What a CSC Credit Card Is and How It Works

A CSC credit card is a card issued by a bank or credit union that includes a Card Security Code — a three- or four-digit number printed on the back (or sometimes the front) used to verify you're the one making the purchase

Every credit card has a CSC, also called a CVV (Card Verification Value) or CVC (Card Verification Code). The terms mean the same thing. This number exists so that when you buy something online or over the phone — anywhere the card isn't physically present — the merchant can confirm the card is actually in your possession. Without it, anyone who knew your card number and expiration date could make a purchase.

The CSC is not the same as your PIN (the number you enter at an ATM or checkout terminal). Your PIN is for in-person transactions where you're using the card yourself. Your CSC is for remote purchases where the merchant can't see the card or watch you enter a code.

Key Takeaways

• Every credit card has a CSC — a three- or four-digit security code that proves you have the physical card when shopping online or by phone.
• The CSC appears on the back of most cards (Visa, Mastercard, Discover) as the last three digits, or on the front of American Express cards as a four-digit code.
• Merchants ask for your CSC during checkout to reduce fraud, but they are not supposed to store it after the transaction is complete.
• Never share your CSC with anyone except the merchant you are actively buying from, and never enter it on a website unless you initiated the purchase yourself.
• A CSC protects you by making it harder for someone with a stolen card number to complete a purchase without the physical card.

Where to find your CSC on your card

For Visa, Mastercard, and Discover cards, the CSC is the three-digit number on the back of the card, usually printed to the right of the signature strip. It is the last three digits of a longer number that runs across the back.

For American Express cards, the CSC is a four-digit number printed on the front of the card, just above the card number on the right side. American Express calls this the CID (Card Identification Number), but it serves the same purpose as the CSC on other cards.

If your card is damaged and you cannot read the CSC, contact your card issuer and they will provide it to you or send you a replacement card. Do not try to guess or estimate the number — entering an incorrect CSC will decline the transaction.

Why merchants ask for your CSC during checkout

When you shop online or by phone, the merchant cannot see your physical card or watch you enter information. The CSC is their way of confirming that you actually have the card in your hands. If someone stole your card number and expiration date from a data breach or a receipt, they would not have the CSC printed on the back of the card.

Asking for the CSC reduces fraud losses for the merchant, which is why most online retailers now require it. Some merchants may also ask for your billing zip code as an additional check — this is called Address Verification Service (AVS) — but the CSC is the most common second layer of security.

The merchant is supposed to use the CSC only to verify the transaction and then delete it immediately. By law, merchants cannot store your CSC after the purchase is complete. This means even if a merchant's database is hacked, the CSC should not be there to steal.

How to protect your CSC from fraud

Never give your CSC to anyone unless you are the one making the purchase. Do not enter it on a website unless you started the transaction yourself — if someone sends you a link or calls you asking for your CSC, it is a scam. Legitimate companies will never ask you to provide your CSC over the phone or in an email.

When you shop in person and hand your card to a cashier or server, they should not ask for your CSC. The CSC is only for remote transactions. If someone asks for it at a physical store, do not provide it.

Keep your card in a safe place and do not photograph it or write the CSC down anywhere. If your card is lost or stolen, contact your card issuer immediately. Most card companies will cancel the card and send you a new one with a different CSC within 7 to 10 business days.

CSC versus other card security features

Your CSC is one layer of fraud protection, but it is not the only one. Your card also has an expiration date, which limits how long a stolen card number can be used. Many cards now include a chip (EMV technology) that creates a unique code for each in-person transaction, making it much harder to clone the card.

Some cards also offer fraud monitoring, where the issuer watches for unusual activity and contacts you if something looks wrong. Your card issuer may also let you set spending limits or turn off certain types of transactions (like international purchases) through their mobile app.

The CSC protects you specifically against remote fraud — someone using your card number without the physical card. The chip protects you against in-person cloning. Together, they make it much harder for a thief to use a stolen card number.

What happens if someone uses your CSC fraudulently

If someone makes a purchase using your card number and CSC without your permission, contact your card issuer right away. Most card companies have a fraud department that handles these calls 24/7. You can usually find the number on the back of your card or on your monthly statement.

By federal law, your liability for fraudulent charges is limited to $50, and most card issuers waive that fee entirely if you report the fraud quickly. The card issuer will investigate the charge, and if they determine it was fraudulent, they will remove it from your bill and send you a new card.

Reporting fraud quickly is important because it stops the thief from making more charges and it protects you legally. Keep records of when you reported the fraud and the name of the person you spoke with — this creates a paper trail if there are any disputes later.

Frequently Asked Questions

Is my CSC the same as my card number?

No. Your card number is the 16-digit number on the front of the card (or 15 digits for American Express). Your CSC is a separate three- or four-digit code on the back or front. A thief needs both to make a purchase, which is why merchants ask for both.

Can I use my card online without providing a CSC?

Some merchants may not require a CSC for small purchases or if you have an account with them and have already provided it once. However, most online retailers now require it for every transaction. If a site does not ask for a CSC, it may be less secure.

What should I do if I accidentally shared my CSC with someone?

Contact your card issuer immediately and ask them to monitor your account for fraudulent activity. You may want to request a new card with a new CSC. If you shared it with a legitimate merchant during a normal purchase, there is usually no risk — just watch your statement for the next few weeks.

Do I need to memorize my CSC?

No. You should never memorize it or write it down. The CSC is meant to be used only when you have the physical card in front of you. If you memorize it and someone learns it, they could use it to make fraudulent purchases.

Why does American Express put the CSC on the front of the card?

American Express places the four-digit CID on the front because their card design is different from Visa and Mastercard. The location does not affect how it works — it still proves you have the physical card when making a remote purchase.