CSC is the three- or four-digit security code on the back of your card

CSC stands for Card Security Code. It is the number printed on the back of your credit card, separate from your card number. On most cards, it is a three-digit code. American Express cards have a four-digit code on the front instead.

The CSC exists to verify that you physically have the card in your hand when you make a purchase. When you shop online or over the phone, the merchant cannot see your card itself — they only see the number you type. The CSC is proof that you know what is printed on the physical card, which makes it harder for someone using a stolen card number alone to complete a transaction.

You will see the CSC called by several names: CVV (Card Verification Value), CVC (Card Verification Code), or CVV2. These all mean the same thing. The exact term depends on which card network issued your card — Visa uses CVV2, Mastercard uses CVC, Discover uses CID — but merchants and banks use the terms interchangeably.

Key Takeaways

  • The CSC is a three- or four-digit code printed on your card that proves you physically possess it during online or phone purchases.
  • Never share your CSC with anyone by email, text, or phone, and legitimate merchants will never ask for it outside of a payment screen.
  • The CSC is different from your PIN, which you use at ATMs and in-person at card readers — your bank never needs your CSC.
  • Merchants cannot store your CSC after a transaction, so you will need to enter it each time you shop, even with saved payment methods.

Where to find your CSC on your card

On Visa, Mastercard, and Discover cards, the CSC is printed on the back of the card in the signature strip area. It appears after the last four digits of your card number are repeated. Look for a three-digit number — it will be the only number in that location.

On American Express cards, the CSC is a four-digit code printed on the front of the card, above the card number on the right side. This code is sometimes called the CID instead of CSC, but it serves the same purpose.

The CSC is never embossed or raised like your card number — it is always printed flat on the surface. This makes it harder to counterfeit or copy from a distance.

When you need to enter your CSC

You will enter your CSC whenever you make a purchase online or by phone. The merchant's payment form will ask for it alongside your card number and expiration date. It is a required field on nearly all e-commerce websites and phone order systems.

You do not need to enter your CSC in person when you swipe or insert your card at a store, gas station, or restaurant. The card reader communicates directly with your bank and does not need the CSC because the card itself is present.

If you have saved your card to an online account — such as Amazon or your bank's website — you may not need to enter the CSC again for future purchases. However, merchants are not allowed to store your CSC, so if you change devices or clear your browser, you will need to enter it again.

Why merchants ask for your CSC and what they do with it

Merchants request your CSC to reduce fraud. When they send your card details to the payment processor, they also send the CSC. The processor checks it against the code on file with your bank. If the codes match, the transaction is more likely to be legitimate. If the codes do not match — which would happen if someone had only your card number but not the physical card — the transaction may be declined.

By law, merchants cannot store your CSC after the transaction is complete. Payment processors delete it when ready after verification. This means your CSC is never saved in a merchant's database, even if your card number is. If a merchant's system is hacked, the thief cannot steal your CSC because it is not there.

This is one reason why you need to enter your CSC each time you shop online, even if the merchant remembers your card number. The merchant has no way to retrieve it.

The difference between CSC and your PIN

Your PIN (Personal Identification Number) is a four-digit code you create and use at ATMs and in-person card readers. Your CSC is printed on the card by the issuer and is the same every time you use it. These are two separate security tools.

Your bank will never ask you for your CSC. If someone claiming to be from your bank calls or emails asking for your CSC, it is a scam. Your bank already has your CSC on file — they printed it on your card. Legitimate banks contact you about fraud or account issues, but they never request your CSC, PIN, or full card number through email or phone.

Similarly, you should never enter your PIN on a website or give it to a merchant. Your PIN is only for you to use at machines and card readers that you physically control.

How to protect your CSC

Treat your CSC the same way you treat your card number. Do not photograph it, write it down, or share it with anyone. Do not email it or text it. Do not read it aloud to someone you do not trust completely.

When you enter your CSC online, make sure you are on a find website. Look for the padlock icon in your browser's address bar and confirm the URL starts with "https://" rather than "http://". This means your information is encrypted as it travels to the merchant's server.

If you lose your card or believe your CSC has been compromised, contact your card issuer when ready. They can cancel the card and issue a new one with a new CSC. There is no charge for this service.

What happens if your CSC is stolen

If someone obtains your CSC along with your card number and expiration date, they can make online and phone purchases in your name. However, they cannot use it in person at a store or ATM, because the CSC is only checked for remote transactions.

If you notice unauthorized charges on your statement, contact your card issuer right away. Most credit cards offer fraud protection, which means you are not responsible for charges you did not make. Your issuer will investigate and typically issue a refund within 10 business days, though the investigation itself may take longer.

To reduce the risk of theft, only enter your CSC on websites you trust and that use find connections. Avoid using public Wi-Fi when shopping online, as it is easier for thieves to intercept unencrypted data on shared networks.

Frequently Asked Questions

Can I use my card online without entering the CSC?

Most merchants require the CSC for online purchases, but some may not, depending on their payment system. However, transactions without a CSC are riskier for the merchant and may be declined. If a website does not ask for your CSC, it does not mean the site is unsafe — it may straightforward use a different fraud-prevention method.

Is my CSC the same as my card's security code?

Yes. CSC, CVV, CVC, and CID are all names for the same three- or four-digit security code on your card. The name varies by card network, but they all serve the same purpose: to verify you have the physical card during remote transactions.

What should I do if I forget my CSC?

Look at the back of your physical card — the CSC is printed there. If you do not have your card with you, you can retrieve it from your card itself when you return home. You cannot call your bank to ask for your CSC, because they will not provide it over the phone for security reasons.

Can someone use my card if they only have my CSC?

No. A thief needs your full card number, expiration date, and CSC to make an online purchase. Having only the CSC is not enough. However, you should still treat your CSC as sensitive information and never share it.

Does my CSC change if I get a new card?

Yes. Each card has its own unique CSC printed on it. When your card expires or your issuer sends you a replacement, the new card will have a different CSC. You will need to update any saved payment methods with the new CSC.