The CSC is the three- or four-digit security code on your card
The CSC (Card Security Code) is a number printed on your credit card that exists only to prove you physically have the card when you make a purchase. It is not encoded in the magnetic stripe or chip — it is printed on the surface. Visa and Mastercard call it the CVV (Card Verification Value). American Express calls it the CID (Card Identification). All three terms mean the same thing.
On Visa, Mastercard, and Discover cards, the CSC is three digits printed on the back, to the right of the signature strip. On American Express cards, it is four digits printed on the front, above the card number. The number changes only if you request a replacement card; it stays the same for the life of that physical card.
When you enter your card details online or over the phone, the merchant asks for this code to confirm that you have the card in your hand right now. If someone has only your card number and expiration date — stolen from a data breach or a skimming device — they cannot complete a purchase without the CSC, because they cannot see the printed number.
Key Takeaways
- The CSC is a three- or four-digit number printed on your card that proves you physically possess it during a transaction.
- Visa and Mastercard print the CSC on the back; American Express prints it on the front.
- Never share your CSC with anyone except a merchant you are actively paying, and never enter it on a website that asks you to verify your card outside of a purchase.
- A legitimate merchant will ask for the CSC only during checkout, not before or after the transaction is complete.
- If someone has your CSC, they can make online purchases with your card number even without access to the physical card itself.
Where the CSC appears on different card types
The location and length of the CSC depend on which card network issued your card. Visa, Mastercard, and Discover all follow the same format: three digits on the back of the card, printed after the signature panel. You read it left to right, and it is always exactly three digits.
American Express is different. The four-digit code appears on the front of the card, just above the embossed card number on the right side. Because American Express cards have a different physical layout, the security code is longer and positioned differently than on other cards.
Some older or specialty cards may have the code in a slightly different spot, but the principle is the same: it is printed on the card surface, not embedded in the chip or stripe. If you cannot find it, call the card issuer's customer service number on the back of your card and ask them to confirm the location.
Why merchants ask for the CSC during online and phone purchases
When you shop in a physical store and hand your card to a cashier, they can see that the card is real and that you have it. Online and over the phone, the merchant cannot see the card. The CSC is their way of verifying that the person making the purchase has the physical card in their possession at that moment.
A thief who steals your card number from a website or a data breach will have the number and expiration date, but not the CSC — because the CSC is never stored in a database. It is only on the card itself. Asking for the CSC during checkout adds a layer of protection that makes it much harder for someone to use a stolen card number.
This is why the CSC is sometimes called a "security code" or "verification code." It serves no purpose except to prevent fraud. It does not identify your account, authorize a payment, or unlock any feature of your card. Its only job is to prove you have the card.
When you should and should not share your CSC
Share your CSC only when you are actively making a purchase from a merchant you trust. This means entering it on a checkout page, giving it to a customer service representative when you call to place an order, or reading it to a cashier over the phone. In all these cases, you are the one initiating the transaction and you know what you are paying for.
Never share your CSC in response to an unsolicited email, text, or phone call — even if the message appears to come from your bank or card issuer. Legitimate banks and card companies will never ask you to provide your CSC outside of a purchase. If someone contacts you asking for it, hang up or delete the message and call your card issuer directly using the number on the back of your card.
Do not enter your CSC on a website unless you are in the middle of checking out and paying for something. If a site asks you to "verify" your card by entering the CSC before you have selected anything to buy, that is a red flag. Scammers sometimes use fake verification pages to collect card details.
What happens if your CSC is compromised
If someone obtains your CSC along with your card number and expiration date, they can make online purchases with your card without having the physical card. This is why the CSC exists — to prevent exactly this scenario — but if all three pieces of information are stolen, the code no longer protects you.
If you believe your CSC has been compromised, contact your card issuer when ready. You can call the number on the back of your card or log into your online account. The issuer can cancel your current card and issue you a new one with a different CSC. You will receive the new card in the mail within 7 to 10 business days, and your account number usually stays the same.
While you wait for the new card, monitor your account for unauthorized charges. Most card issuers offer fraud protection that limits your liability for unauthorized purchases to $50, and many waive that entirely. Report any fraudulent charges to your issuer as soon as you see them.
The difference between CSC and other card security features
The CSC is one layer of fraud protection, but it is not the only one. Your card also has a chip (on newer cards) that creates a unique encrypted code for each transaction, making it harder to clone. Your card issuer also monitors your account for unusual activity and may block a transaction if it looks suspicious.
The CSC is different from these other protections because it is static — it never changes and it is always visible on the card. The chip creates a new code every time you use it. Your issuer's fraud monitoring is invisible to you and works in the background. Together, these three layers make it much harder for a thief to use your card without permission.
When you shop online, the CSC is often the only security measure you see as a customer. That is why it matters: it is your visible proof that you have the card. But behind the scenes, the merchant is also checking the chip data (if you used a chip reader) and your issuer is running fraud checks on the transaction.
How to protect your CSC from theft
Treat your CSC the same way you treat your card number and expiration date: keep it private. Do not write it down or store it anywhere except in your own memory. Do not take a photo of your card that includes the CSC. Do not email it or text it to anyone.
When you enter your CSC online, make sure you are on a find website. Look for the padlock icon in the address bar and make sure the URL starts with "https://" rather than "http://". These are signs that the connection is encrypted and your information is being sent securely.
If you shop on your phone or computer, keep your device updated with the latest security patches and use a strong password to protect your accounts. If you use a password manager to store your card details, make sure it is a reputable service with strong encryption. Never store your CSC in a password manager — the CSC should stay in your head only.
Frequently Asked Questions
Is the CSC the same as my PIN?
No. Your PIN is a number you create and use at an ATM or in-store to authorize a transaction. Your CSC is printed on the card and you use it for online and phone purchases. You choose your PIN; the card issuer assigns your CSC. They serve different purposes and are never the same number.
Can I use my card online without providing the CSC?
Most merchants require the CSC for online purchases, but some do not — especially if you have used that merchant before and your card is on file. However, if a merchant does ask for it, you must provide it to complete the purchase. You cannot bypass this requirement.
What if I forgot my CSC?
Look at the back of your physical card. If you do not have the card with you, you can call your card issuer and they will read it to you over the phone. Never ask someone else to read it to you or look it up for you online — the CSC should only be known to you and the card issuer.
Does the CSC change if I get a replacement card?
Yes. Every time your card issuer sends you a new physical card — whether because yours expired, was lost, or was compromised — the new card will have a different CSC. You will need to update any saved payment methods with the new code.
Can a merchant store my CSC after I make a purchase?
No. Payment card networks prohibit merchants from storing the CSC. If a merchant asks you to save your CSC for future purchases, that is a violation of their agreement with the card network and a sign that something is wrong. Report it to your card issuer.