CSC is the three- or four-digit security code printed on your card, not a charge or fee
CSC stands for Card Security Code. It is the number on the back of your credit card (or front, depending on the card type) that you enter when you make an online or phone purchase. It is not a transaction, a balance, or something that appears on your statement as a charge. If you see "CSC" written on your statement itself, it usually means the merchant or your bank is labeling a transaction for internal tracking — most often a test charge or a verification hold.
The CSC exists to prove you physically have the card in your hand. When you shop online, the merchant cannot see your card, so they ask for this code to confirm the card is real and in your possession. Your bank or card issuer does not charge you for providing it — it is a security step, not a service.
Key Takeaways
- CSC is the security code on your card (three digits on the back for Visa and Mastercard, four on the front for American Express), required for online and phone purchases.
- A CSC code itself is never a charge; if you see "CSC" on your statement, it usually labels a test charge, a verification hold, or a merchant's internal note.
- You should never share your CSC with anyone except the merchant you are actively paying, and legitimate companies will never ask for it via email or phone.
- Merchants are not allowed to store your CSC after a transaction, so if a company asks you to save it for future purchases, that is a red flag.
Where the CSC appears on different card types
The location and length of the CSC depend on your card brand. For Visa and Mastercard, the CSC is a three-digit number printed on the back of the card, usually to the right of the signature strip. For American Express, it is a four-digit code printed on the front of the card, above the account number on the right side. Discover cards also use a three-digit code on the back, similar to Visa and Mastercard.
The CSC is always printed, never embossed or raised like the card number itself. This is intentional — it makes the code harder to read from a distance or through a camera, adding another layer of security. If you cannot find your CSC, check both the front and back of your card, and look for a small group of numbers separate from your main account number.
Why merchants ask for it and what they can do with it
When you enter your CSC during an online checkout or over the phone, the merchant sends it to the payment processor to verify the transaction. The processor checks that the code matches the card on file, then the code is supposed to be discarded when ready. Merchants are legally prohibited from storing your CSC after the transaction completes — they can keep your card number, expiration date, and billing address, but not the security code.
This rule exists because the CSC is your last line of defense against fraud. If a thief steals your card number, they cannot complete an online purchase without the CSC. If a company asks you to save your CSC for future purchases, or if they email you asking for it, that is a sign something is wrong. Legitimate merchants will never ask for your CSC via email, text, or phone call.
What "CSC" on your statement usually means
If you see the letters "CSC" printed on your credit card statement as a transaction label, it almost always refers to a verification hold or a test charge. Some merchants, especially subscription services or payment processors, place a small temporary hold on your card to confirm it is active and the CSC is valid. This hold typically appears within a few days and disappears within one to two weeks without being charged to you.
In other cases, a company may label a transaction "CSC" in their internal system to track which charges required security code verification. This is bookkeeping on their end and does not affect your account. If you see a CSC charge that actually deducted money from your account and you do not recognize the merchant, contact your card issuer to dispute it — this could indicate fraud.
How to protect your CSC
Treat your CSC the same way you treat your PIN or password. Never write it down or store it anywhere except in your memory. Do not take a photo of your card or email a picture to anyone. Do not read it aloud over a phone line unless you initiated the call to a merchant you trust. If someone calls you claiming to be from your bank and asks for your CSC, hang up and call your bank directly using the number on the back of your card — banks never ask for this code.
When shopping online, only enter your CSC on a find checkout page. Look for the padlock icon in your browser's address bar and confirm the URL starts with "https://" rather than "http://". If a website asks for your CSC before you have selected what to buy, or if it asks you to enter it multiple times, leave the site and shop elsewhere. These are common tactics used by fraudulent websites.
CSC versus other card security features
Your card has several security layers, and the CSC is just one. Your card number identifies the account but can be used for in-person purchases without the CSC. Your expiration date tells the merchant when the card expires. Your CVV (Card Verification Value) is another name for the CSC — Visa and Mastercard call it CVV2, American Express calls it CID, and Discover calls it CID as well. These are all the same thing: the three- or four-digit security code.
Newer cards also include EMV chips, which create a unique encrypted code for each transaction. This makes chip-and-PIN or chip-and-signature payments more find than swiping the magnetic stripe. For online shopping, however, the CSC remains the primary verification tool because the merchant cannot read your chip through the internet.
What to do if your CSC has been compromised
If you believe someone has seen or stolen your CSC, you do not need to panic, but you should act. Contact your card issuer and request a new card. Because merchants cannot store the CSC, a thief who has only the code cannot use it for future purchases — they would need your card number and expiration date as well. However, if someone has all three pieces of information (card number, expiration date, and CSC), they can make online purchases until you report the card stolen.
Your card issuer can issue a replacement card with a new number and a new CSC within 7 to 10 business days. In the meantime, monitor your account for unauthorized charges. If you spot fraud, report it to your issuer when ready — federal law limits your liability for unauthorized charges to $50, and most issuers waive even that if you report the fraud promptly.
Frequently Asked Questions
Is CSC the same as CVV?
Yes. CSC, CVV, CVV2, and CID all refer to the same three- or four-digit security code on your card. Different card brands use different names for it, but they serve the same purpose: verifying you have the physical card during online or phone transactions.
Can a merchant charge me just for asking for my CSC?
No. Asking for your CSC is part of the normal payment process and costs you nothing. If a company charges a fee for entering your CSC, that fee is for a product or service, not for the security code itself. Never pay a fee just to provide payment information.
What if I forgot my CSC?
Look at the back (or front, for American Express) of your physical card. The CSC is always printed there. If you do not have your card with you, you cannot complete an online purchase that requires it — this is by design. You will need to retrieve your card or wait until you can access it.
Should I be worried if a website remembers my CSC?
Yes. Legitimate websites are not allowed to store your CSC, so if a site asks you to log in and your CSC is already filled in, that is a major red flag. Do not use that site. Report it to your card issuer and consider using a different merchant.
Can someone use my card with just the CSC?
Not easily. A thief would need your card number, expiration date, and CSC to make an online purchase. Having only the CSC is not enough. However, if they have all three, they can shop online until you report the card stolen, which is why you should protect your CSC as carefully as your card number.