What the CSC on Your Credit Card Actually Does

The CSC is a three- or four-digit security code printed on your card

The Card Security Code (CSC) — also called a CVV, CVC, or security code depending on which card company issues it — is a short number printed on your physical card that proves you actually have the card in your hand. It is not stored in the card's magnetic stripe or chip, which is why someone who steals your card number online cannot use it without also knowing this code.

Where you find it depends on your card type. On Visa, Mastercard, and Discover cards, it is a three-digit number printed on the back, usually to the right of the signature line. On American Express cards, it is a four-digit code printed on the front, above the card number on the right side.

The CSC exists for one reason: to reduce fraud when you are not physically present — like when you shop online, over the phone, or through a mail order. A merchant who asks for it is checking that you have the actual card, not just a stolen number.

Key Takeaways

• The CSC is a three- or four-digit code on your card that merchants request during online and phone purchases to verify you have the physical card.
• Visa, Mastercard, and Discover print the CSC on the back of the card; American Express prints it on the front.
• Never share your CSC with anyone except the merchant you are actively paying, and never enter it on a website unless you initiated the transaction.
• A CSC protects you from fraud because someone with only your card number cannot complete a purchase without it.
• The CSC is different from your PIN — your PIN is for ATM withdrawals and in-person debit card use, while the CSC is for remote purchases.

Why merchants ask for the CSC during checkout

When you buy something online or over the phone, you cannot hand your card to the cashier. The merchant has no way to verify that the card in front of them is real. Asking for the CSC is their way of confirming that you have the physical card and are not just using a number you found or stole.

The merchant sends the CSC to the card network (Visa, Mastercard, or Discover) as part of the payment request. The network checks it against the code on file and tells the merchant whether it matches. If it does not match, the transaction is declined. The merchant never stores the CSC — they are not supposed to keep it after the transaction is complete, which is why you should never see it saved in your account on a website.

This check happens in seconds, and you usually do not notice it. But it is one of the main reasons that stolen card numbers alone are not enough for a thief to make purchases online.

Where to enter your CSC and when to be cautious

You will enter your CSC during checkout on legitimate websites, in phone orders with real merchants, and sometimes when setting up recurring payments like a gym membership or subscription service. These are normal, safe situations.

Be cautious if someone asks for your CSC in ways that do not match these scenarios. Never give your CSC to someone who called you unsolicited, even if they say they are from your bank or credit card company. Your actual bank will never call and ask for your CSC. Never enter it on a website you did not navigate to yourself — if you clicked a link in an email or text message, type the merchant's web address directly into your browser instead. Never photograph or write down your CSC and store it anywhere.

If a website asks you to enter your CSC but you did not initiate the purchase, stop and contact the merchant directly using a phone number or website you know is real.

How the CSC differs from your PIN and other card numbers

Your PIN (Personal Identification Number) is a four-digit code you create and use at ATMs or when you pay with a debit card in person. It proves you authorized the transaction at that moment. Your PIN is never printed on your card and should never be shared with anyone.

Your card number — the 16 digits on the front of most credit cards — identifies which account the card belongs to. Merchants need this to process any payment, but the card number alone is not enough for online purchases because it does not prove you have the physical card.

Your expiration date tells the merchant when your card stops working. It is printed on the front and is part of the payment information, but like the card number, it does not prove you have the card in hand.

The CSC is the only piece of information that proves physical possession because it is printed on the card itself and not stored anywhere in the card's electronic data. This is why it is the most important number to keep private.

What happens if your CSC is compromised

If someone learns your CSC along with your card number and expiration date, they can make online purchases with your card. However, this is less likely than you might think because the CSC is harder to steal than the card number alone. Thieves who steal card numbers from data breaches usually do not get the CSC because merchants are not supposed to store it.

If you notice unauthorized charges on your card, contact your card issuer right away. Most credit cards offer fraud protection, which means you are not responsible for charges you did not make. Your card company will investigate and typically issue you a new card with a new CSC within a few business days.

You do not need to change your CSC yourself — it changes automatically when you receive a new card. If your card is lost or stolen, report it to your card issuer immediately, and they will cancel it and send you a replacement with a new CSC.

CSC requirements vary slightly by card network

Visa, Mastercard, and Discover all use three-digit codes on the back of the card, but they call them different names. Visa calls it the CVV2, Mastercard calls it the CVC2, and Discover calls it the DI (Discover Integrity). For your purposes, they work the same way — they are all three-digit security codes on the back.

American Express uses a four-digit code on the front, which it calls the CID (Card Identification). The extra digit makes it slightly more secure, but the purpose is identical: to verify you have the physical card.

When you are checking out online, the website will usually just ask for "security code" or "CVV" regardless of which card you are using. You enter whichever code is on your specific card, and the payment system figures out which network it belongs to.

Frequently Asked Questions

Is it safe to enter my CSC on a website?

Yes, if you navigated to the website yourself and you are actively making a purchase. Look for a padlock icon in the address bar and make sure the web address starts with "https" (not just "http"). Never enter your CSC on a website you reached by clicking a link in an email or text message — type the address directly into your browser instead.

Can I use my credit card without the CSC?

In person, yes — you can swipe or insert your card at a store without entering a CSC. Online and over the phone, most merchants require it. Some older or smaller websites might not ask for it, but reputable merchants almost always do because it reduces their fraud risk.

What should I do if I forgot my CSC?

Look at the back of your physical card — the code is printed there. If you do not have your card with you, you can call your card issuer and they can read it to you over the phone. Never ask a merchant or website to tell you what your CSC is.

Does my CSC change when I use my card?

No. Your CSC stays the same for the life of that card. It only changes when you receive a new card — either because yours expired, was lost or stolen, or your card issuer issued you a new one for security reasons.

Can someone use my card if they only know the CSC?

No. They would also need your card number and expiration date. Knowing all three pieces of information together is what allows someone to make an online purchase, which is why you should never share any of these numbers with anyone except a merchant you are actively paying.