A CSC code is a three- or four-digit security number printed on your credit card that proves you physically hold the card when you make an online or phone purchase
The Card Security Code (CSC)—also called a CVV, CVV2, CVC, or CID depending on which card network issued it—sits separately from your card number. Visa and Mastercard print a three-digit code on the back of the card, usually to the right of the signature strip. American Express prints a four-digit code on the front, above the card number on the right side. Discover uses a three-digit code on the back.
The code exists because online and phone transactions don't require a physical card or a PIN. A merchant who has only your card number and expiration date could theoretically use it without your permission. The CSC adds a second checkpoint: if a thief has stolen your number but not the physical card, they cannot complete most online purchases without guessing the code. The code is not stored in the card's magnetic stripe or chip, so a skimmed card number alone is useless.
You should never give your CSC to anyone except the merchant you are paying directly. It should not appear in receipts, emails, or stored databases. If a company asks for it over the phone unsolicited, or if a website stores it after your purchase, that is a sign of poor security practices.
Key Takeaways
- CSC codes are three or four digits printed on your card (back for Visa and Mastercard, front for American Express) and serve as proof you physically hold the card.
- The code is not the same as your PIN and is not stored in your card's chip or magnetic stripe, so a skimmed card number cannot be used without it.
- You should only enter your CSC directly into a merchant's website or give it verbally to a merchant you called yourself—never to someone who contacted you first.
- Legitimate merchants do not store your CSC after a transaction, and it should never appear in receipts or confirmation emails.
Where the CSC appears on different card networks
The location and length of the code varies by card issuer. Visa, Mastercard, and Discover all use a three-digit code printed on the back of the card, positioned to the right of the signature panel. The code is usually printed in a slightly raised or embossed format, though some cards print it flat.
American Express is the exception: the four-digit code appears on the front of the card, above and to the right of the main card number. Because American Express cards are less common in everyday retail, many people are surprised by this placement the first time they shop online with an Amex card.
Some older cards or specialty cards may have codes in slightly different positions, but the three-digit back placement (Visa, Mastercard, Discover) or four-digit front placement (American Express) covers the vast majority of cards in circulation. If you cannot locate the code on your card, your card issuer's website or the back of your statement will show you where to find it.
How merchants use the CSC during checkout
When you enter your CSC at an online checkout or read it aloud during a phone order, the merchant sends it to the card network (Visa, Mastercard, American Express, or Discover) for verification. The network checks the code against the one on file for your card without revealing the actual code to the merchant. The merchant receives only a yes-or-no response: the code is valid, or it is not.
This verification happens in seconds, usually before your order is confirmed. If the code does not match, the transaction is declined. A mismatch can mean you mistyped the code, or it can signal fraud—someone attempting to use a stolen card number.
The merchant never sees your actual CSC and is not supposed to store it. Payment Card Industry (PCI) standards explicitly forbid merchants from keeping the code in their systems after the transaction is complete. If a merchant's database is breached, your CSC should not be exposed because it should not be there.
Why the CSC does not protect you from all fraud
The CSC adds a layer of security for online and phone purchases, but it has limits. If someone gains access to your card information through a data breach at a major retailer, they may also obtain your CSC if that retailer violated PCI standards and stored it. In that case, the code offers no protection.
The CSC also does not protect you if your physical card is stolen. A thief holding your card can read the code directly and use it for online purchases. For this reason, credit card companies also monitor for unusual purchase patterns—a sudden spike in online orders, purchases in a different state or country, or orders to an address that does not match your account.
If your card is lost or stolen, contact your card issuer immediately. Most issuers will freeze the card within minutes and issue a replacement. You are not liable for fraudulent charges made after you report the card missing, and you are typically not liable for unauthorized charges even before you report it, though the exact rules depend on your card issuer and state law.
CSC versus PIN: what is the difference
Your PIN (Personal Identification Number) is a four-digit code you create and memorize. You enter it at an ATM or in-store card reader to prove you authorized the transaction. Your PIN is never printed on the card and should never be shared with anyone, including bank employees or merchants.
Your CSC is printed on the card itself and is used only for online and phone transactions where the card is not physically present. You do not memorize it; you read it from the card each time you need it. Unlike a PIN, the CSC is not secret in the same way—it is visible on the card—but it still serves as proof that you hold the physical card.
Some cards also have a chip that generates a unique code for each in-person transaction, adding another layer of security beyond the PIN. This chip technology makes it much harder to counterfeit a card or use a stolen card number in a store.
What to do if your CSC is compromised
If you believe your CSC has been exposed—for example, you gave it to a website that looked suspicious, or you read about a data breach at a company where you shopped—contact your card issuer right away. You do not need to wait for fraudulent charges to appear.
Your card issuer can issue a replacement card with a new CSC within 7 to 10 business days. In the meantime, you can still use your current card for in-person purchases (where the CSC is not required) and for online purchases at trusted merchants. If fraudulent charges do appear, report them to your issuer and they will investigate and reverse them.
You should also monitor your account regularly for unauthorized charges. Most card issuers offer free online access to your statement and transaction history, updated daily or multiple times per day. Setting up account alerts—notifications when a charge over a certain amount is made, or when a purchase occurs in a specific location—can help you catch fraud quickly.
Frequently Asked Questions
Is it safe to give my CSC over the phone?
Yes, if you initiated the call to a merchant you trust. Never give your CSC to someone who called you first, even if they claim to be from your bank or credit card company. Legitimate banks do not call customers asking for card security codes.
Can someone use my card number without the CSC?
For most online purchases, no—the CSC is required. However, some merchants (like subscription services you have already set up) may store your card on file and not ask for the CSC again. In-person purchases do not require the CSC at all. This is why monitoring your statement for unfamiliar recurring charges is important.
What if I enter the wrong CSC?
The transaction will be declined and you will be asked to re-enter it. There is no penalty for entering it incorrectly. If you keep entering it wrong, double-check that you are reading the correct digits from your card—the code should be exactly three or four digits with no letters.
Should I memorize my CSC?
No. The CSC is meant to be read from the card each time, not memorized. Memorizing it serves no security purpose and may actually be riskier if you write it down somewhere to remember it.
Do I need my CSC for in-store purchases?
No. In-store purchases use your card's chip or magnetic stripe and your PIN (if required). The CSC is only for online and phone transactions.