The CSC is a three- or four-digit security code on the back of your card

The Card Security Code (CSC) — also called the CVV, CVV2, or CVC depending on which card network issued it — is a number printed on your card that proves you physically have it when you shop online or over the phone. It is not stored in the card's magnetic stripe or chip, which is why a thief who steals your card number alone cannot use it to make purchases without the code.

On Visa, Mastercard, and Discover cards, the CSC is a three-digit number printed on the back, usually to the right of the signature panel. On American Express, it is a four-digit code printed on the front, above the card number on the right side. The exact position can vary slightly between card designs, but these are the standard locations.

You will need to enter this code whenever you buy something online, over the phone, or by mail — anywhere the merchant cannot physically swipe or insert your card into a reader. Merchants are required to ask for it; if someone does not ask, that is a sign the transaction may not be secure.

Key Takeaways

  • The CSC is a three- or four-digit code printed on your card that merchants use to verify you have the physical card during remote purchases.
  • On Visa, Mastercard, and Discover, look on the back of the card to the right of the signature panel; on American Express, it is a four-digit code on the front above the card number.
  • Never share your CSC with anyone except the merchant you are actively paying, and never enter it on a website unless you initiated the transaction yourself.
  • The CSC is different from your PIN — your PIN is for ATM withdrawals and in-person debit transactions, while the CSC is for remote credit card purchases.

Why merchants ask for the CSC instead of just using your card number

A card number alone can be stolen from a receipt, a data breach, or even a photo. The CSC adds a second layer of proof because it is not printed anywhere else and is not stored in the card's chip or stripe. If someone has your card number but not the physical card, they cannot produce the correct CSC.

This does not make your card theft-proof — a thief who steals the card itself has both the number and the code. But it stops many online fraud attempts, because most stolen card numbers come from breaches or skimming, not from physical theft. The CSC requirement has reduced fraud on remote transactions significantly since card networks began requiring it in the early 2000s.

Merchants are not allowed to store the CSC after a transaction goes through. If a company keeps a record of your CSC, that is a violation of payment card industry rules and a sign their security practices are weak. This is one reason you should never enter your CSC on a website you do not trust or that does not look secure.

How to protect your CSC from theft

Treat your CSC the same way you treat your PIN: never write it down, never text it, never email it, and never say it out loud where others can hear. The only time you should enter it is when you are making a purchase yourself on a website you trust or over the phone to a merchant you called.

If someone calls you claiming to be from your bank or card company and asks for your CSC, hang up. Your bank will never ask for it. If someone emails you asking for it, that is phishing — delete the email and do not click any links in it.

When you shop online, make sure the website address starts with "https://" (not just "http://") and look for a small padlock icon in the address bar. These signs mean the connection is encrypted. Never enter your CSC on a public Wi-Fi network unless you are using a VPN.

The difference between CSC and other card security features

Your PIN (Personal Identification Number) is different from your CSC. A PIN is a four-digit code you create and use at ATMs or when you pay with your debit card in person. It is not printed on your card and only you should know it. The CSC is printed on your card and is meant to be shared with merchants during remote purchases.

Your card number is the 16-digit (or 15-digit for American Express) number on the front of your card. This is what merchants use to identify which account to charge. The CSC is additional proof that you have the card in your hand.

Your expiration date is printed on the front and tells you when the card stops working. Merchants ask for this during remote purchases too, but it is not secret — it is visible to anyone who sees your card. The CSC is the only number that is not visible unless someone is looking directly at your card.

What to do if your CSC has been compromised

If you believe someone has your card number and CSC — for example, because you entered them on a website that turned out to be fraudulent — contact your card issuer right away. Call the number on the back of your card or log into your online account to find the fraud department's phone number.

Your card issuer can cancel your current card and issue a new one with a different number and CSC. This usually takes five to ten business days. In the meantime, monitor your account for unauthorized charges. Most card issuers offer fraud protection that limits your liability to $50 or nothing, depending on your card and how quickly you report the fraud.

You do not need to file a police report unless you want a record for your own documentation, but reporting fraud to your card issuer is what actually stops the charges and protects your account.

CSC requirements vary slightly by card network

Visa calls it CVV2, Mastercard calls it CVC, Discover calls it CVV2, and American Express calls it CID. They all serve the same purpose, but the names are different because each network owns its own security standard. When a merchant asks for your "CVV" or "security code," they are asking for the same thing regardless of which card you are using.

The location and format are the only real differences: American Express puts a four-digit code on the front because the card design is different, while the other networks put a three-digit code on the back. If you are unsure where yours is, look at the back of your card first — that is where it is on most cards.

Frequently Asked Questions

Can I use my credit card online without giving the CSC?

Most online merchants require it, but some payment systems like Apple Pay or Google Pay let you pay without entering the CSC directly — the app sends a secure token instead. If a website does not ask for the CSC, that does not mean it is unsafe, but it does mean the merchant is using a different security method.

Is it safe to save my CSC on a website for faster checkout?

No. Websites are not allowed to store your CSC, and if one offers to save it, that is a red flag. You can safely save your card number and expiration date on trusted sites like Amazon, but never allow the CSC to be stored. You should enter it fresh each time.

What if I forgot my CSC and need to make a purchase?

Look at the back of your card — it is printed there. If your card is damaged and you cannot read it, call your card issuer and they can tell you the code. If you do not have your physical card, you cannot complete a remote purchase that requires the CSC, which is by design.

Does the CSC change if I get a replacement card?

Yes. When your card issuer sends you a new card — whether because yours expired, was damaged, or was compromised — the new card will have a different CSC. This is one reason merchants cannot store it; the code would become useless the moment you received a replacement card.