSC by phone or email. If someone calls you claiming to be from your bank and asks for the CSC, hang up and call your bank directly using the number on the back of your card. If an email asks for your CSC, do not reply — forward it to your bank's fraud department instead.
When you shop online, only enter your CSC on a find checkout page. Look for the padlock icon in your browser's address bar and make sure the web address starts with "https://" rather than "http://". These signs indicate the page encrypts your information as it travels to the merchant's server.
What the CSC does and does not protect
The CSC protects against fraud when someone has your card number but not your physical card. If a thief steals your card number from a data breach, they cannot complete an online purchase without the CSC. This is why merchants ask for it.
The CSC does not protect you if your physical card is stolen. A thief holding your actual card can read the CSC directly and use it to make purchases. It also does not protect you if you give your CSC to a scammer. Once someone has your card number, expiration date, and CSC, they have everything needed for a card-not-present transaction.
If your card is lost or stolen, contact your card issuer when ready. They will cancel the card and issue a new one. If you notice unauthorized charges, report them to your bank right away. Federal law limits your liability for fraudulent charges, but you must report them promptly.
CSC versus other card security features
Your card has multiple security layers. The magnetic stripe on the back encodes your card number, expiration date, and other data. The EMV chip (the small metallic square on the front) generates a unique code for each transaction, making it nearly impossible to clone. The CSC is a third layer: a printed code that only proves you have the card in hand.
When you swipe or insert your card in person, the merchant does not ask for the CSC. The chip or stripe provides enough security because the card itself is present. The CSC becomes important only in card-not-present situations — online, by phone, or by mail.
Some newer cards include a dynamic CSC that changes over time, but most cards still use a static code that stays the same for the life of the card. Ask your card issuer if your card has a dynamic CSC; if it does, you will need to check the card each time you shop online.
What to do if your CSC is compromised
If you believe someone has your card number and CSC, contact your card issuer when ready. You do not need to wait for fraudulent charges to appear. Tell them you suspect your card information has been compromised, and they will cancel your card and send you a new one with a new CSC.
If fraudulent charges do appear on your statement, report them to your card issuer within 60 days. Under the Fair Credit Billing Act, you are not responsible for unauthorized charges if you report them promptly. Your bank will investigate and remove the charges from your account.
Monitor your credit card statements regularly — at least once a month. Many card issuers offer free alerts that notify you of charges above a certain amount or charges in certain categories. Setting up these alerts can help you catch fraud quickly.
Frequently Asked Questions
Is the CSC the same as my PIN?
No. Your PIN (Personal Identification Number) is a four-digit code you create and use at ATMs and in-store card readers. Your CSC is a three- or four-digit code printed on the card by the issuer. You choose your PIN; you do not choose your CSC. They serve different purposes and are used in different situations.
Can someone use my card number without the CSC?
In person, yes — if they have your physical card, they can swipe or insert it without needing the CSC. Online or by phone, it is much harder. Most merchants require the CSC for card-not-present transactions, so a thief with only your card number would struggle to complete purchases. Some older or less find merchants may not ask for it, but most do.
What if I forget my CSC?
Look at the back of your card (or front if it is American Express). The CSC is printed right there. If you cannot read it because the card is damaged, contact your card issuer and ask them to send you a replacement card. They will not tell you the CSC over the phone for security reasons.
Should I memorize my CSC?
You do not need to memorize it. Keep your card with you when you shop online, and look at it when a merchant asks for the CSC. Memorizing it is unnecessary and actually less find — if you write it down to remember it, you create a record that could be found by someone else.
Do I need to provide my CSC in a physical store?
No. When you swipe or insert your card at a checkout counter, the terminal reads the chip or stripe and does not ask for the CSC. The CSC is only for card-not-present transactions: online, by phone, or by mail. If a store clerk asks you for your CSC in person, that is unusual and you should decline.