The CSC is a three- or four-digit security code printed on the back of your card

The Card Security Code (CSC) — also called a CVV, CVV2, or CVC depending on which card network issued it — is a number printed directly onto your physical card. It is not encoded in the magnetic stripe or chip. On most cards, you will find it on the back, in the signature panel on the right side, printed after the last four digits of your card number. On American Express cards, it appears on the front, above the card number on the right.

This code exists to verify that you actually hold the card in your hand when you make an online or phone purchase. A merchant who has only your card number and expiration date cannot complete a transaction without it — they need proof you have physical possession of the card itself. The code is never stored in a merchant's system after the transaction clears, which is why you have to enter it every time you shop online.

Key Takeaways

  • The CSC is a three- or four-digit number printed on your card itself, not embedded in the chip or stripe, and serves as proof you physically hold the card.
  • On Visa, Mastercard, and Discover cards, the CSC appears on the back in the signature panel; on American Express, it is on the front above the card number.
  • You must enter the CSC for online and phone purchases, but never share it via email, text, or unsolicited calls — legitimate merchants never ask for it that way.
  • The CSC protects you from fraud when someone has stolen your card number but not the physical card, since they cannot complete online purchases without it.

Why the CSC is on the back, not the front

The placement of the CSC on the back of the card (or front, in American Express's case) is intentional. When you hand your card to a cashier or server in person, they see your name, card number, and expiration date — but they do not see the CSC. This design means a person who glimpses your card briefly cannot steal the one piece of information needed to make an online purchase without your knowledge.

If someone photographs your card or writes down the number while you are not looking, they still cannot shop online with it. They would need to either steal the physical card itself or find another way to obtain that three- or four-digit code. This is why the CSC is considered a basic fraud prevention tool, even though it is not a complete shield against determined thieves.

The difference between Visa, Mastercard, Discover, and American Express codes

All four major card networks use a security code, but they call it different things and the codes work slightly differently behind the scenes. Visa calls it CVV2, Mastercard calls it CVC, Discover calls it CID, and American Express calls it CID as well — though American Express's version is four digits instead of three. Despite the different names, they all serve the same purpose: proving you have the card in your hand.

From your perspective as a cardholder, the only real difference you will notice is the location. Visa, Mastercard, and Discover all print their codes on the back. American Express prints its four-digit code on the front, above the card number on the right side. When you are entering the code online or over the phone, the merchant's system usually just asks for "CVV" or "security code" regardless of which card you are using — the system knows which network you are on and validates accordingly.

When you should and should not share your CSC

You should enter your CSC when you are making an online purchase on a website you trust, when you are paying over the phone to a merchant you called yourself, or when you are using a mobile payment app. In all these cases, you are initiating the transaction and you control the interaction. The CSC is required precisely so that merchants know you are the one making the purchase.

Never share your CSC via email, text message, or in response to an unsolicited phone call. Legitimate merchants and your bank will never ask for it that way. If someone calls claiming to be from your card issuer and asks for your CSC, hang up and call the number on the back of your card instead. If you receive an email asking for it, do not click any links — go directly to the merchant's website by typing the address into your browser yourself. Scammers often pose as customer service representatives to trick you into giving them this code, and once they have it, they can make online purchases until you notice and report the fraud.

How the CSC protects you from fraud

The CSC is most useful against a specific type of fraud: someone who has stolen your card number but not your physical card. This might happen if a merchant's database is hacked, if your card number is skimmed at a gas pump, or if a photo of your card is taken without your knowledge. In all these cases, the thief has your number and expiration date but not the CSC.

When that person tries to make an online purchase, they will be stopped at checkout because they cannot provide the code. This gives you time to notice the fraud attempt on your statement and report it before significant damage occurs. The CSC does not protect you if someone steals your physical card itself — they will have the code right there — but it does raise the bar for remote fraud. Combined with your bank's fraud monitoring systems, which flag unusual purchases, the CSC is one layer in a multi-layer defense.

What to do if your CSC is compromised

If you believe someone has seen or photographed your CSC, contact your card issuer when ready. You do not need to wait for fraudulent charges to appear. Your bank can issue you a new card with a new CSC, and the old card can be deactivated. This is a fast process — most issuers can have a replacement card to you within 5 to 10 business days, and many offer expedited shipping for a small fee or no fee at all.

Until your new card arrives, you can still use your current card for in-person purchases at stores and restaurants, since those transactions do not require the CSC. You can also make phone purchases by calling merchants directly, as long as you trust the number you are calling. Avoid online shopping until you have the new card, or use a different payment method like a digital wallet or a different card if you have one.

Frequently Asked Questions

Can someone use my card number and expiration date without the CSC?

Not for online purchases — the CSC is required to complete most online transactions. They could potentially use it for in-person fraud if they had a counterfeit card made, but that requires more effort and skill. For phone orders, it depends on the merchant; some require the CSC and some do not.

Is the CSC the same as my PIN?

No. Your PIN is a number you create and memorize to authorize in-person purchases at ATMs or point-of-sale terminals. Your CSC is printed on the card and is used for online and phone purchases. They are separate security tools.

What if I enter the wrong CSC?

The transaction will be declined. You will usually be given a chance to re-enter it. If you enter it incorrectly multiple times, the merchant's system may lock you out temporarily as a fraud prevention measure.

Do I need to memorize my CSC?

No. You only need to know where to find it on your card when you are making an online or phone purchase. Do not write it down or store it anywhere — just look at the card when you need it.