A CSC is the three or four-digit security code printed on your card

The Card Security Code (CSC) is a number printed on your physical credit card that you enter when you make an online or phone purchase. It is not encoded in the magnetic stripe or chip — it only appears on the card itself. The code serves as proof that you have the card in your possession at the time of the transaction.

Most cards have a three-digit code printed on the back, in the signature panel area. American Express cards print a four-digit code on the front, above the account number. The code is sometimes called a CVV (Card Verification Value), CVC (Card Verification Code), or CID (Card Identification), depending on the card network, but they all function the same way.

When you enter this code during checkout, the merchant's payment processor checks it against the code on file with your card issuer. If the codes match, the transaction proceeds. If they do not match or the code is missing, the transaction is declined. This is why merchants ask for it — it is a basic anti-fraud measure that confirms you have physical access to the card.

Key Takeaways

  • A CSC is a three or four-digit code printed on your card that you must provide for online and phone purchases.
  • The code is not stored in the card's magnetic stripe or chip, so a thief with a stolen card number alone cannot complete an online transaction without it.
  • You should never share your CSC with anyone except the merchant you are paying, and legitimate companies will never ask for it via email or phone.
  • The CSC is different from your PIN, which you use at ATMs and in-person at card readers; the CSC is only for remote transactions.

Where the CSC appears on your card

The location and format of the CSC depend on your card network. Visa, Mastercard, and Discover cards print a three-digit code on the back of the card, positioned to the right of the signature panel. This code is the last three digits of a longer number that appears in that area.

American Express cards are different. The four-digit code appears on the front of the card, above and to the right of the main account number. It is printed in smaller type than the account number itself.

The code is always printed in raised or flat text on the card surface — it is never embossed like the account number. This makes it slightly harder to read in some lighting, but it is always there on a legitimate card. If you cannot find it, check both the front and back of your card, and look in the signature area or near the account number.

Why merchants ask for the CSC during checkout

The CSC is a fraud prevention tool. When a thief steals your card number — through a data breach, a skimmed ATM, or a compromised website — they do not automatically have the CSC. The code is not transmitted or stored in the same systems as the account number, so it is not part of most data breaches.

This means a criminal with your card number alone cannot complete an online purchase without the CSC. They would need to either have your physical card or guess the three or four-digit code, which is difficult at scale. Merchants require the CSC to reduce the number of fraudulent transactions they process, which also lowers their fraud liability and the cost of processing those transactions.

The CSC is checked in real time during the transaction. If the code you enter does not match the code on file with your card issuer, the transaction is declined immediately. You will see an error message and the charge will not go through. This is different from other fraud checks, which may happen after the transaction is approved.

CSC versus PIN: what is the difference

Your PIN (Personal Identification Number) and your CSC are two separate security features, and they serve different purposes. The PIN is a four-digit code you create when you open your account, and you use it at ATMs and at in-person card readers when you tap or insert your card. The PIN is never printed on your card.

The CSC, by contrast, is printed on your card and is used only for remote transactions — online purchases, phone orders, and mail orders. You do not enter the CSC at a store or ATM. The PIN protects your account when you are physically present; the CSC protects your account when you are not.

If someone steals your card, they can use it in person if they know your PIN, but they cannot complete an online purchase without the CSC. If someone steals your card number online, they cannot use it in person without your PIN. This layering of security is intentional — no single piece of information gives a thief full access to your account.

How to protect your CSC

Treat your CSC the same way you treat your card number and expiration date — as sensitive information that only you and the merchant should see. Never enter your CSC on a website that does not have a secure connection. Look for "https://" at the beginning of the URL and a padlock icon in the address bar before you enter any card information.

Do not share your CSC via email, text, or phone call, even if someone claims to be from your card issuer or a merchant. Legitimate companies will never ask for your CSC through these channels. If you receive a call or email asking for your CSC, hang up or delete the message and contact the company directly using the number on your card or their official website.

Do not write your CSC on receipts or store it in your phone, email, or a note on your computer. The only place your CSC should be written is on your physical card. If you are making a purchase over the phone with a company you trust, you can read the code to them directly from the card, but do not repeat it or confirm it if they read it back to you — that is a common scam tactic.

What happens if your CSC is compromised

If you believe your CSC has been compromised — for example, you gave it to a fraudulent website or you saw an unauthorized charge on your statement — contact your card issuer immediately. You can find the customer service number on the back of your card or on your billing statement.

Your card issuer can issue you a new card with a new CSC. The new card will have a different account number and expiration date as well. This process usually takes 7 to 10 business days. In the meantime, your old card will be deactivated, so no new charges can be made with it.

If you see unauthorized charges on your statement, report them to your card issuer right away. You are not responsible for fraudulent charges under federal law, but you must report them within 60 days of the statement date to ensure full protection. Your card issuer will investigate the charges and typically remove them from your account within 30 to 90 days.

CSC and recurring payments

When you set up a recurring payment — such as a subscription service, gym membership, or monthly utility bill — you enter your CSC once during setup. The merchant stores your card information on file and charges your card automatically each billing cycle without asking for the CSC again.

This is safe because the merchant is authorized to store your card information and the payment is recurring. However, if your card is compromised or you close the card, you should update or remove the card information from any recurring payments before the next billing date. If you do not, the charge may be declined or the merchant may attempt to charge an old or invalid card.

If you cancel a subscription or service, make sure to remove the card from that merchant's system. Do not assume that canceling the service also removes your card information. Some merchants keep card data on file for a period of time after cancellation, which can lead to accidental charges if the subscription is reactivated.

Frequently Asked Questions

Can someone use my card online if they only have my card number and expiration date?

Not easily. Most online merchants require the CSC in addition to the card number and expiration date. Without the CSC, the transaction will be declined. However, some merchants — particularly those selling digital goods or services — may not require the CSC, so it is still possible but less common. This is why protecting your card number is important even though the CSC adds an extra layer of security.

Is it safe to save my CSC in my browser or password manager?

No. Do not save your CSC anywhere except on your physical card. Password managers and browsers are designed to store passwords, not payment card information. If your device is compromised, a thief could access your saved CSC along with your card number and expiration date, giving them everything they need to make online purchases.

What if I enter the wrong CSC during checkout?

The transaction will be declined and you will see an error message. You can try again with the correct code. Entering the wrong CSC a few times will not lock your card or trigger fraud alerts, but repeated failed attempts may cause the merchant's system to block further attempts temporarily as a security measure.

Do I need to enter my CSC every time I shop at the same online store?

It depends on whether you have saved your card information with that merchant. If you check out as a guest or do not save your card, you will need to enter the CSC each time. If you have created an account and saved your card, the merchant may not ask for the CSC on future purchases, though some merchants ask for it every time for security reasons.

What is the difference between a CSC and a security code sent to my phone?

They are different security measures. A CSC is printed on your card and proves you have the physical card. A security code sent to your phone (via text or an app) is part of two-factor authentication and proves you have access to your phone. Some merchants use both — they ask for your CSC during checkout and then send a code to your phone to confirm the transaction.