CSC is the three- or four-digit security code printed on your card
CSC stands for Card Security Code. It is the number on the back of your credit card (or front, on American Express) that you enter when you make an online or phone purchase. The code is not stored in the card's magnetic stripe or chip, so a merchant who has only your card number cannot use it without also having the physical card or knowing this code.
The CSC goes by several names depending on your card issuer: Visa and Mastercard call it the CVV (Card Verification Value) or CVV2. American Express calls it the CID (Card Identification Number) or CVC (Card Verification Code). Discover uses CVV2 as well. All of these terms refer to the same thing: a three- or four-digit number that proves you have the card in your hand.
This code is different from your PIN (Personal Identification Number), which you use at ATMs and in-store chip readers. The CSC is only for remote transactions—online, by phone, or by mail.
Key Takeaways
- CSC is a three- or four-digit security code on your credit card that you must provide for online and phone purchases.
- The code is printed on the card itself but is not encoded in the magnetic stripe or chip, so merchants cannot process a transaction with your card number alone.
- Never share your CSC with anyone except the merchant you are paying, and never enter it on a website unless the connection is secure (look for https:// in the address bar).
- If your card is lost or stolen, the CSC on your replacement card will be different, which is why thieves cannot use a stolen card number online without the physical card.
Where the CSC appears on your card
On Visa, Mastercard, and Discover cards, the CSC is a three-digit number printed on the back of the card, usually to the right of the signature strip. It is the last three digits of a longer number on that panel.
On American Express cards, the CSC is a four-digit number printed on the front of the card, above the card number on the right side. This is one reason American Express cards are sometimes handled differently by online merchants—the code location is not the same as other cards.
The CSC is printed in raised or flat text, depending on the card, but it is never embossed like your card number. This makes it harder to read from a distance or to copy by rubbing a piece of paper over it.
Why merchants ask for the CSC
When you enter your card number online or over the phone, the merchant sends that number to their payment processor to check whether the card is valid and whether you have enough credit available. The CSC is a second check: it proves that you have the physical card or have seen it recently.
A thief who steals your card number from a data breach or a skimming device at a gas pump will have your number, expiration date, and name—but not the CSC, because it is not stored anywhere except on the card itself. Without the CSC, they cannot complete an online purchase. This is why the code exists: it closes a gap that card number alone leaves open.
Merchants are required by card networks (Visa, Mastercard, American Express, Discover) to request the CSC for card-not-present transactions. If a merchant does not ask for it, that is a sign the merchant may not be following security standards, and you should reconsider whether to use that site.
What happens if you give your CSC to the wrong person
If you enter your CSC on a fraudulent website or give it to someone posing as a merchant, that person now has everything needed to make online purchases with your card. Unlike your card number, which you might see on a receipt or a statement, your CSC should never appear in any record you keep or any email you receive.
If you believe your CSC has been compromised, contact your card issuer immediately. They will cancel your current card and issue a replacement with a new CSC. You will not be liable for fraudulent charges made after you report the compromise, as long as you report it before the fraud occurs or within a reasonable time after you discover it.
Never share your CSC via email, text, or phone call, even if someone claims to be from your bank or the merchant. Your bank will never ask you for your CSC. If someone calls or emails asking for it, hang up or delete the message and call your card issuer directly using the number on the back of your card.
CSC and your account statement
Your CSC will not appear on your monthly statement or in your online account portal. This is intentional—the fewer places your CSC is recorded, the fewer places it can be stolen from. When you make a purchase online, the merchant's system records that you entered a valid CSC, but the actual digits are not stored in most cases.
If you see a transaction on your statement that you do not recognize, the presence or absence of the CSC in that transaction does not tell you whether it was fraudulent. What matters is whether you authorized the charge. If you did not, report it to your card issuer as a dispute, and they will investigate.
CSC versus other card security features
The CSC is one layer of security, but not the only one. Modern credit cards also have a chip (EMV) that generates a unique code for each in-person transaction, making it harder to clone a card. Online purchases may also be protected by 3D Secure, a system that sends you a code via text or app to confirm you are making the purchase.
Some card issuers offer virtual card numbers, which are temporary numbers linked to your real account. You can use a virtual number for online shopping, and if that number is stolen, it cannot be used again because it expires after one transaction or after a set date. This is more secure than using your real card number and CSC every time.
Your card issuer may also monitor your account for unusual activity—large purchases, purchases in a different country, or purchases at merchants you have never used before. If the system flags something as suspicious, the issuer may decline the transaction or call you to confirm it is legitimate.
Frequently Asked Questions
Can I use my credit card online without entering the CSC?
Most major online merchants require the CSC for every card-not-present transaction. Some merchants may skip this step if you have an account with them and have made purchases before, but this is less common. If a merchant does not ask for the CSC, you can still provide it if the form allows—it adds a layer of protection.
What should I do if I forgot my CSC?
Look at the back of your physical card. If you do not have the card with you, you can call your card issuer and they will read the CSC to you over the phone. Never ask a merchant or a website to tell you what your CSC is—they should never know it.
Is the CSC the same as my PIN?
No. Your PIN is a number you create and use at ATMs and in-store chip readers. Your CSC is printed on the card by the issuer and is used only for online and phone purchases. They serve different purposes and are not interchangeable.
Do I need to memorize my CSC?
You do not need to memorize it, but you should not write it down or store it in an email or note on your phone. Keep your physical card in a safe place, and look at it when you need the CSC for an online purchase.
What if a website asks me to save my CSC for future purchases?
Reputable merchants do not ask you to save your CSC. If a website offers to store it, that is a red flag. Legitimate sites may ask to save your card number for convenience, but they should never store the CSC. Consider using a different merchant if they request this.