CSC is the three- or four-digit security code printed on your card, separate from your account number
CSC stands for Card Security Code. It is the number you enter when you buy something online or over the phone — the place where a website asks for "CVV" or "security code" or "card verification value." Visa calls it CVV2. Mastercard calls it CVC2. American Express calls it CID. They are all the same thing: a code that proves you physically have the card in your hand.
On Visa, Mastercard, and Discover cards, the CSC is three digits printed on the back, to the right of the signature strip. On American Express, it is four digits printed on the front, above the account number. The code changes only when you get a new card — it does not change month to month like your expiration date does.
The CSC is not stored in the magnetic stripe or chip on your card. It lives only on the physical card itself and in the card issuer's records. That separation is intentional: a merchant who stores your card number cannot store your CSC, which means a stolen database of card numbers is useless for online purchases without the physical card.
Key Takeaways
- CSC is the three- or four-digit code on your card that merchants ask for during online and phone purchases to confirm you have the card.
- Visa, Mastercard, and Discover print the CSC on the back; American Express prints it on the front.
- Never give your CSC to anyone who calls you or emails you — legitimate companies never ask for it that way.
- A CSC does not protect you from fraud if someone steals your physical card, only from online fraud when the card is not present.
- Merchants are not allowed to store your CSC after the transaction, which is why you enter it fresh each time.
Why merchants ask for the CSC during online checkout
When you swipe or insert your card in a store, the merchant can read your account number and expiration date from the chip or stripe. They do not need the CSC because they can verify the card is real by running it through their terminal. Online and phone purchases are different: the merchant cannot read the chip, and they cannot see that you have the card in your hand.
The CSC is the merchant's way of confirming you have the physical card. If a thief has only your account number and expiration date — stolen from a data breach, for example — they cannot complete an online purchase without the CSC. That is why the code exists separately from the account number and why it is printed on the card itself rather than encoded in the chip.
Some merchants also use the CSC to flag suspicious transactions. If the code does not match the issuer's records, the transaction is declined. This catches some cases where someone is using a stolen card number but does not have the actual card.
Where to find your CSC and how to protect it
Locate your CSC before you need it. On Visa, Mastercard, and Discover, flip the card over and look at the back. The CSC is the last three digits printed to the right of the signature strip — it is not part of your account number. On American Express, turn the card face-up. The CSC is four digits printed above your account number on the front.
Treat your CSC like you treat your PIN: do not write it down, do not photograph it, and do not text it to anyone. Never give it to someone who calls you or emails you claiming to be from your bank or card issuer. Legitimate companies never ask for your CSC by phone or email. If someone asks, hang up or delete the message and call your card issuer directly using the number on the back of your card.
Do not enter your CSC on a website unless you are sure the site is legitimate and the connection is secure. Look for the padlock icon in your browser's address bar and make sure the URL starts with "https://" rather than "http://". If you are unsure whether a website is real, do not enter your card information at all.
CSC versus other card security features
The CSC is one layer of fraud protection, but it is not the only one. Your card also has an expiration date, which changes every few years. It may have a chip, which creates a unique code for each transaction and is harder to counterfeit than a magnetic stripe. It may have your name printed on it, which some merchants check against the name on your ID.
If someone steals your physical card and uses it in a store, the CSC does not protect you — they have the card itself. In that case, your protection comes from your card issuer's fraud monitoring and your right to dispute unauthorized charges. Most issuers cover fraudulent purchases, though you may have to report them within a certain window (often 60 days from when you see the charge on your statement).
If someone has only your account number and expiration date but not the card itself, the CSC is a barrier to online fraud. But it is not foolproof: some merchants do not ask for it, and some fraudsters have found ways around it. That is why your card issuer also monitors for unusual spending patterns and may decline a transaction or call you to confirm it is legitimate.
What happens if you enter the wrong CSC
If you mistype your CSC, the transaction will be declined. The merchant's system will tell you the code does not match and ask you to try again. You get another chance to enter it correctly. There is no penalty for entering it wrong — you simply cannot complete the purchase until you get it right.
If you enter the wrong code multiple times in a row, some merchants or card issuers may flag the activity as suspicious and temporarily block further attempts. This is a fraud prevention measure. If this happens, wait a few minutes and try again, or contact your card issuer to confirm the transaction is legitimate.
Do not confuse the CSC with your PIN. Your PIN is the four-digit code you enter at an ATM or when you use your debit card as a debit card (rather than as a credit card). Your PIN is never printed on the card and should never be shared with anyone. The CSC is printed on the card and is meant to be entered during online and phone purchases.
CSC and data breaches: why merchants cannot store it
Payment Card Industry Data Security Standard (PCI DSS) rules forbid merchants from storing your CSC after a transaction is complete. This is a legal requirement, not a suggestion. The rule exists because the CSC is supposed to prove you have the physical card — if a merchant stored it, that protection would disappear.
When you make a purchase, the merchant's payment processor sends your CSC to your card issuer to verify it matches their records. Once the issuer confirms it is correct, the processor deletes it. The merchant never sees it, and it is never stored in their database. If a hacker breaks into the merchant's system, they will not find your CSC because it was never there.
This is why you have to enter your CSC every time you make an online purchase, even from the same merchant. The merchant cannot save it for next time. Some websites offer to save your card for faster checkout, but what they are saving is your account number and expiration date — never the CSC.
Frequently Asked Questions
Is the CSC the same as my card number?
No. Your card number is the 16 digits (or 15 for American Express) printed on the front of the card. Your CSC is the separate three- or four-digit code on the back or front. They are different numbers for a reason: merchants can store your card number, but they cannot store your CSC.
What should I do if someone asks for my CSC over the phone?
Hang up. Legitimate companies — your bank, your card issuer, your insurance company — never ask for your CSC by phone or email. If you are unsure whether the call is real, hang up and call the company back using the number on your card or statement, not the number the caller gave you.
Can someone use my card online if they have my card number and expiration date but not my CSC?
Most online merchants require the CSC, so it is much harder. Some merchants do not ask for it, so it depends where the person tries to use the card. That is why the CSC exists — to add a second layer of protection for online purchases. If fraud does happen, your card issuer is responsible for most unauthorized charges.
Do I need to memorize my CSC?
No. You should know where to find it on your card when you need it, but you do not need to memorize it. In fact, it is safer not to memorize it or write it down. Just look at your card when a website or merchant asks for it.
Does my CSC change if I get a replacement card?
Yes. Every time your card issuer sends you a new card — whether because yours expired, was damaged, or was compromised — the new card has a different CSC. This is another reason merchants cannot store it: it would become invalid as soon as you got a new card.