A CSC is a three- or four-digit security code printed on your card, not stored in the magnetic stripe
A CSC (Card Security Code) is the number on the back of your credit card — usually three digits for Visa, Mastercard, and Discover, or four digits for American Express (which prints it on the front). It exists to verify that you physically hold the card when you make an online or phone purchase. The merchant never stores this number; they use it once to confirm the transaction is legitimate.
The CSC is separate from your card number and expiration date. Because it is printed on the card itself rather than encoded in the magnetic stripe or chip, a thief who steals your card number online cannot use it without also having the physical card. This makes the CSC one of the simplest fraud barriers in the payment system.
Different card networks call it different names — Visa and Discover call it the CVV (Card Verification Value), while Mastercard calls it the CVC (Card Verification Code) — but they all serve the same purpose. American Express uses the term CID (Card Identification). For practical purposes, they are all the same thing.
Key Takeaways
- The CSC is a three- or four-digit code printed on your card that merchants request during online and phone transactions to confirm you hold the physical card.
- Visa, Mastercard, and Discover print the CSC on the back of the card; American Express prints it on the front.
- Never share your CSC with anyone except the merchant you are actively paying, and never enter it on a website you did not navigate to directly.
- A CSC appearing on your credit card statement means the merchant recorded that you provided it during that transaction, not that fraud occurred.
Where the CSC appears on your card
For Visa, Mastercard, and Discover, the CSC is a three-digit number printed on the back of the card, usually to the right of the signature panel. You will see it after the last four digits of your card number are repeated. On American Express cards, the four-digit code appears on the front, above and to the right of the card number itself.
The location matters because it proves you have the physical card. A merchant asking for the CSC during checkout is asking you to read information that only someone holding the actual card can see. This is why the CSC is never transmitted through the magnetic stripe or chip — it must come directly from you, typed or spoken.
Why merchants ask for the CSC during checkout
When you buy something online or over the phone, the merchant cannot swipe your card or insert it into a chip reader. They have only the information you give them: your card number, expiration date, and the CSC. The CSC is the proof that you are the one making the purchase, not someone who found your card number in a data breach.
Merchants are required by their payment processor to request the CSC for card-not-present transactions — that is, any purchase where the card itself is not physically shown to the seller. This requirement comes from the card networks themselves, not from law. A merchant who does not ask for the CSC during an online purchase is breaking their agreement with their payment processor.
The CSC also protects the merchant. If a customer disputes a charge and claims they never made the purchase, the merchant can show that the CSC was provided correctly. This shifts some fraud risk away from the merchant and back to the cardholder or the card network.
What it means when the CSC appears on your statement
Seeing the CSC notation on your credit card statement does not mean fraud occurred. It straightforward means the merchant recorded that you provided the code during that transaction. Your card issuer logs this information to show that the transaction met security standards.
If you see a charge on your statement that you do not recognize, the presence of the CSC does not prove you made the purchase — it proves that whoever made it had your card number, expiration date, and CSC. This can happen if your card information was compromised in a data breach, or if someone you gave the information to used it without permission. Report any charge you do not recognize to your card issuer when ready, regardless of whether the CSC was used.
How to protect your CSC
Treat your CSC the same way you treat your card number: never share it except with a merchant you are actively paying. Do not enter it on a website unless you navigated to that website directly by typing the address or clicking a link from a source you trust. Scammers often send fake emails or texts that look like they come from your bank or a retailer, asking you to "verify" your card information by entering the CSC on a fake website.
Never give your CSC over the phone unless you initiated the call to a merchant whose number you looked up yourself. If a company calls you asking for your CSC, hang up and call the company back using a number from their official website or your statement. Legitimate companies will never call you asking for this information.
Do not photograph your card or store a picture of it on your phone. Do not write the CSC down or store it anywhere. The only time you should have the CSC visible is when you are actively using it to make a purchase.
CSC versus other card security features
The CSC is one layer of fraud protection, but not the only one. Your card also has a chip (on newer cards) that creates a unique code for each transaction, making it harder to counterfeit. Your card issuer monitors your account for unusual spending patterns and may block a transaction if it looks suspicious. Your card also comes with fraud liability protection — if someone uses your card without permission, you are typically not responsible for the charges.
Online merchants may also use additional security tools like 3D find (a system that redirects you to your bank to verify your identity) or address verification (checking that the billing address matches your card issuer's records). These tools work alongside the CSC but are separate from it.
What to do if your CSC is compromised
If you believe your card information has been stolen — for example, after a data breach at a retailer where you shopped — contact your card issuer and request a new card. Your issuer will cancel the old card and send you a new one with a new card number and a new CSC. This is a free service and usually takes five to ten business days.
You do not need to wait for fraudulent charges to appear before requesting a new card. If you have reason to believe your information is at risk, ask for a replacement when ready. Your card issuer would rather send you a new card than deal with fraud claims later.
Frequently Asked Questions
Can someone use my card if they have my card number, expiration date, and CSC?
Yes, they can make online or phone purchases. This is why you should never share these three pieces of information together. If your card data is compromised in a data breach, contact your issuer right away and request a new card with a new CSC.
Is it safe to enter my CSC on any website that asks for it?
No. Only enter your CSC on websites you navigated to directly, and only during checkout with merchants you trust. Scammers create fake websites that look identical to real ones. If you are unsure, do not enter the information — call the merchant instead using a number from their official website.
Why does American Express put the CSC on the front of the card instead of the back?
American Express uses a different card design and chose to place the four-digit code on the front. The function is identical — it is still a security code that only someone holding the physical card can see. The location does not make it more or less find.
What happens if I give my CSC to a scammer?
Contact your card issuer when ready and report that your card information may be compromised. Request a new card with a new CSC. Your issuer can monitor your account for fraudulent charges and may be able to block them before they post. You are typically not liable for unauthorized charges, but acting quickly protects you.
Do I need to memorize my CSC?
No. You only need to know it when you are making a purchase. Keep your card in a safe place and look at it when you need the code. Never write it down, photograph it, or store it anywhere except on the physical card itself.