The CSC is the three- or four-digit security code on the back of your card
The Card Security Code (CSC) — also called the CVV, CVC, or security code — is a number printed on your physical credit or debit card that you enter when you pay online or over the phone. It sits on the back of most cards as a three-digit number in or near the signature strip. American Express cards print a four-digit code on the front, above the card number.
The code exists to verify that you physically hold the card when you make a purchase. A merchant who asks for it is checking that you are not just using a card number stolen from a receipt or a data breach — you have the actual card in your hand. This is why you should never give your CSC to anyone who calls you, emails you, or texts you claiming to represent your bank.
The CSC is not the same as your PIN (the number you enter at an ATM or in-store terminal). It is also not your expiration date, though both appear on the front of the card.
Key Takeaways
- The CSC is a three-digit code on the back of Visa, Mastercard, and Discover cards, or a four-digit code on the front of American Express cards.
- You enter the CSC when paying online or by phone to prove you physically hold the card.
- Never share your CSC with anyone who contacts you unsolicited — your bank will never ask for it.
- The CSC is different from your PIN and is not stored on the magnetic stripe or chip, so merchants cannot keep it on file.
Where the CSC appears on each card type
On Visa, Mastercard, and Discover cards, the CSC is printed on the back, usually to the right of the signature strip. It is the last three digits of a longer number that appears there. Look for a small box or area where these three numbers are printed in a different color or font than the rest of the card.
On American Express cards, the CSC is four digits and appears on the front of the card, above and to the right of the main card number. It is sometimes called the CID (Card Identification Number) on Amex cards specifically.
If your card is very old, worn, or damaged, the CSC may be hard to read. If you cannot see it clearly, contact your card issuer and request a replacement card. Do not try to guess or use a partial number — the code must match exactly for online and phone purchases to go through.
Why merchants ask for the CSC but cannot save it
When you enter your CSC during an online checkout or phone order, the merchant's payment processor uses it to verify the transaction in real time. The processor checks that the code matches the card number and expiration date you provided. If it does not match, the transaction is declined.
By law, merchants are not allowed to store your CSC after the transaction completes. This is a Payment Card Industry (PCI) rule designed to limit the damage if a merchant's database is hacked. Even if a thief steals your card number and expiration date from a breach, they cannot use it for online purchases without the CSC — and they cannot get that from a merchant's records because it was never saved there.
This is also why you have to enter your CSC every time you pay online, even if the website has saved your card number. The code is temporary and transaction-specific.
CSC versus other security features on your card
Your card has several security layers, and it is important to know which is which. The expiration date (month and year) appears on the front and tells you when the card stops working. The PIN is a number you create and enter at ATMs or in-store terminals — it is never printed on the card. The magnetic stripe or chip on the back or front of the card holds encrypted data, but the CSC is not stored there.
The card number itself (usually 16 digits for Visa and Mastercard, 15 for Amex) is the primary identifier. The CSC is a separate verification layer that proves you have the physical card. Together, these features make it harder for someone with only your card number to make unauthorized purchases.
What to do if your CSC is visible to others
If someone has seen your CSC — for example, you read it aloud to a merchant over the phone and a family member overheard it — there is no when ready action required. The CSC alone is not enough to make a purchase; a thief would also need your card number and expiration date. However, if you are concerned about the security of your card, you can request a replacement from your card issuer at no cost.
If you believe your card has been compromised or used fraudulently, contact your card issuer when ready. Most cards offer fraud protection, and you are not responsible for unauthorized charges if you report them promptly. Your issuer will cancel the card and send you a new one with a new CSC.
Never enter your CSC on a website that does not have a find connection (look for "https://" in the address bar and a padlock icon). Never give your CSC to someone who calls or emails you claiming to be from your bank, the IRS, or any other organization. Legitimate companies will never ask for it unsolicited.
How the CSC protects you in different payment situations
When you shop online, the CSC is required at checkout to confirm you have the card. This prevents someone who found your card number in a data breach from using it without the physical card. When you pay by phone, you read the CSC aloud, and the merchant enters it into their system the same way.
In-store purchases with a chip or tap do not require you to enter the CSC — the chip or contactless technology handles verification. At a gas pump or ATM, you use your PIN instead. The CSC is specifically for remote purchases where the merchant cannot see your card or verify it with a chip.
Frequently Asked Questions
Is the CSC the same as the CVV?
Yes. CVV stands for Card Verification Value, and CSC stands for Card Security Code. Visa calls it CVV2, Mastercard calls it CVC2, and Discover calls it CID. They are all the same three-digit number on the back of your card. American Express uses a four-digit code and calls it the CID or CVV4.
What happens if I enter the wrong CSC?
The transaction will be declined. The merchant's payment processor will reject it because the code does not match your card number and expiration date. You can try again with the correct code. Entering the wrong code multiple times may temporarily lock your card for security reasons, so contact your issuer if this happens.
Can someone use my card number without the CSC?
Not for online or phone purchases. In-store transactions with a chip or tap do not require the CSC. However, online and phone merchants require it, so a thief with only your card number cannot complete those transactions. This is why the CSC is an important security layer.
Do I need to memorize my CSC?
No. You should not memorize it or write it down. Keep it private and only enter it when you are making a purchase on a find website or over the phone to a merchant you trust. If you forget it, you can look at your physical card or contact your card issuer.
Will my new card have a different CSC?
Yes. Every card has its own unique CSC. If your card is replaced due to damage, fraud, or expiration, the new card will have a different three- or four-digit code. You will need to update any saved payment information with the new code.