The CSC code is a three- or four-digit security number printed on your card, separate from your account number, used to verify you physically possess the card when you make online or phone purchases.
The Card Security Code (CSC) — also called CVV, CVC, or CID depending on which card network issued it — is a number the card issuer prints on the card itself but does not encode in the magnetic stripe or chip. When you enter it during an online checkout or phone order, the merchant sends it to the card network, which checks whether it matches the code on file. If it does not match, the transaction is declined.
The code serves one purpose: to confirm you have the physical card in your hand. A thief who has only your account number and expiration date cannot complete a purchase without this number. It is not the same as your PIN, which you use at ATMs and in-person terminals, and it is not stored in your account the way your address or phone number is.
Key Takeaways
- The CSC is a three- or four-digit code printed on the back of Visa and Mastercard, or the front of American Express, and exists only to verify you hold the card.
- Merchants and payment processors see the code during online and phone transactions, but legitimate companies do not store it after the transaction clears.
- Your card issuer never asks for the CSC by phone, email, or text — any request for this number outside a checkout page is a fraud attempt.
- If your CSC is compromised, you do not need a new card; the code cannot be used without the account number and expiration date, and the issuer can monitor for fraud.
Where the CSC appears on your card
The location and format depend on your card network. Visa and Mastercard print a three-digit code on the back of the card, usually in or near the signature panel. American Express prints a four-digit code on the front, above the account number on the right side. Discover also uses a three-digit code on the back.
The code is printed, not embossed, so it does not raise above the card surface the way your account number does. This makes it harder to read from a distance or to copy by rubbing. The issuer does not mail you a separate notice with this number — it is only on the physical card itself.
Why merchants ask for it during checkout
When you buy something online or over the phone, you cannot insert your card into a terminal or tap it on a reader. The merchant has no way to verify you physically possess the card. The CSC closes that gap: if you can recite the number, you almost certainly have the card in front of you.
The merchant sends the CSC to the card network along with your account number and expiration date. The network compares it to the code on file. If it matches, the transaction proceeds. If it does not match — because the number is wrong, or because someone is using a stolen account number without the card — the network declines the charge.
This check happens in seconds, behind the scenes. You see only "approved" or "declined." The merchant never stores the CSC after the transaction; payment card industry rules forbid it. If a merchant's database is breached, the CSC should not be in it.
What happens if your CSC is exposed
A CSC by itself is nearly useless to a thief. The code only works in combination with your account number and expiration date. Someone who has only the CSC cannot make a purchase. Someone who has the account number and expiration date but not the CSC will be declined on any online or phone order that requests it.
If you believe your CSC has been compromised — for example, because a website you used was breached — you do not need to request a new card. The code cannot be changed without issuing a new card, but the issuer can flag your account for fraud monitoring. Call the number on the back of your card and tell them what happened. They will review recent transactions and watch for unauthorized charges.
If you do see unauthorized charges, report them immediately. Your liability for fraud is capped at $50 under federal law, and most issuers waive even that if you report within 60 days of the statement date.
How to protect your CSC
Never enter your CSC on a website unless you are actively checking out and the page is encrypted (look for "https://" in the address bar and a padlock icon). Do not type it into an email, text message, or chat window. Do not photograph your card or save an image of it on your phone.
If a company calls you and asks for your CSC, hang up. Your card issuer, your bank, and legitimate merchants never ask for this number by phone, email, or text. Any such request is a fraud attempt. If you are unsure whether a call is legitimate, hang up, find the official phone number for the company on your statement or their website, and call them back.
When shopping online, use a card reader or autofill feature if your browser offers it — these fill in your card details without you typing them. Some card issuers offer virtual card numbers that expire after one use or work only with a specific merchant; these add a layer of protection because the number cannot be reused elsewhere.
CSC versus other card security features
The CSC is one of several tools that protect your card. Your PIN is a number you choose and memorize; it is used at ATMs and in-person terminals, never online. Your chip (EMV) is an embedded microprocessor that generates a unique code for each transaction, making it nearly impossible to counterfeit. Your magnetic stripe contains your account number and expiration date but not your CSC.
Online fraud protection also includes address verification (the merchant checks whether the billing address you enter matches the one on file) and 3D Secure, a protocol that redirects you to your bank's website during checkout to verify your identity. These work alongside the CSC but are separate from it.
If your card is lost or stolen, the CSC does not protect you from in-person fraud — a thief with your physical card can use it at a store or ATM. That is why you should report a lost or stolen card immediately, regardless of the CSC. The issuer will cancel the card and mail you a replacement with a new CSC.
Frequently Asked Questions
Can someone use my card if they have the CSC but not the account number?
No. The CSC is only one piece of the puzzle. A thief needs your account number, expiration date, and cardholder name to attempt a purchase. The CSC alone cannot be used to make a charge.
Is the CSC the same as my PIN?
No. Your PIN is a number you create and use at ATMs and in-person terminals. The CSC is printed on your card by the issuer and used only for online and phone purchases. They serve different purposes and are not interchangeable.
Why does my statement show a CSC code?
Your statement should not show your CSC. If you see a three- or four-digit code listed on your statement, it is not your security code — it may be a transaction reference number or merchant code. Your actual CSC appears only on the physical card itself.
What should I do if I accidentally shared my CSC online?
Contact your card issuer immediately. Tell them where and when you shared it. They can monitor your account for fraud and, if necessary, issue you a new card with a new CSC. Most issuers can flag your account within minutes.
Do I need to memorize my CSC?
No. You should have your card in front of you whenever you enter the CSC. Never memorize it or write it down separately from the card. If you need to store card details for recurring charges, use your card issuer's secure payment portal or a password manager, not a text file or email.