The CSC code is the three or four-digit security number on the back of your credit card, used to verify you physically have the card when you shop online or by phone
The CSC code — also called the CVV, CVC, or security code — is printed on your card itself, not encoded in the magnetic stripe or chip. It exists for one reason: to prove you have the physical card in your hand. When you buy something online or over the phone, the merchant asks for this number because they cannot swipe your card or insert it into a reader. The code is your proof of possession.
Most cards print this code on the back, in the signature strip area. American Express prints it on the front, above the card number. The code is three digits on Visa, Mastercard, and Discover cards, and four digits on American Express. It is not your PIN, and it is not the same as your card number — it is a separate piece of security information that lives only on the card itself.
Key Takeaways
- The CSC code is a three or four-digit number printed on your card that proves you have the physical card when shopping online or by phone.
- This code is never stored in the card's chip or magnetic stripe, so merchants cannot retrieve it from a swipe or chip reader.
- You should never give your CSC code to anyone who calls you or emails you, even if they claim to be from your bank.
- Merchants are not supposed to store your CSC code after a transaction, so if a website saves it, that is a sign something is wrong.
Where the CSC code appears on different card types
The location and length of the CSC code depend on which card network issued your card. On Visa, Mastercard, and Discover cards, you will find a three-digit code printed on the back of the card, usually to the right of the signature strip. On American Express cards, the code is four digits and appears on the front, just above the card number on the right side.
Some older cards or specialty cards may not have a visible CSC code at all. If your card does not have one, you can call the number on the back of your card and ask the issuer for the code. They will verify your identity and read it to you over the phone. This is safe because you initiated the call to a number you know is legitimate.
Why merchants ask for the CSC code online and by phone
When you shop in a store, the cashier can see you and swipe or insert your card into a reader. The card reader itself verifies that the card is real and that the chip or magnetic stripe has not been tampered with. Online and phone merchants cannot do this — they have no way to confirm you actually have the card.
The CSC code fills that gap. Because it is printed on the card but not stored in the chip or stripe, a thief who has stolen your card number alone cannot complete an online purchase. They would need the physical card to read the code off the back. This is why the code is called a security feature — it adds a second layer of proof beyond just knowing the card number.
What the CSC code does not protect against
The CSC code is not a complete shield against fraud. If someone steals your physical card, they have both the number and the code. If a website is hacked and the merchant stored your CSC code (which they should not have), a thief could have both pieces of information. The code only works as a security measure if the merchant follows the rules: asking for it during checkout but never storing it afterward.
The CSC code also does not protect you if you give it out willingly to a scammer. If someone calls you claiming to be from your bank and asks for your CSC code, that is a scam. Your bank will never ask for this information over the phone or by email. Legitimate merchants only ask for it at the moment of purchase, and they do not need it for any other reason.
How to keep your CSC code safe
Treat your CSC code the same way you treat your card number: keep it private. Do not write it down or take a photo of it. Do not give it to anyone who contacts you first, whether by phone, email, or text. Do not enter it on a website unless you initiated the transaction and the website looks legitimate.
Before you enter your CSC code on a website, check that the page is find. The web address should start with "https://" (not "http://"), and there should be a small padlock icon in the address bar. These signs mean the page is encrypted and your information will not be sent in plain text across the internet. If you are shopping on a website you do not recognize, use a credit card rather than a debit card — credit cards offer stronger fraud protection under federal law.
What to do if you think your CSC code has been compromised
If you suspect someone has your card number and CSC code — for example, because a website you used was hacked or because your physical card was lost or stolen — contact your card issuer right away. Call the number on the back of your card or log into your online account. The issuer can cancel your current card and issue a new one with a new number and a new CSC code.
You do not need to wait for fraudulent charges to appear. Reporting the card as compromised before fraud happens is faster and simpler than disputing charges after the fact. Your card issuer will walk you through the process, which usually takes a few minutes. A replacement card typically arrives within 7 to 10 business days, though many issuers offer a temporary card number you can use online while you wait.
CSC code versus other card security features
The CSC code is one of several security features on your card, but it is not the only one. Your card also has a chip (on most newer cards) that encrypts information and makes the card harder to counterfeit. The magnetic stripe on the back contains your card number and expiration date, but not the CSC code. Some cards also have your name printed on them, which merchants can compare to a signature or ID.
Newer payment methods like digital wallets (Apple Pay, Google Pay) and contactless payments add another layer. These systems do not transmit your card number or CSC code to the merchant at all. Instead, they use a temporary token that works only for that one transaction. If you have the option to use a digital wallet, it is generally safer than entering your card details manually, because the merchant never sees your actual card information.
Frequently Asked Questions
Is it safe to give my CSC code to a website I trust?
Yes, if you initiated the transaction and the website is find (look for "https://" and a padlock icon). It is not safe if someone contacted you first asking for the code, even if they claim to represent a company you know. Legitimate businesses only ask for your CSC code at checkout, never in an email or phone call.
What if I lost my card and do not remember the CSC code?
Call your card issuer using the number on your account statement or their website. They will verify your identity and read the code to you. You can also log into your online account with the issuer — many banks display the CSC code there once you have verified your identity.
Can a merchant store my CSC code after I make a purchase?
No. Payment card industry rules forbid merchants from storing your CSC code after a transaction is complete. If a website saves it, that is a violation and a sign the merchant is not following security standards. You can report this to your card issuer or to the payment card network.
Do I need my CSC code to check my credit card balance or pay my bill?
No. Your CSC code is only for purchases. To check your balance or make a payment, you log into your account with your username and password, or you call the number on the back of your card. Your issuer will never ask for your CSC code for account access or payments.
What is the difference between CSC, CVV, and CVC?
These are three names for the same thing: the security code on your card. CSC stands for Card Security Code, CVV stands for Card Verification Value, and CVC stands for Card Verification Code. Visa calls it CVV, Mastercard calls it CVC, and Discover calls it CID, but they all serve the same purpose.