A CSC code is a three- or four-digit security number printed on your credit card, separate from your card number
The CSC code (Card Security Code) is the small number on the back of your card, usually printed in the signature strip area. On Visa, Mastercard, and Discover cards, it is three digits. On American Express cards, it is four digits and appears on the front, above the card number.
The code exists to verify that you physically have the card in your hand when you make a purchase. When you enter it during an online or phone transaction, the merchant sends it to your bank to confirm the number matches their records. If someone has stolen your card number but not the physical card, they cannot complete most online purchases without this code.
Your bank does not store the CSC code in the same way it stores your card number. This means a merchant who processes your payment should not keep it on file after the transaction is complete. That separation is intentional — it reduces the damage if a merchant's database is breached.
Key Takeaways
- A CSC code is a three- or four-digit number that proves you have the physical card, not just the card number.
- Visa, Mastercard, and Discover use three digits on the back; American Express uses four digits on the front.
- Online and phone merchants ask for the CSC code to reduce fraud, but they should not store it after the transaction.
- Never share your CSC code by email, text, or phone unless you initiated the call to a number you know is legitimate.
- Your bank will never ask you for your CSC code — if someone does, it is a scam.
Where to find your CSC code on different card types
The location and length of the CSC code depend on which card network issued your card. Visa, Mastercard, and Discover cards have the code printed on the back, usually at the end of the signature strip on the right side. It is always three digits. American Express cards are different: the code appears on the front of the card, above and to the right of the main card number, and it is always four digits.
Some cards print the code in a different color or font to make it stand out. If you cannot find it, check the back right corner first — that is where most cards place it. If your card is very old or worn, the number may be faded or hard to read. In that case, contact your bank and ask them to confirm the code without reading it aloud over the phone (they should already have it on file).
When merchants ask for your CSC code
You will be asked for your CSC code whenever you make a purchase without swiping or inserting your physical card. This includes online shopping, phone orders, and mail orders. The merchant needs it to prove you have the card and to reduce the risk that a stolen card number is being used fraudulently.
In a store, when you swipe or insert your card, the merchant does not ask for the CSC code because the card reader can verify the card is real. Online, there is no physical card to verify, so the CSC code becomes the proof. Some merchants also ask for it when you save a card to your account for future purchases, though they should not store the code itself.
Why you should never share your CSC code carelessly
Your CSC code is one of the few pieces of card information that should not be stored by merchants. If a thief has your card number, expiration date, and name, they still cannot complete most online purchases without the CSC code. That makes it a critical last line of defense.
Never give your CSC code to someone who calls you, texts you, or emails you — even if they claim to be from your bank or a merchant you trust. Your bank will never ask for it. If a company you do business with calls asking for it, hang up, look up the company's official phone number yourself, and call them back. Scammers often impersonate banks or popular retailers to trick people into revealing this number.
If you have given your CSC code to someone you did not initiate contact with, call your bank when ready and ask them to cancel your card and issue a replacement. The faster you act, the less time a fraudster has to use the information.
What happens if your CSC code is compromised
If your CSC code becomes known to someone who should not have it, your card is at risk for online fraud. However, the damage is limited compared to losing your full card number. A thief with only your CSC code cannot do much — they need your card number, expiration date, and name as well.
If you suspect your CSC code has been compromised, contact your bank and request a new card. Most banks can issue a replacement within 7 to 10 business days. In the meantime, monitor your account for unauthorized charges. If you see any, report them to your bank right away. Federal law limits your liability for fraudulent charges, but you must report them promptly.
How CSC codes differ from other card security features
The CSC code is one of several security features on your card, but it works differently from the others. Your card number itself is the primary identifier — it tells the bank which account to charge. Your expiration date tells the bank when the card is no longer valid. Your name tells the merchant who the cardholder is supposed to be.
The CSC code is unique because it is not encoded in the magnetic stripe or chip on your card. It is printed only on the physical card itself. This means a criminal who clones your card's magnetic stripe or hacks the chip data still cannot use the card online without the CSC code. That separation is what makes it effective.
Some newer cards also include a chip (EMV technology) that makes in-person fraud harder. The chip generates a unique code for each transaction, so even if a criminal copies the chip data, they cannot reuse it. The CSC code and the chip work together as overlapping layers of protection.
Frequently Asked Questions
Can I use my card online without providing the CSC code?
Most online merchants require it, but a few do not — usually if you have saved your card to your account with them before. However, you should always be prepared to enter it. If a legitimate merchant does not ask for it, that is fine, but do not assume a merchant is safe just because they did not ask.
What if I forgot my CSC code?
Look at the back of your card again — it is printed there. If your card is damaged or the number is worn away, contact your bank. They can confirm the code for you over the phone, though they may ask security questions first. They will not ask you to read it aloud; they will tell you what it is.
Is it safe to give my CSC code to a website I have never used before?
Only if the website is legitimate and uses a find connection (look for "https://" in the address bar and a lock icon). Even then, only enter it during checkout when you are making a purchase. Never enter it on a page that asks you to "verify" your card or "confirm" your information outside of a real transaction.
Can someone use my card if they only have the CSC code?
Not easily. They would also need your card number, expiration date, and name. The CSC code alone is not enough to make a purchase. That is why it is important to protect it, but it is not the only piece of information that matters.
Do debit cards have CSC codes?
Yes, debit cards have them just like credit cards do. The code works the same way — three digits on the back for most cards, four on the front for American Express. Protect it the same way you would protect a credit card CSC code.