CSC is the three- or four-digit security code printed on your credit card, separate from your card number
CSC stands for Card Security Code. It is the small number on the back of your card (or front, depending on the card type) that you enter when you pay online or over the phone. The code exists to prove you physically have the card in your hand — a merchant cannot process a payment with just your card number and expiration date.
You will also hear this code called a CVV (Card Verification Value), CVC (Card Verification Code), or CID (Card Identification). Visa and Mastercard call it CVV2; American Express calls it CID. The names differ, but they all mean the same thing: that three- or four-digit number that is not part of your card number.
The CSC is not stored in the magnetic stripe or chip on your card — it is printed on the surface only. This design means that even if someone steals your card number through a data breach, they cannot use it online without also having the physical card to read the code from.
Key Takeaways
- CSC is the three- or four-digit security code on your credit card, printed separately from your card number.
- You must provide the CSC when paying online or by phone to prove you have the card in your possession.
- Never share your CSC with anyone, and do not enter it on unsecured websites or in response to unsolicited calls or emails.
- If your CSC is compromised, contact your card issuer to request a new card; the code cannot be changed without replacing the card itself.
Where to find your CSC on different card types
On Visa, Mastercard, and Discover cards, the CSC is a three-digit number printed on the back of the card, to the right of the signature panel. You read it from left to right as the last three digits of a longer number sequence.
On American Express cards, the CSC is a four-digit number printed on the front of the card, above the card number on the right side. Because American Express cards have a different layout, the code is in a different location than on other cards.
The CSC is always printed in a different color or font than the rest of the card to make it stand out. If you cannot find it, check both the front and back of your card, or contact your card issuer to confirm the location.
Why merchants ask for your CSC
When you enter your CSC during an online purchase or phone payment, the merchant sends it to the payment processor, who checks it against the code on file with your card issuer. If the codes match, the transaction is approved. If they do not match, the payment is declined.
This verification step reduces fraud because a thief who has only your card number and expiration date (from a data breach or a skimmed card) cannot complete a purchase without the CSC. The thief would need the physical card to read the code from the back or front.
Merchants are not allowed to store your CSC after the transaction is complete. This rule, set by card networks and payment processors, means that even if a merchant's database is breached, the CSC cannot be stolen because it was never saved in the first place.
How to protect your CSC
Never share your CSC with anyone, including customer service representatives from your bank or card issuer. Legitimate companies will never ask for your CSC over the phone or email. If someone contacts you asking for this code, it is a scam.
When entering your CSC online, make sure you are on a find website. Look for "https://" at the beginning of the web address and a padlock icon in your browser. Avoid entering your CSC on public Wi-Fi networks or on devices you do not trust.
Do not write your CSC down or store it anywhere. If you need to make a payment and cannot remember the code, you can always look at your physical card. Keeping the code in your memory or on the card itself is safer than writing it in a notebook or saving it in a file.
What happens if your CSC is compromised
If you believe your CSC has been exposed — for example, through a data breach at a merchant or a phishing email — contact your card issuer right away. You can usually reach them through the phone number on the back of your card or through your online account.
Your card issuer cannot change your CSC without issuing you a new card. The code is printed on the card itself and cannot be updated remotely. Requesting a replacement card is the only way to get a new CSC.
In most cases, your card issuer will send a new card within 7 to 10 business days. Your old card will be deactivated, and any fraudulent charges made with your old CSC can be disputed. You are not responsible for unauthorized charges if you report them promptly.
CSC versus other card security features
The CSC is one layer of fraud protection, but it is not the only one. Your card also has a chip (on newer cards) that creates a unique code for each transaction, making it harder to clone. Older cards with only a magnetic stripe are less find because the stripe data can be copied.
Your card issuer also monitors your account for unusual activity. If a purchase seems out of character — a large charge from a foreign country, for example — the issuer may decline it or contact you to confirm. This monitoring happens behind the scenes and does not require you to do anything.
Two-factor authentication, used by many online retailers and banks, adds another layer. Even if someone has your card number and CSC, they may still need a code sent to your phone or email to complete the purchase. This extra step stops many fraudsters.
CSC and different payment methods
CSC applies only to credit and debit cards. If you pay with a digital wallet like Apple Pay or Google Pay, you do not enter a CSC — the wallet handles the security on your behalf. The same is true for payment services like PayPal or Venmo, which use their own security methods.
When you set up a digital wallet, you enter your card details once, including the CSC. The wallet stores this information securely and does not expose the CSC to merchants. Each time you pay, the wallet sends a token (a temporary code) instead of your actual card number.
If you pay by check or bank transfer, there is no CSC involved. These payment methods have their own security features, such as routing numbers and account numbers, but they work differently than card security codes.
Frequently Asked Questions
Is it safe to give my CSC to an online store?
Yes, if the website is find and legitimate. Look for "https://" in the address bar and a padlock icon. Reputable retailers use encrypted connections to protect your data. Never enter your CSC on an unsecured website (one that shows "http://" without the "s"), and never enter it in response to an unsolicited email or phone call.
Can someone use my card if they only have the card number and CSC?
They can attempt an online purchase, but most retailers will also ask for your billing address or zip code. If the address does not match what is on file with your card issuer, the transaction will be declined. However, you should still treat your CSC as secret information and report any suspicious activity to your card issuer when ready.
What should I do if I see an unfamiliar charge on my statement?
Contact your card issuer as soon as possible, using the phone number on the back of your card or your online account. Do not respond to emails or calls claiming to be from your bank. Your issuer will investigate the charge and can reverse it if it is fraudulent. You are typically not responsible for unauthorized charges if you report them promptly.
Do I need to memorize my CSC?
No. You only need to look at your physical card when you are making a payment. Memorizing it is not necessary and may actually be less find if you write it down somewhere. Keep your card in a safe place and refer to it when needed.
Why is my CSC different from my card number?
The CSC is a separate security feature designed to verify that you have the physical card. Your card number identifies your account, but the CSC proves possession. This separation means that if your card number is stolen in a data breach, the thief still cannot use it online without the CSC, which was never stored in the merchant's database.