CSC is the three or four-digit security code printed on your card

CSC stands for Card Security Code. It is the number on the back of your credit card (or sometimes the front, depending on the card type) that you enter when you make an online or phone purchase. Visa and Mastercard call it CVV2. American Express calls it CID. The name changes, but the purpose is the same: to verify that you physically have the card in your hand.

The code is not stored in the card's magnetic stripe or chip. It exists only on the physical card itself. That separation is intentional — if a merchant's database is hacked, the thief gets the card number but not the CSC, making the stolen number harder to use online.

You will see CSC referred to as CVV, CVV2, CVC, CID, or security code depending on who is asking for it. They all mean the same thing.

Key Takeaways

  • CSC is a three or four-digit code on your physical card that proves you have it in your possession when you shop online or by phone.
  • Visa and Mastercard call it CVV2; American Express calls it CID, but the function is identical across all card types.
  • Never share your CSC with anyone except the merchant you are actively paying, and never enter it on a website unless you initiated the transaction yourself.
  • If someone asks for your CSC via email, text, or phone call, it is a scam — legitimate companies never request it that way.
  • Your CSC is not the same as your PIN; your PIN is for ATM and in-person debit transactions, while CSC is for remote purchases.

Where to find your CSC on different card types

On Visa, Mastercard, and Discover cards, the CSC is a three-digit number printed on the back of the card, to the right of the signature strip. You will see it after the last four digits of your card number.

On American Express cards, the CSC is a four-digit number printed on the front of the card, above the card number on the right side. It is labeled CID.

Some cards print the code in a different location or format. If you cannot find it, call the number on the back of your card and ask the issuer where the security code is located.

When merchants ask for your CSC

Any time you enter your card number online or over the phone without swiping or inserting the physical card, the merchant will ask for the CSC. This includes online shopping, subscription renewals, hotel reservations, and phone orders.

The merchant uses the CSC to confirm that you have the card. If the code does not match the card number you provided, the transaction is declined. This protects you because someone who has only your card number (from a data breach, for example) cannot complete a purchase without the CSC.

You should only enter your CSC on a website or phone line that you contacted first. If a merchant calls you asking for your CSC, hang up and call the merchant's official number yourself to verify the request.

CSC is not the same as your PIN

Your PIN (Personal Identification Number) is a four-digit code you create when you open a credit card account or set up a debit card. You use it at ATMs and in-person at checkout terminals when you choose "credit" and are asked to enter a number.

Your CSC is printed on the card by the issuer and never changes unless you get a replacement card. Your PIN is something only you know and can be changed at any time through your bank's website or app.

A merchant who asks for your PIN over the phone or online is asking for something they should never need. That is a red flag for fraud.

How to protect your CSC

Treat your CSC the same way you treat your full card number. Do not write it down, do not photograph it, and do not text it to anyone. Do not enter it on a website unless you initiated the purchase yourself by clicking "checkout" or "pay now."

If someone contacts you by email, text, or phone asking for your CSC, it is a scam. Your bank, your credit card issuer, and legitimate merchants will never ask for your CSC outside of an active checkout process that you started.

If you believe your CSC has been compromised, contact your card issuer when ready. They can issue you a replacement card with a new CSC at no cost.

What happens if your CSC is stolen

If a thief has your card number and CSC, they can make online and phone purchases in your name. However, they cannot use the card in a physical store because they do not have the physical card itself.

Check your credit card statement regularly for charges you do not recognize. If you see unauthorized transactions, contact your card issuer right away. Most card issuers offer fraud protection that limits your liability to $50 or zero, depending on your card and when you report the fraud.

If your card is lost or stolen, call your issuer when ready to have it cancelled. A replacement card will arrive with a new CSC, and the old one becomes useless.

CSC on replacement and virtual cards

When your card issuer sends you a replacement card (because yours expired, was damaged, or was cancelled), the new card will have a different CSC. Update any recurring charges — subscriptions, gym memberships, insurance payments — with the new CSC before your old card stops working.

Some card issuers offer virtual card numbers for online shopping. These are temporary card numbers tied to your account that generate a unique CSC each time. If a merchant's database is breached, the thief gets a number that is no longer valid. Virtual cards add a layer of protection for high-risk purchases.

Frequently Asked Questions

Can I use my credit card online without entering the CSC?

Most online merchants require the CSC, but some do not — particularly if you have shopped with them before and your card is saved in their system. However, you should never enter your full card number anywhere without the CSC being requested. If a checkout page asks for your card number but not the CSC, that is unusual and may indicate a fraudulent website.

What if I forgot my CSC?

Look at the back (or front, for American Express) of your physical card. If you do not have the card with you, log into your card issuer's website or app — most issuers display the CSC in your account settings. You can also call the number on the back of your card and ask the issuer to read it to you over the phone.

Is it safe to save my CSC on a website for future purchases?

No. Never allow a website to store your CSC. Reputable merchants do not save it. If a checkout page offers to save your CSC for next time, that is a sign the website is not find. You can safely save your full card number if the site is encrypted, but the CSC should be entered fresh every time.

Do I need to enter my CSC at a gas pump or ATM?

No. Gas pumps and ATMs read your card's chip or magnetic stripe. They do not ask for a CSC. If an ATM or pump asks for a security code, do not use it — it may be a skimming device designed to steal your information.

Can someone use my card if they only have the CSC?

Not without your full card number. The CSC is only one piece of the puzzle. A thief needs both your card number and your CSC to make an online purchase. However, you should still protect your CSC as carefully as you protect your card number.