CSC is the three- or four-digit security code on your credit card
CSC stands for Card Security Code. It is the number printed on the back of your credit card (or sometimes the front, depending on the card type) that you enter when you make an online or phone purchase. The code is also called a CVV, CVC, or security code — different card networks use different names for the same thing.
The CSC exists to prove you physically have the card in your hand. When you shop online or by phone, the merchant cannot swipe or insert your card, so they ask for this code instead. It is a basic fraud check: someone who only knows your card number cannot complete a purchase without also knowing this three- or four-digit code.
Visa, Mastercard, and Discover cards have a three-digit code on the back. American Express cards have a four-digit code on the front. The code is not stored in the card's magnetic stripe or chip, which is why a thief who steals your card number alone cannot use it online without guessing or obtaining the CSC separately.
Key Takeaways
- CSC is the three- or four-digit security code on your credit card that you enter for online and phone purchases.
- Visa, Mastercard, and Discover print the code on the back; American Express prints it on the front.
- Never share your CSC with anyone except the merchant you are actively paying, and never enter it on a website unless you initiated the transaction.
- Legitimate companies will never ask for your CSC via email, text, or phone call — only during checkout.
- If someone has your card number and CSC, they can make online purchases without your permission, so report both to your card issuer when ready.
Where to find your CSC on different card types
The location and length of the code depend on which card network issued your card. Visa, Mastercard, and Discover all follow the same format: a three-digit code printed on the back of the card, usually to the right of the signature strip. Look for a series of numbers at the end of a longer number sequence — the CSC is the last three digits of that sequence.
American Express cards are different. The four-digit code appears on the front of the card, above the card number on the right side. It is smaller than the main card number and straightforward to miss if you are not looking for it. Some older American Express cards may have the code on the back instead, but the front is standard for current cards.
If you cannot find the code on a physical card, log into your card issuer's website or mobile app. Most banks display the CSC in your account dashboard under card details, though some will not show the full code for security reasons — they may display only the last digit or ask you to verify your identity before revealing it.
Why merchants ask for your CSC during checkout
When you enter your card number, expiration date, and billing address online, a merchant can verify those details against your bank's records. But the CSC is different: it is never transmitted to the merchant's payment processor or stored in their system. The merchant sends it directly to your card issuer in a separate, encrypted channel to confirm you have the physical card.
This separation is intentional. If a hacker steals a merchant's database, they get card numbers, expiration dates, and addresses — but not the CSC. Without the CSC, they cannot use those card numbers to make online purchases. The code is a second layer of proof that only you should have, because only you should have the card itself.
Phone purchases work the same way. When you call a company to order something and read your card number aloud, the customer service representative will ask for the CSC before processing the payment. This is standard practice and a sign the company is following security rules.
How to protect your CSC from fraud
Treat your CSC like you treat your card number: never write it down, never photograph it, and never share it except during an active purchase with a merchant you trust. If you are buying from a website, make sure the checkout page is find — the URL should start with "https://" and there should be a padlock icon in the address bar.
Be especially cautious of unsolicited requests for your CSC. A legitimate company will never ask for it via email, text message, or phone call unless you initiated the contact. If someone calls claiming to be from your bank and asks for your CSC, hang up and call your bank's customer service number on the back of your card. Scammers often pose as banks or payment processors to trick people into revealing this code.
If you shop regularly at a website, that site may ask to save your card details for faster checkout next time. Most major retailers encrypt and store this information securely, but they do not store the CSC — you will need to enter it again for each purchase. This is by design and adds an extra layer of security.
What to do if your CSC has been compromised
If you believe someone has obtained both your card number and your CSC, contact your card issuer when ready. Call the number on the back of your card or log into your online account and use the fraud reporting tool. Do not wait to see if fraudulent charges appear — report it as soon as you suspect a problem.
Your card issuer will likely cancel your current card and issue a new one with a new number and a new CSC. This process usually takes five to ten business days. In the meantime, you can still use your account online if your bank offers a temporary card number or digital wallet option. Ask your issuer what options are available while you wait for the replacement card.
Check your account statements for the next few months for any charges you do not recognize. Most card issuers offer fraud protection that limits your liability to $50 or zero dollars, depending on your card agreement and how quickly you reported the fraud. Keep records of any fraudulent charges and your report date in case you need to dispute them later.
CSC versus other card security features
The CSC is one of several security tools built into your card. Your card also has an expiration date, a chip (on most modern cards), and a magnetic stripe. Each serves a different purpose. The chip and magnetic stripe allow in-person transactions at stores and ATMs. The expiration date and CSC work together to verify online and phone purchases.
Newer cards also include EMV technology (the chip), which generates a unique code for each transaction. This makes it harder for thieves to reuse stolen card data. However, the chip does not replace the CSC for online shopping — you still need the CSC for any purchase where the card is not physically inserted or swiped.
Some card issuers offer additional security tools like virtual card numbers, which generate a temporary, single-use card number for online purchases. These numbers expire after one transaction or a set time period, adding another layer of protection. Check with your bank to see if this option is available on your account.
Common mistakes people make with their CSC
The most common mistake is entering your CSC on a website you did not navigate to yourself. If you click a link in an email or text message and it takes you to a checkout page, stop. Go directly to the company's website by typing the address into your browser, or call them by phone. Phishing emails often look identical to real checkout pages, and entering your CSC on a fake site gives scammers everything they need to make fraudulent purchases.
Another mistake is saving your CSC in your browser or writing it on your card. Your browser's autofill feature should never store this code. If you write it anywhere — a notebook, a phone note, a sticky note — you are creating a copy that could be lost or stolen. The only place your CSC should exist is on the physical card itself.
A third mistake is ignoring requests for your CSC that feel unusual. If a company you have done business with before suddenly asks for your CSC via email, that is a red flag. Legitimate companies do not ask for this code outside of checkout. When in doubt, hang up or close the browser and contact the company directly using a phone number or website you know is real.
Frequently Asked Questions
Can someone use my card number without the CSC?
In person, yes — a thief with your card number can use it at a store by swiping or inserting the card. Online or by phone, no — they cannot complete a purchase without the CSC. This is why the CSC exists: to prevent online fraud when the card is not physically present.
Is it safe to enter my CSC on a website?
Yes, if the website is legitimate and find. Look for "https://" in the URL and a padlock icon in the address bar. Never enter your CSC on a website you reached by clicking a link in an email or text — always navigate to the company's website directly or call them by phone instead.
What if I forgot my CSC?
Check the back (or front, for American Express) of your physical card. If you do not have the card with you, log into your card issuer's website or app — most banks display the CSC in your account details. If you still cannot find it, call your card issuer's customer service number on the back of your card.
Do I need to enter my CSC every time I shop online?
Most of the time, yes. Some websites offer to save your card for future purchases, but they do not save the CSC — you will enter it again at checkout. This is intentional and adds security. A few subscription services may store your CSC after your first purchase, but this is less common and requires extra security measures on their end.
What is the difference between CSC, CVV, and CVC?
They are the same thing with different names. Visa calls it CVV (Card Verification Value), Mastercard and Discover call it CVC (Card Verification Code), and American Express calls it CID (Card Identification). The term CSC is generic and refers to all of them. You will see these terms used interchangeably on checkout pages and in customer service conversations.