What a CSC Code Is and Why Your Credit Card Has One

A CSC code is a three- or four-digit security number printed on your credit card that proves you physically have the card when you make an online or phone purchase

The CSC code sits separately from your card number. On most cards, it appears on the back in small print near your signature. American Express prints it on the front. The code exists because online and phone merchants cannot swipe your card or see your face — the CSC is a quick way for them to confirm you actually hold the physical card and aren't just using a stolen number they found online.

CSC stands for Card Security Code. You'll also hear it called a CVV (Card Verification Value), CVC (Card Verification Code), or CID (Card Identification). Visa, Mastercard, and Discover all use slightly different names for the same thing. The function is identical across all of them.

Key Takeaways

• A CSC code is a three- or four-digit number printed on your physical card that merchants use to verify you own the card during online and phone transactions.
• The code appears on the back of Visa, Mastercard, and Discover cards, and on the front of American Express cards.
• You should never share your CSC with anyone except the merchant you're actively paying, and legitimate companies will never ask for it by email or phone.
• The CSC protects you from fraud because someone with only your card number cannot complete an online purchase without it.

Where to find your CSC code on different card types

On a Visa, Mastercard, or Discover card, flip the card over and look at the back. On the right side of the signature strip, you'll see a three-digit number printed in a slightly raised or embossed style. That's your CSC. It's separate from any other numbers on the card.

American Express works differently. The CSC on an Amex card is a four-digit code printed on the front of the card, above the card number on the right side. Because American Express is a closed network — meaning Amex issues the card and processes the payment — they use a four-digit code instead of three.

If you can't find the code on a physical card, you can usually see it in your online account. Log into your card issuer's website or app, go to your card details, and the CSC will be displayed there. Never take a photo of your CSC or write it down and store it somewhere — the whole point is that it's only on the physical card.

Why merchants ask for your CSC during checkout

When you buy something online or over the phone, the merchant needs proof that you have the card in your hands right now. Your card number alone isn't enough — that number can be stolen from a data breach, found in the trash, or skimmed from a gas pump. But your CSC is only printed on the card itself, not stored in any merchant's system or database.

By asking for the CSC, the merchant is running what's called a CVV check. Your bank verifies that the CSC you entered matches the one on file for that card number. If they don't match, the transaction gets declined. This happens in seconds, and you won't see the CSC check happening — it's automatic.

This is why CSC codes reduce fraud. A criminal who steals your card number from an online retailer's database still can't use it to buy things online or by phone without the CSC. They would need the physical card.

What you should never do with your CSC

Never share your CSC with anyone except during an active purchase with a merchant you trust. Never type it into an email, text message, or chat. Never give it to someone who calls you claiming to be from your bank — your bank already has this information and will never ask for it.

If a website or caller asks for your CSC before you've initiated a purchase, that's a red flag for fraud. Legitimate merchants only ask for the CSC at checkout, and only once. If you see a pop-up asking for it in the middle of browsing, close the window and leave the site.

The same rule applies to in-person purchases. When you hand your card to a cashier or server, they should never ask for your CSC. If they do, politely decline and ask to swipe or insert the card yourself. Legitimate retailers don't need the CSC for in-person transactions because they can verify the card physically.

How the CSC protects you from fraud

The CSC is one layer of fraud protection, not the only one. Your bank also monitors your account for unusual activity, and most cards come with fraud liability protection that limits what you owe if someone uses your card without permission.

But the CSC does its specific job well: it stops someone who has only your card number from making online purchases. This matters because card numbers leak from retailers, payment processors, and databases all the time. A stolen number alone is nearly useless without the CSC.

That said, the CSC isn't perfect. If someone steals your physical card, they have both the number and the code. If your card information is breached along with your CSC (which can happen if a retailer stores it illegally), the code won't help. This is why you should also monitor your account regularly and report any charges you don't recognize.

CSC codes and recurring payments

When you set up a subscription or recurring payment — like a streaming service, gym membership, or monthly insurance — you enter your CSC once during setup. The merchant stores your card number but not the CSC. For future charges, they use the stored card number without asking for the CSC again.

This is safe because the merchant has already verified you own the card by checking the CSC the first time. Recurring transactions don't need the CSC on every charge. If a merchant asks you to re-enter your CSC for a recurring payment, that's unusual and worth questioning.

What happens if you forget or lose your CSC

If you forget your CSC, you can find it by logging into your card issuer's online account or app. You can also call the number on the back of your card and a representative can read it to you over the phone. Your bank will verify your identity first.

If your physical card is lost or stolen, contact your card issuer immediately. They will cancel the card and issue you a new one with a new CSC. Until the new card arrives, you can still make online purchases using the CSC from your account portal or by calling your bank.

Frequently Asked Questions

Is my CSC the same as my PIN?

No. Your PIN is a four-digit code you create and use at ATMs and in-store terminals. Your CSC is a fixed code printed on the card that you use for online and phone purchases. They're completely separate security tools.

Can a merchant store my CSC after I make a purchase?

No, they shouldn't. Payment Card Industry rules prohibit merchants from storing your CSC after a transaction is complete. If a merchant is storing CSC codes, they're breaking the rules and putting your card at risk. Report this to your card issuer.

Do I need to enter my CSC every time I shop online?

Yes, for new purchases. Most checkout pages ask for it as part of the standard payment information. For recurring charges you've already set up, the merchant uses your stored card number without asking for the CSC again.

What if the CSC on my card is worn off or hard to read?

Contact your card issuer and request a replacement card. A worn or illegible CSC can cause legitimate purchases to be declined. Your bank will send you a new card with a fresh, readable code at no charge.

Can someone use my card number if they don't have my CSC?

They can't complete an online or phone purchase without it. However, they could still use your card number in person if they had a physical card, or they might attempt fraud through other methods. This is why monitoring your account and reporting suspicious activity matters.