The CSC is a three- or four-digit security code printed on your card
The Card Security Code (CSC) — also called a CVV, CVV2, CVC, or CID depending on which card network issued it — is a number printed on your physical card that proves you have the card in your hand. It is not encoded in the magnetic stripe or chip. Visa and Mastercard print a three-digit code on the back, right after the signature panel. American Express prints a four-digit code on the front, above the account number.
The code exists to prevent fraud when you cannot hand the card to someone in person. When you buy something online, over the phone, or by mail, the merchant asks for this number to confirm you actually possess the card. A thief who has only your card number and expiration date cannot complete the transaction without it.
The CSC is not the same as your PIN, which you use at ATMs and some in-person terminals. It is also not your security code for online banking or your card's password. It is purely a fraud-prevention tool for remote purchases.
Key Takeaways
- The CSC is a three- or four-digit number printed on your card that you must provide for online, phone, and mail purchases.
- Visa and Mastercard print the code on the back of the card; American Express prints it on the front.
- You should never store your CSC in your phone, email, or anywhere online, and never share it except directly with a merchant during a transaction.
- Merchants are not supposed to store your CSC after a transaction completes, so if you see it saved in your account, contact the company immediately.
- The CSC protects against card-not-present fraud, but it does not protect you if your card number is stolen — you are still liable for fraudulent charges unless you report them promptly.
Where to find your CSC on different card types
On a Visa or Mastercard, flip the card over and look at the back. The CSC is the three-digit number printed to the right of the signature strip, usually in a slightly raised or embossed format. It appears after the last four digits of your account number.
On an American Express card, the four-digit code is on the front, printed above and to the right of your account number. Because American Express cards are typically smaller and the layout is different, the position is more prominent than on other cards.
If your card is damaged or the number is worn away, contact your card issuer and request a replacement. They will mail you a new card with a new CSC. The old CSC will no longer work once the new card arrives.
When and where you need to provide your CSC
You provide your CSC whenever you make a purchase without physically handing your card to the merchant. This includes online shopping, phone orders, and mail orders. The merchant's payment form will have a field labeled "CVV," "CVV2," "CVC," "Security Code," or "Card Code" — these all mean the same thing.
You do not need to provide your CSC at a physical store when you swipe or insert your card. You also do not need it for in-person contactless payments (tap or mobile wallet). The code is only for remote transactions where the merchant cannot see the card itself.
Some subscription services and recurring billing arrangements ask for your CSC during setup. This is normal, but be cautious: legitimate companies should not ask you to store your CSC permanently in their system. After the first transaction, they should store only your card number and expiration date, and they should request a new CSC if they need to retry a failed charge.
Why merchants should not store your CSC
Payment card networks have strict rules: merchants are forbidden from storing your CSC after a transaction is complete. The code is meant to be used once and then discarded. If a merchant's database is breached, the thief gets your card number and expiration date, but not the CSC — which limits what they can do with the stolen information.
If you notice your CSC saved in your account on a merchant's website, that is a red flag. Contact the company's customer service and ask them to delete it. If they refuse or seem confused about the rule, consider whether you want to continue doing business with them. Major retailers and payment processors follow this rule; smaller or less professional merchants sometimes do not.
Some older or poorly designed payment systems may ask you to re-enter your CSC for every transaction, even recurring ones. This is actually the correct approach — it is inconvenient, but it is safer than storing the code.
How the CSC protects you and what it does not protect
The CSC reduces the risk of card-not-present fraud. If someone steals your card number from a data breach or skimming device, they still cannot complete an online purchase without the CSC. This is why online fraud rates are lower than they would be otherwise.
However, the CSC does not protect you if your full card information — including the CSC — is stolen. A thief who has all four pieces of data (card number, expiration date, CSC, and your name) can make purchases online. The CSC is a speed bump, not a wall.
The CSC also does not protect you from liability if your card is used fraudulently. Under federal law, your liability for unauthorized charges is capped at $50, but only if you report the fraud within a specific timeframe. Check your card issuer's fraud policy for exact deadlines. Most issuers are more lenient and will reverse fraudulent charges even if you report them late, but you are not legally may provide that protection.
How to keep your CSC safe
Never write your CSC down, photograph it, or store it in your phone, email, or cloud storage. The only time your CSC should exist outside your physical card is during the moment you type it into a merchant's payment form. After that transaction, it should be gone from your screen and from any record you keep.
Do not share your CSC with anyone over the phone or email, even if they claim to represent your bank or the merchant. Legitimate companies will never ask you to provide your CSC this way. If someone calls claiming to verify your card, hang up and call your card issuer's number from the back of your card instead.
When shopping online, make sure you are on a secure website. Look for "https://" in the address bar and a padlock icon. This encrypts your CSC in transit so it cannot be intercepted. Avoid entering your CSC on public Wi-Fi networks, since they are easier to intercept than home or work networks.
What to do if your CSC is compromised
If you believe your CSC has been exposed — for example, you used it on a website that was later breached — contact your card issuer immediately. You do not need to wait for fraudulent charges to appear. The issuer can issue you a new card with a new CSC, usually within 5 to 10 business days.
In the meantime, monitor your account for unauthorized charges. Most card issuers offer free fraud monitoring and alerts. Set up text or email notifications for all transactions so you catch anything unusual right away.
If fraudulent charges do appear, report them to your card issuer as soon as you see them. Do this by phone or through your online account — do not email sensitive information. The issuer will investigate and typically reverse the charges within one to two billing cycles while they look into it.
Frequently Asked Questions
Is my CSC the same as my PIN?
No. Your PIN is a number you create and use at ATMs and some in-person card terminals. Your CSC is printed on the card and used only for remote purchases. They serve different purposes and are not interchangeable.
Can I use my card online without providing a CSC?
Most major online retailers require a CSC, but some do not, especially if you have an account with them and have made purchases before. Some payment systems use other fraud-prevention methods instead, like address verification or 3D Secure authentication. It depends on the merchant's payment processor.
What happens if I enter the wrong CSC?
The transaction will be declined. You can try again with the correct number. Entering the wrong CSC multiple times may trigger a fraud alert on your account, so if you are unsure, double-check the number before submitting.
Do I need to memorize my CSC?
No. You only need to know where to find it on your card when you make a purchase. Memorizing it is actually less secure than keeping it only on the physical card, because if you memorize it, you might accidentally share it or use it somewhere unsafe.
Will my CSC change if I get a replacement card?
Yes. Every time your card issuer sends you a new card — whether because yours expired, was damaged, or was compromised — the new card will have a different CSC. Any merchant that has your old CSC on file will need the new one for future transactions.