CSC is the three or four-digit security code printed on your card, separate from your card number

The CSC (Card Security Code) is a short number on the back or front of your credit card that exists for one reason: to prove you physically have the card when you're making an online or phone purchase. It's not the same as your card number. Your card number is the long string of digits on the front; the CSC is a smaller code printed separately, usually in a different location.

Visa and Mastercard call it the CVV (Card Verification Value). American Express calls it the CID (Card Identification). Discover calls it the CVC (Card Verification Code). They all do the same thing, but the name depends on which card issuer you use. When a website or phone order asks for your "security code" or "CVV," they're asking for this number.

The CSC is not encoded in your card's magnetic stripe or chip. It's printed on the surface only. That's the whole point — if someone steals your card number online, they won't have this code unless they physically hold your card.

Key Takeaways

  • The CSC is a three or four-digit code printed on your card, separate from your card number, and is required for most online and phone purchases.
  • Visa and Mastercard call it CVV, American Express calls it CID, and Discover calls it CVC, but they all serve the same security purpose.
  • On Visa, Mastercard, and Discover cards, the CSC appears on the back in the signature area; on American Express, it's on the front above the card number.
  • Never share your CSC with anyone except the merchant you're paying, and legitimate companies will never ask for it via email or phone.
  • The CSC protects you against fraud when you can't swipe or insert your card in person, but it does not protect you if someone physically steals your card.

Where to find your CSC on different card types

The location depends on your card issuer. On a Visa, Mastercard, or Discover card, flip the card over and look at the back. In the white signature area (or just above it), you'll see a three-digit number printed to the right of the signature line. That's your CSC.

American Express is different. On an American Express card, the CSC is a four-digit code printed on the front of the card, above the card number on the right side. It's not on the back. If you have an older American Express card, the code might be in a slightly different spot, but it will still be on the front.

Some cards have the CSC printed in a raised or embossed style; others have it flat. The format doesn't matter — what matters is that you can read the number clearly when you need it.

Why merchants ask for your CSC during online and phone purchases

When you swipe or insert your card at a store, the card reader can verify that your card is real and that you have it in your hand. Online and over the phone, the merchant can't do that. They can't see the card or run it through a reader. The CSC is their way of confirming that you're the person making the purchase, because you have to physically look at your card to read it.

The merchant sends your CSC to your card issuer (Visa, Mastercard, American Express, or Discover) to verify. The issuer checks that the code matches the card number you provided. If it doesn't match, the transaction is declined. This step takes a fraction of a second and happens behind the scenes.

The CSC also protects you. If someone steals your card number from a data breach or a skimmed ATM, they can't use it online without the CSC. They would need to physically have your card in their hands to read the code.

What the CSC does and does not protect you against

The CSC protects you against card-not-present fraud — situations where someone uses your card number without physically having the card. This includes online shopping, phone orders, and mail orders. If a thief has only your card number (from a breach or a skimmed terminal), they can't complete most online purchases without your CSC.

The CSC does not protect you if someone physically steals your card. If a thief has your actual card in their hands, they have the CSC too. They can use it to make online purchases or call a merchant and place an order. In that case, your protection comes from your card issuer's fraud monitoring and your right to dispute unauthorized charges — not from the CSC itself.

The CSC also does not protect you against phishing or social engineering. If someone tricks you into giving them your card number and CSC over the phone or email, the CSC won't stop them from using it. Legitimate companies never ask for your CSC via email, text, or unsolicited phone calls.

How to keep your CSC safe

Treat your CSC the same way you treat your card number: don't share it with anyone except the merchant you're paying right now. Never write it down or store it anywhere. Never give it to someone who calls you or emails you claiming to be from your bank or card issuer. Your bank already has this information and will never ask you for it.

When you're shopping online, only enter your CSC on a secure website. Look for the padlock icon in your browser's address bar and make sure the URL starts with "https://" (the "s" stands for secure). Avoid entering your CSC on public Wi-Fi networks, where someone could intercept your data.

If you're shopping on a website you don't recognize or trust, consider using a different payment method. Some credit cards offer virtual card numbers or one-time-use card numbers for online shopping, which add an extra layer of protection. Check with your card issuer to see if this option is available to you.

CSC versus other card security features

Your card has several security features working together. Your card number identifies the account. Your expiration date confirms the card is current. Your name on the card is a basic check. Your CSC confirms you have the card in your possession. Your card's chip (if it has one) encrypts your information when you insert it at a terminal. Your card issuer's fraud monitoring watches for suspicious activity.

None of these features alone is foolproof. Together, they make it harder for thieves to use your card without your knowledge. If you notice a charge you didn't make, contact your card issuer right away. Most card issuers have zero-liability policies, meaning you won't be responsible for fraudulent charges if you report them promptly.

Frequently Asked Questions

Can someone use my card online if they have my card number but not my CSC?

Most legitimate online merchants require the CSC, so a thief with only your card number would be blocked at checkout. However, some smaller merchants or international sites may not ask for it, so it's still possible. This is why monitoring your card statements and reporting unauthorized charges quickly is important.

Is it safe to save my CSC on a website for faster checkout?

No. Never save your CSC on any website, even if the site offers to store it for convenience. Legitimate payment processors do not store CSC codes. If a website asks you to save it, that's a red flag. You should enter your CSC fresh each time you make a purchase.

What should I do if I accidentally shared my CSC with someone?

Contact your card issuer immediately. They can monitor your account for fraudulent activity and, if needed, issue you a new card with a new CSC. The sooner you report it, the better protected you are.

Do I need to memorize my CSC?

No. Keep your card with you when you shop online or by phone, and look at the code when you need it. Memorizing it increases the risk that you'll accidentally share it or that someone will see you write it down.

Why does American Express put the CSC on the front instead of the back?

American Express designed their cards differently for historical reasons related to their card format and security approach. The location doesn't make it more or less secure — what matters is that the code is printed separately from the card number and not encoded in the chip or stripe.