What That Three-Digit Code on Your Credit Card Actually Does

The CSC code is the three or four-digit security number on the back of your card that proves you physically have it when you shop online

The Card Security Code (CSC) — also called CVV, CVC, or CID depending on which card company issued it — is a short number printed on your card that serves one purpose: to verify you're the person holding the physical card. When you enter it during an online purchase, you're proving to the merchant that you have the card in your hand right now, not just the card number.

This code lives in a specific spot on your card. On Visa, Mastercard, and Discover cards, it's a three-digit number on the back, usually printed to the right of the signature strip. American Express puts a four-digit code on the front, above the card number on the right side. The code itself is not stored in the card's magnetic stripe or chip — it's only printed on the surface, which is why it matters that you physically possess the card to read it.

Key Takeaways

• The CSC is printed on your card but not stored in the chip or magnetic stripe, so only someone holding the physical card can read it.
• Online merchants ask for this code to confirm you have the card in hand, reducing fraud from stolen card numbers alone.
• You should never share your CSC with anyone, store it in your phone, or write it down — it's meant to be read fresh each time you need it.
• The code does not protect you in person at a store or gas pump, and many in-person transactions do not ask for it at all.
• If your card is lost or stolen, the CSC printed on it becomes useless because the card itself is no longer in your possession.

Why merchants ask for it during online checkout

When you shop online, the merchant never physically sees your card. They have your card number, expiration date, and billing address — information that could theoretically be used by someone who stole those details from a data breach or phishing email. The CSC adds a second layer of verification: it proves you're not just someone who knows your card number, but someone who actually has the card.

This is why the code is printed on the card but not stored anywhere in the card's data. If a hacker steals your card number from a retailer's database, they won't have the CSC. If they call a merchant pretending to be you, they can't read the code off the back of a card they don't have. The code is meant to be looked up fresh each time — not memorized, not saved, not transmitted through email.

Where you'll see it requested and where you won't

Online shopping is where you'll encounter CSC requests most often. Websites for airlines, hotels, subscription services, and retail stores almost always ask for it. Phone orders sometimes do too, though less consistently. In-person transactions at stores and gas pumps rarely ask for it — the card reader already has physical proof you have the card because you're handing it over.

Some recurring payment setups — like a gym membership or streaming service — may ask for your CSC once when you set up the account, then store it for future charges. This is generally safe because the merchant is PCI-compliant (meaning they follow strict security standards), but it's worth checking the privacy policy if you're uncertain. Legitimate merchants never ask you to email, text, or call them with your CSC.

What the CSC does and does not protect you from

The CSC protects you against fraud where someone has your card number but not your physical card. If your card number is leaked in a data breach, a fraudster can't use it to shop online without also having the CSC. This is valuable protection because card numbers are relatively easy to steal, but the CSC requires physical possession of the card itself.

The CSC does not protect you if your entire card is stolen. Once someone has the physical card, they have the code too. It also does not protect you against in-person fraud — a cashier who writes down your card number and CSC can use both. And it does not protect you if you voluntarily give your CSC to a scammer over the phone or email, which is why you should never do that. Legitimate companies will never ask you to share it that way.

How to keep your CSC safe

The simplest rule: never write it down, never photograph it, never type it into an email or text message, and never say it out loud to anyone except a merchant during a legitimate transaction. The code is meant to be read directly from your card in the moment you need it. If you're shopping online, you look at the back of your card, type the number into the website, and move on. That's the intended use.

If you lose your card or suspect it's been stolen, contact your card issuer right away. They'll cancel the card and issue you a new one with a new CSC. The old code becomes worthless because the card itself is no longer valid. You don't need to worry about someone using the old CSC — it only works with the card number that was printed alongside it, and that card is now closed.

The difference between CSC, CVV, CVC, and CID

These are all the same thing, just different names. Visa calls it CVV (Card Verification Value). Mastercard calls it CVC (Card Verification Code). Discover uses CID (Card Identification). American Express calls it CVV as well, though theirs is four digits instead of three. When a website asks for any of these terms, they're asking for the security code on your card. The name doesn't matter — the location and purpose are the same.

You might also hear the term CVC2 or CVV2, which refers specifically to the printed code (as opposed to an older, encoded version that used to exist in the card's magnetic stripe). For practical purposes, when you're shopping online and someone asks for your CVV or CVC, you're looking at the back of your card and reading the three-digit number to the right of the signature line.

What happens if you enter the wrong code

If you mistype the CSC, the transaction will be declined. The merchant's payment processor checks the code against the card number you provided, and if they don't match, the purchase won't go through. You can try again — there's no penalty for entering it wrong. If you keep getting declined and you're sure you're reading the code correctly, double-check that you're entering the right card number and expiration date too, because those have to match as well.

Some merchants allow multiple attempts before locking you out temporarily. Others may flag repeated failed attempts as a security concern and ask you to contact your card issuer. If you're consistently having trouble, call the customer service number on the back of your card and ask them to verify that the card is active and that there are no fraud blocks on it.

Frequently Asked Questions

Can someone use my card number without the CSC?

They can try, but most online merchants will decline the transaction if the CSC is missing or wrong. In-person transactions don't require it, so a stolen card number could potentially be used at a physical store. However, the CSC does add meaningful protection for online shopping, which is where most fraud happens.

Is it safe to save my CSC for recurring payments?

It depends on the merchant. PCI-compliant companies (those that meet strict security standards) can store it safely. Before you allow it, check the merchant's privacy policy and confirm they're a legitimate, established business. Never save your CSC with an unfamiliar or suspicious website.

What should I do if I accidentally shared my CSC with someone?

Contact your card issuer immediately and ask them to cancel the card and issue a new one. The old CSC becomes useless once the card is closed. Your card company can also monitor the account for fraudulent charges and reverse them if they occur.

Do I need to memorize my CSC?

No. The code is printed on your card specifically so you can look it up when you need it. Memorizing it defeats the purpose — the whole point is that only someone physically holding the card can read it. Keep your card secure and look up the code fresh each time you shop online.

Why is American Express's code four digits instead of three?

American Express uses a different card structure and security model than Visa, Mastercard, and Discover. The four-digit code provides the same verification function as the three-digit codes on other cards. Both are equally secure for their respective card networks.