CSC is the three or four-digit security code printed on your card, not a charge or fee

CSC stands for Card Security Code. It is the number on the back of your card (or front, for American Express) that you enter when you buy something online or over the phone. It is not a transaction, a fee, or something that appears on your statement as a line item. If you are seeing "CSC" written on your statement, it usually means the merchant or your bank is labeling a transaction in a way that references the security code that was used to process it.

The CSC exists to prove you physically have the card in your hand. When you type it in, the merchant sends it to the card network (Visa, Mastercard, American Express, or Discover) to verify. The code itself never gets stored after the transaction clears, which is why you have to enter it every time you shop online.

Confusion about CSC on statements usually comes from one of two places: either a merchant labeled a charge in a confusing way, or you are looking at a security alert rather than an actual charge. Both are worth understanding so you know whether to investigate further.

Key Takeaways

  • CSC is the three or four-digit security code on your card; it is not a separate charge or fee that appears on your bill.
  • If CSC appears as a label on a statement line, it typically means the merchant or bank is describing how that transaction was verified, not what you were charged for.
  • Your card issuer never stores the CSC after a transaction completes, so each online or phone purchase requires you to enter it again.
  • A CSC-related alert usually means a merchant tried to process a charge using your card details; check the transaction amount and merchant name to confirm whether you authorized it.

Why CSC shows up on your statement at all

Most of the time, CSC does not appear on your statement. You enter it, the transaction processes, and your statement shows the merchant name and amount. But some banks and merchants use internal codes or labels that reference the security verification method, and CSC can show up in that label.

This is most common with banks that break down transactions by the type of verification used. For example, a bank might label a transaction "CSC Verified" or "CVV Check Passed" to show that the card was not physically present but the security code matched. This is informational — it tells you the transaction went through the online or phone verification path, not that you were charged for the code itself.

If you see CSC on a statement and you do not recognize the merchant name or amount, that is the real issue to investigate, not the CSC label. The CSC itself is just the bank's way of saying "we checked the code and it was valid."

CSC versus CVV: what the difference is

CVV (Card Verification Value) and CVC (Card Verification Code) are the same thing as CSC — different card networks and banks just use different names. Visa calls it CVV. Mastercard calls it CVC. American Express calls it CID (Card Identification Number). Discover calls it CID as well. CSC is a general term that covers all of them.

The number itself is always three digits, except for American Express, which uses four. The location is the same across all cards: on the back in the signature strip for Visa, Mastercard, and Discover; on the front for American Express. When you see any of these terms on a statement or during checkout, they all refer to the same security code.

When CSC appears as a security alert

Sometimes you will get a notification from your bank saying something like "CSC mismatch detected" or "CSC verification failed." This means a merchant tried to charge your card using your card number, but the security code they provided did not match the one on file. This is a fraud-prevention tool.

A CSC mismatch alert does not mean you were charged. It means the transaction was blocked or flagged. If you see this alert and you did not just make a purchase, it could mean someone tried to use your card number without having the physical card. If you did just make a purchase and got this alert, it usually means you typed the code wrong — try again, or contact the merchant to confirm they have the right number.

If you get repeated CSC alerts and you have not been shopping, contact your card issuer. This can be a sign that your card number has been compromised, even though the CSC requirement prevented the fraudulent charge from going through.

How to protect your CSC

Never write your CSC down or store it anywhere. The whole point of the code is that it proves you have the physical card. If someone has your card number but not the code, they cannot complete an online or phone transaction. Once you type it in and the transaction processes, your bank does not keep it on file.

Do not give your CSC to anyone who calls you claiming to be from your bank. Your bank already has your card on file and will never ask for the security code over the phone. If someone calls asking for it, hang up and call your bank directly using the number on the back of your card.

Be cautious about entering your CSC on unfamiliar websites. Look for a padlock icon in the browser address bar and make sure the web address starts with "https://" (the "s" means secure). Legitimate merchants encrypt this information during transmission.

What to do if you see an unfamiliar CSC charge

If a transaction appears on your statement labeled with CSC and you do not recognize the merchant or amount, the CSC label is not the problem — the unauthorized charge is. Report it to your card issuer the same way you would report any fraudulent transaction.

Have your statement in front of you when you call. Tell the issuer the merchant name, the amount, and the date. They will investigate and can reverse the charge if it was not authorized. Most card issuers cover fraudulent charges, so you are not liable for the amount, but you do need to report it within the timeframe stated in your cardholder agreement (usually 60 days from when the statement was issued).

While the issuer investigates, they may issue you a replacement card with a new number. This is normal and protects you from further unauthorized charges using that card number.

Frequently Asked Questions

Is CSC the same as the card number?

No. Your card number is the 16 digits on the front. The CSC is the 3 or 4 digits on the back (or front for American Express). Someone who has your card number but not the CSC cannot complete an online or phone purchase. The CSC is the extra verification that proves you have the physical card.

Can a merchant store my CSC after I make a purchase?

No. Payment networks prohibit merchants from storing the CSC. After the transaction completes, the code is deleted. This is why you have to enter it every time you shop online, even with the same merchant. If a merchant asks you to save your CSC for future purchases, that is a red flag.

What does "CSC mismatch" mean?

It means the security code entered did not match the one on your card. This usually happens when you type it wrong, or when someone tried to use your card number without having the physical card. The transaction is blocked, so you were not charged. If you made the purchase, try entering the code again.

Do I need to enter my CSC in person at a store?

No. The CSC is only for online and phone purchases. When you swipe or insert your card at a physical store, the terminal reads the card directly and does not ask for the security code. This is one reason why in-person purchases are considered more secure.

What should I do if my card is lost or stolen?

Contact your card issuer immediately using the number on your statement or their website. They will cancel the card and issue a replacement. The CSC on the old card becomes useless once it is canceled, so even if someone has that card number, they cannot use it online without the new code on your replacement card.