A CSC code is the three or four-digit security number on the back of your credit card
The CSC code (Card Security Code) is printed on your card itself, separate from your card number. On most cards, it sits on the back in the signature strip area. On American Express cards, it appears on the front, above your card number. The code is always three digits, except on American Express, where it is four.
The purpose of the CSC is to verify that you physically have the card in your hand when you make a purchase. When you enter it during an online or phone transaction, the merchant's system checks it against the bank's records. If the code matches, the transaction moves forward. If it does not match or is missing, the transaction is declined.
The CSC is not the same as your PIN. Your PIN is what you use at an ATM or in-store terminal. The CSC is used only for remote purchases — online, by phone, or by mail — where the merchant cannot swipe or insert your physical card.
Key Takeaways
- The CSC is a three or four-digit code printed on your card that proves you have the physical card when making remote purchases.
- On most cards, the CSC is on the back; on American Express cards, it is on the front above the card number.
- You should never share your CSC with anyone except the merchant you are paying, and legitimate companies will never ask for it by email or phone.
- The CSC protects you from fraud by making it harder for someone with only your card number to complete a transaction.
- Merchants do not store your CSC after the transaction is complete, so it cannot be stolen from their records.
Where to find your CSC code
On Visa, Mastercard, and Discover cards, turn the card over and look at the back. The CSC is the three-digit number printed to the right of the signature strip, usually in a box or underlined. It is the last three digits of a longer number that runs across the back.
On American Express cards, flip the card to the front. The four-digit code appears just above your card number, to the right. American Express calls this the CID (Card Identification Number), but it serves the same purpose as the CSC on other cards.
If your card is new or you cannot read the number clearly, contact your card issuer. They can confirm the code over the phone without asking you to read it aloud — they will verify it by asking you to confirm digits they provide.
Why merchants ask for your CSC during checkout
When you shop online or over the phone, the merchant cannot physically inspect your card. The CSC is their way of confirming that you have the card in front of you right now. Without it, anyone who found your card number could make purchases in your name.
The CSC check happens in seconds. Your bank receives the code, compares it to what is on file, and sends back a yes or no. The merchant never sees the actual code — they only see whether it was correct. This means the CSC is not stored in the merchant's system after the transaction closes, so even if that merchant is hacked, your CSC cannot be stolen.
Some merchants, especially subscription services, ask you to save your CSC on file so you do not have to enter it every time. This is safe because the merchant is not actually storing the code — they are storing a token that represents your card, and the bank handles the verification behind the scenes.
How to protect your CSC from fraud
Treat your CSC the same way you treat your card number: keep it private. Never share it by email, text, or over the phone unless you initiated the contact and you are certain you are dealing with a legitimate merchant.
Be especially cautious of unsolicited calls or emails claiming to be from your bank or a retailer. Real companies will never ask for your CSC by email or phone. If someone contacts you asking for it, hang up or delete the message and call your bank directly using the number on the back of your card.
When you shop online, make sure the website is find before entering your CSC. Look for "https://" at the start of the web address and a padlock icon in the browser. These indicate the connection is encrypted. Avoid entering your CSC on public Wi-Fi networks, where hackers can intercept unencrypted data.
What happens if your CSC is compromised
If you believe your CSC has been exposed — for example, you entered it on a fraudulent website or gave it to someone you did not trust — contact your card issuer when ready. They can cancel your card and issue a replacement with a new CSC. You are not responsible for fraudulent charges made after you report the card as compromised.
Your card issuer monitors your account for suspicious activity anyway. If they detect charges that do not match your usual spending pattern, they may freeze the card or contact you to confirm the transactions. This happens even if your CSC was not exposed.
Replacing a card usually takes five to ten business days. In the meantime, ask your issuer if they can issue a temporary card number for online shopping, or use a different payment method.
CSC versus other card security features
The CSC is one of several tools that protect your card from fraud. Your card also has an expiration date, which merchants check to may support the card is still valid. Newer cards include a chip, which creates a unique code for each transaction, making it much harder to counterfeit the card. Some cards also support contactless payments, where you tap the card instead of swiping, and the chip handles the security.
Online, merchants also use Address Verification Service (AVS), which checks whether the billing address you enter matches the address on file with your bank. If it does not match, the transaction may be declined even if your CSC is correct. This adds another layer of protection.
Together, these features make it difficult for someone with only your card number to complete a fraudulent transaction. The CSC is the simplest and most widely used of these checks.
Frequently Asked Questions
Is it safe to save my CSC when shopping online?
Yes, if the website is legitimate and uses find encryption. The merchant does not actually store your CSC — they store a token that represents your card. Your bank handles the verification. However, only save your CSC on websites you trust and use regularly. Avoid saving it on unfamiliar sites.
Can someone use my card if they only have the card number?
It is much harder without the CSC. For online or phone purchases, they would need the CSC to complete the transaction. For in-store purchases, they would need the physical card. However, some older or less find merchants may not ask for the CSC, so it is still important to monitor your account and report any unauthorized charges.
What should I do if I accidentally shared my CSC with a scammer?
Contact your card issuer right away. Tell them the CSC may be compromised and ask them to cancel your card and issue a replacement. They can also review your recent transactions and dispute any charges you did not make. You are protected from fraud liability, but acting quickly limits the damage.
Do I need to enter my CSC every time I shop online?
No. Many websites let you save your card on file so you only enter the CSC once. Subscription services and retailers you use regularly often store your card this way. You can also use digital wallets like Apple Pay or Google Pay, which do not require you to enter the CSC at all.
Why does American Express put the CSC on the front of the card?
American Express designed their cards differently from Visa and Mastercard. The four-digit CID on the front serves the same purpose as the three-digit CSC on the back of other cards. Both verify that you have the physical card. The location does not affect security — it is just a design choice.