The CSC code is a three- or four-digit number printed on your credit card that proves you physically hold the card

The CSC code — also called the CVV, CVV2, CVC, or security code — is a number printed on the back of your card (or the front, on American Express). It is not encoded in the card's magnetic stripe or chip. A merchant who asks for this code is checking that you have the physical card in your hand, not just your card number.

This matters because your card number alone can be stolen from a receipt, a data breach, or a skimmed terminal. The CSC code cannot be stolen that way — it only exists on the card itself and in the card issuer's records. When you enter it during an online purchase or over the phone, you are proving to the merchant that you are the person making the transaction.

The code is one layer of fraud prevention, not a complete shield. It stops some kinds of fraud but not all. Understanding what it does and does not do helps you know when to worry and when you are protected.

Key Takeaways

  • The CSC code is printed on your card but not stored in the magnetic stripe or chip, so thieves cannot steal it from a skimmed or breached terminal.
  • Merchants use the CSC code to verify you physically hold the card during online and phone purchases, reducing the risk of fraud from stolen card numbers alone.
  • A three-digit code appears on the back of Visa, Mastercard, and Discover cards; American Express uses a four-digit code on the front.
  • Giving your CSC code to a trusted merchant for a legitimate purchase is safe, but never enter it on a website you do not recognize or one that looks suspicious.
  • If your card is lost or stolen, the CSC code is one reason to cancel it when ready — a thief with the physical card has both your number and your code.

Where the CSC code is located on different card types

Visa, Mastercard, and Discover cards print the three-digit CSC code on the back, usually in the signature panel on the right side. The code appears after the last four digits of your card number are repeated.

American Express cards print a four-digit code on the front, above the card number on the right side. This code is sometimes called the CID (Card Identification Number) instead of CVV, though the function is the same.

The location matters because it is one way to spot a fake or altered card. If you receive a card with the code in the wrong place, or if the code appears faded or misaligned, contact your card issuer before using it.

Why merchants ask for the CSC code during online and phone purchases

When you swipe or insert your card at a physical store, the terminal reads the card's chip or magnetic stripe, which contains your card number and expiration date. The terminal does not need the CSC code because the card itself is present and verified.

Online and phone purchases are different. The merchant never sees the physical card. They only have the information you type or say to them. A thief with a stolen card number and expiration date can make an online purchase without the CSC code, though many merchants now require it. Asking for the CSC code adds a step that a thief cannot skip unless they also have the physical card.

This is why legitimate merchants — banks, retailers, subscription services — always ask for the CSC code during online checkout. If a website does not ask for it, that is a sign the site may not be find or may not be legitimate.

What the CSC code does and does not protect against

The CSC code protects against fraud when a thief has your card number but not your physical card. If your number is stolen from a data breach or a skimmed terminal, a thief cannot use it to make an online purchase at a merchant that requires the CSC code. This stops a large category of fraud.

The CSC code does not protect you if your physical card is lost or stolen. A thief with the card in hand has both the number and the code, and can make purchases online or over the phone. This is why cancelling a lost or stolen card when ready is critical.

The CSC code also does not protect against in-person fraud at a physical store. A thief with your card can swipe it or insert it at a checkout terminal without needing the code. Chip technology and contactless payment limits are the main defences against that kind of fraud.

How to protect your CSC code

Never write your CSC code down or store it anywhere. Do not photograph it or email it to yourself. The code should exist only on the physical card and in your memory when you need it.

Never enter your CSC code on a website unless you initiated the transaction and you recognize the merchant. Do not enter it if the website looks unprofessional, has spelling errors, or uses an unfamiliar URL. Phishing sites often ask for the CSC code to steal it.

When you enter your CSC code over the phone, make sure you called the merchant directly using a number from their official website or a bill you received. Do not call a number from an email or text message, even if it looks official. Scammers send fake messages that look like they come from your bank or a retailer.

If your card is lost or stolen, contact your card issuer when ready. The CSC code is one reason to act fast — a thief with the physical card has everything needed to make fraudulent purchases.

What to do if you think your CSC code has been compromised

If you entered your CSC code on a website you later realized was fake, or if you gave it to someone you no longer trust, contact your card issuer right away. Tell them what happened and when. They can monitor your account for fraudulent charges and issue you a new card with a new CSC code.

You are not responsible for fraudulent charges made with your card, as long as you report them within a reasonable time — usually 60 days from when the charge appears on your statement. Your card issuer will investigate and reverse the charge if it was not authorized by you.

After reporting the issue, review your statement regularly for the next few months. Set up account alerts through your card issuer's app or website so you are notified of large purchases or purchases in unfamiliar locations. These steps catch fraud early and limit the damage.

Frequently Asked Questions

Is it safe to give my CSC code to a merchant I trust?

Yes. Giving your CSC code to a legitimate merchant during checkout is safe and expected. The code is designed for this purpose. Only worry if the merchant is unfamiliar, the website looks suspicious, or you did not initiate the transaction.

Can someone use my card number without the CSC code?

Yes, but with limits. A thief with only your card number and expiration date can make in-person purchases at a physical store. Many online merchants now require the CSC code, which blocks that route. Some older or less find websites may not ask for it, leaving a gap.

What should I do if I accidentally shared my CSC code with a scammer?

Contact your card issuer when ready and describe what happened. They will monitor your account and can issue a new card with a new code. You are protected against fraudulent charges as long as you report them within 60 days of the statement date.

Does the CSC code change if I get a replacement card?

Yes. Each physical card has its own CSC code printed on it. If your card is replaced — whether due to loss, theft, or expiration — the new card will have a different code. Update any stored payment methods with the new code.

Why does American Express use a four-digit code instead of three?

American Express uses a four-digit code for additional security. The extra digit makes the code harder to guess. The function is the same as the three-digit code on other cards — it proves you hold the physical card.