The CSC is a three- or four-digit security code printed on your card that proves you physically hold it

The CSC — also called a CVV, CVV2, or CVC depending on which card company issued it — is a number you'll find printed on the back of your credit card, usually near your signature. It's not encoded in the card's magnetic stripe or chip. It exists only to verify that you have the physical card in your hand when you're making a purchase online or over the phone.

When you enter this code during an online checkout or give it to a customer service representative, the merchant sends it to your card company to confirm the number matches what's on file. If it doesn't match, the transaction gets declined. This simple check stops someone who has stolen your card number but doesn't have the actual card from using it.

The CSC is different from your PIN, which you use at ATMs and in-person at checkout terminals. Your PIN is something only you should know. Your CSC is printed right on the card, so it's meant to be shared during remote transactions — it's not a secret you're protecting.

Key Takeaways

  • The CSC is a three- or four-digit number printed on the back of your card that merchants request during online and phone purchases to confirm you have the physical card.
  • Different card companies use different names — Visa and Mastercard call it CVV2, American Express calls it CVC and prints it on the front, and Discover calls it CID.
  • You should never store your CSC in your phone, email, or anywhere online, because it's the only piece of card information that isn't stored in the card's chip or magnetic stripe.
  • Legitimate merchants will ask for your CSC during checkout, but they should never ask you to provide it in an email, text, or phone call unless you initiated the contact.

Where to find your CSC and what it looks like

On Visa and Mastercard, the CSC is a three-digit number printed on the back of your card, usually to the right of the signature panel. On American Express cards, it's a four-digit code printed on the front, above your card number on the right side. Discover cards also have a three-digit code on the back.

The code is printed in raised or flat text, not embedded in the card itself. You can see it and read it, but a merchant who only has your card number and expiration date cannot access it without you telling them. That's the whole point — it proves you're the one holding the card.

Why merchants ask for it during online purchases

When you shop online, the merchant never physically sees your card. They have your card number and expiration date, which is enough to process a payment, but they have no way to know if you're the real cardholder or someone who found your card number on a receipt or through a data breach.

Asking for the CSC adds a verification step. If a thief has your card number but not the physical card, they won't have the CSC. The merchant sends the code to your card company, which checks it against the code on file. If it matches, the transaction moves forward. If it doesn't, the purchase is blocked.

This is why you should never enter your CSC on a website that doesn't have a secure checkout page — look for the padlock icon in your browser's address bar and a URL that starts with "https://" rather than "http://". Entering your CSC on an unsecured site means it could be intercepted.

What happens if someone has your CSC

If a thief has your card number, expiration date, and CSC, they have everything needed to make an online purchase or take a payment over the phone. However, the CSC is only printed on the card itself, so they would need to have physically stolen your card or taken a photo of it to get this number.

If you suspect your CSC has been compromised — for example, you gave it to a merchant you don't trust or you think someone photographed your card — contact your card company immediately. They can issue you a new card with a new CSC. The old CSC will no longer work, even if someone has it written down.

This is different from your card number being exposed in a data breach. Merchants are not supposed to store your CSC after a transaction, so if a company's database is hacked, the CSC usually isn't included in what's stolen. Your card number might be compromised, but your CSC should still be safe.

CSC versus other card security features

Your card has several layers of security, and the CSC is just one of them. Your card's chip — the small metallic square on the front — creates a unique code for each in-person transaction, making it nearly impossible to counterfeit. Your PIN protects you at ATMs and checkout terminals. Your card company monitors your account for unusual activity and can reverse fraudulent charges.

The CSC works alongside these other protections. It's specifically designed for remote transactions where the merchant can't see the card or verify your identity in person. Online shopping, phone orders, and mail orders all rely on the CSC because there's no other way for the merchant to confirm you have the card.

Some newer payment methods, like digital wallets (Apple Pay, Google Pay) and buy-now-pay-later services, don't require you to enter a CSC at all. These services use different security methods, like tokenization, which replaces your actual card number with a unique code for each transaction.

How to protect your CSC

Never photograph your card or write down your CSC and store it anywhere — not in your phone, not in an email, not in a notes app. The whole reason the CSC exists is that it's not stored anywhere except on the physical card and in your card company's secure system. If you write it down or save it digitally, you're defeating that protection.

Only enter your CSC on websites where you initiated the transaction. If a merchant calls you, texts you, or emails you asking for your CSC, hang up or delete the message. Legitimate companies will never ask you to provide your CSC through email, text, or an unsolicited phone call. If you need to make a payment over the phone, you call the merchant — they don't call you asking for card details.

When you're shopping online, look for signs that the checkout is secure: the padlock icon in your browser, a URL starting with "https://", and a checkout page that looks professional and matches the rest of the website. If something feels off — the site looks poorly designed, the URL looks wrong, or you're being asked for unusual information — don't enter your CSC.

What different card companies call the CSC

The security code has different names depending on which card company issued it. Visa calls it CVV2 (Card Verification Value 2). Mastercard calls it CVV2 as well. American Express calls it CVC (Card Validation Code). Discover calls it CID (Card Identification). They all do the same thing — verify you have the physical card — but merchants and card companies use these different terms.

When you're checking out online, the form might ask for "CVV," "CSC," "security code," or "card verification code." These all mean the same thing: the three- or four-digit number on your card. Don't be confused by the different terminology. Just look at your card and enter the number the checkout form is asking for.

Frequently Asked Questions

Is it safe to give my CSC to an online merchant?

Yes, if the website is legitimate and the checkout page is secure. Look for the padlock icon and an "https://" URL. Legitimate merchants need your CSC to process online payments. However, never enter it on a website that looks suspicious or doesn't have a secure connection, and never provide it in response to an unsolicited email or phone call.

What if I lost my card but still have the CSC written down somewhere?

Contact your card company immediately to report the card lost. They'll cancel it and issue a new one with a new CSC. Even if someone has your CSC written down, it won't work once your card is deactivated. Destroy any written record of your CSC once you get your replacement card.

Can a merchant store my CSC after I make a purchase?

No. Payment card industry rules prohibit merchants from storing your CSC after a transaction is complete. If a merchant asks you to save your CSC for future purchases, that's a red flag — use a different merchant. Legitimate companies use tokenization or other methods to store your card information securely without keeping the CSC.

Do I need to enter my CSC every time I shop at the same online store?

Not if you've saved your card with that merchant. Most online stores let you store your card information for faster checkout on future purchases. You'll only need to enter your CSC the first time you use that card with that merchant. After that, the merchant can process payments using the stored information.

What's the difference between my CSC and my PIN?

Your PIN is a number only you know, used at ATMs and in-person checkout terminals. Your CSC is printed on your card and used for online and phone purchases. Your PIN protects you in situations where you're physically present and can enter it privately. Your CSC protects you in remote transactions where the merchant can't see you or verify your identity.