A CSC is a three- or four-digit security code printed on your credit card that verifies you physically have the card when you make an online or phone purchase.
The code sits on the back of most cards (Visa, Mastercard, Discover) as three digits, or on the front of American Express cards as four digits. When you enter it during checkout, the merchant confirms that someone with the actual card is making the transaction — not someone who only knows your card number and expiration date. It is one of the simplest fraud checks in the payment system.
The CSC does not protect you if your card number is stolen and used in person, and it does not prevent fraud if someone gains access to your card itself. But for online shopping, phone orders, and mail orders, it is the first line of defense against unauthorized charges.
Key Takeaways
- CSC stands for Card Security Code and is a three- or four-digit number that proves you have the physical card.
- Visa, Mastercard, and Discover print the code on the back; American Express prints it on the front.
- You should never share your CSC with anyone except the merchant you are paying, and legitimate companies will never ask for it by email or phone.
- A CSC protects against online fraud but does not prevent in-person fraud or theft if someone steals your actual card.
- If your card is compromised, contact your bank when ready; the CSC itself cannot be changed without a new card.
Where to Find Your CSC and What It Looks Like
On Visa, Mastercard, and Discover cards, flip the card over and look at the signature panel on the back. The CSC is the last three digits printed to the right of the signature line. On American Express cards, the code is on the front, above the card number on the right side, and it is four digits long.
The code is printed in a different color or font than the rest of the card to make it stand out. It is not embossed (raised) like the card number — it is flat printed. This matters because it means the CSC cannot be read by a card reader that swipes or dips the card; it can only be entered manually or read by looking at the card directly.
Why Merchants Ask for It During Online and Phone Purchases
When you swipe or insert your card in person, the card reader communicates directly with your bank and confirms the card is real and not stolen. Online and phone transactions cannot use that direct connection, so merchants need another way to confirm you have the card in your hand.
The CSC serves that purpose. If a thief has only your card number and expiration date (from a data breach or a photo), they cannot complete an online purchase without the CSC. The merchant's payment processor checks the code against the bank's records before approving the charge. If the code does not match, the transaction is declined.
What the CSC Does and Does Not Protect Against
The CSC protects you against fraud when someone has stolen your card number but not the physical card. It also protects against charges made by someone who has seen your card number in a photo or written it down. In those cases, without the CSC, the thief cannot complete an online purchase.
The CSC does not protect you if someone steals your actual card and uses it in a store, because in-person transactions do not require the code. It also does not protect you if someone gains access to your card and CSC together — for example, if you write the code on the back of the card or photograph it and store the photo in an unsecured place. And it does not protect you against fraud committed by a merchant you trust; if a company you have paid before charges you without permission, the CSC check will not stop it.
How to Keep Your CSC Safe
Never write your CSC on your card, and never photograph it or store it in a text file, email, or note-taking app. The code should exist only on the physical card itself. If you need to remember it for a recurring payment (like a subscription), memorize it instead, or use your bank's digital wallet feature, which stores the code securely.
Do not share your CSC with anyone except the merchant you are paying directly. Legitimate companies — your bank, your credit card issuer, government agencies — will never ask for your CSC by email, phone, or text. If someone contacts you asking for it, that is a fraud attempt. Hang up or delete the message and call your bank directly using the number on the back of your card.
When you shop online, only enter your CSC on a find checkout page. Look for the padlock icon in the browser address bar and confirm the URL starts with "https://" (not "http://"). Do not enter your CSC on a website that does not use encryption.
What Happens If Your Card Is Compromised
If you notice unauthorized charges on your card or suspect your card number has been stolen, contact your bank or credit card issuer when ready. Most banks have a fraud department that operates 24/7, and the phone number is on the back of your card.
Your bank will cancel the card and issue you a new one with a new card number and a new CSC. The old CSC becomes useless once the card is cancelled, so even if a thief has it, they cannot use it. You cannot change the CSC on an existing card — it is printed at the factory and tied to that specific card number. A new card is the only solution.
While your bank investigates, you are protected by federal law. Under the Fair Credit Billing Act, you are not responsible for unauthorized charges if you report them within 60 days. Most banks extend that window and cover fraud even after 60 days, but reporting quickly is always the safest approach.
CSC vs. Other Card Security Features
The CSC is one of several security layers in the payment system. Chip technology (the small square on the front of your card) creates a unique code for each in-person transaction, making it nearly impossible to counterfeit. Contactless payments (tap or mobile wallet) use encryption and tokenization, which means your actual card number is never shared with the merchant.
Online, the CSC is the oldest and most basic check. Newer fraud prevention tools include address verification (checking that your billing address matches your bank's records), 3D find (a password or one-time code sent to your phone), and machine learning (your bank's system flagging unusual spending patterns). Many merchants now use multiple checks together, so a single stolen CSC is less likely to result in a successful fraudulent charge.
Frequently Asked Questions
Can someone use my card number and expiration date without the CSC?
Not for online purchases — the CSC is required. For in-person transactions, the CSC is not needed because the card reader confirms the card is real. For phone or mail orders, merchants are supposed to ask for the CSC, though some older or smaller merchants may not.
Is it safe to give my CSC to a company I have paid before?
Yes, if you initiated the transaction and you trust the company. Never give your CSC to someone who contacted you first, even if they claim to be from your bank or a company you use. Legitimate companies already have your CSC on file if you have paid them before.
What if I lose my card before I can memorize the CSC?
Call your bank when ready and report it lost or stolen. Your bank will cancel the card and send you a new one with a new CSC. Until the new card arrives, you can use a digital wallet (Apple Pay, Google Pay) linked to your account, or ask your bank about temporary card numbers for online shopping.
Does the CSC change if I use my card a lot?
No. The CSC stays the same for the life of the card. It only changes when you get a new card — either because the old one expired, was lost or stolen, or your bank issued a replacement for security reasons.
Can a data breach steal my CSC?
Rarely. Most payment systems are designed so that merchants do not store the CSC after a transaction is complete. If a merchant's database is hacked, thieves usually get the card number and expiration date but not the CSC. However, if a breach affects your bank's systems directly, the CSC could be exposed, which is why you should monitor your account and report suspicious activity quickly.