What CSC Means on Your Credit Card Statement

CSC is the three- or four-digit security code printed on your card, separate from your card number

CSC stands for Card Security Code. It's the small number on the back of your credit card (or sometimes the front, depending on the card type) that exists for one reason: to prove you physically have the card when you're making a purchase online or over the phone.

The CSC is not the same as your card number. Your card number is the long string of digits across the front. The CSC is shorter — three digits for Visa, Mastercard, and Discover cards, or four digits for American Express cards — and it's printed in a different location. Because the CSC isn't encoded in the magnetic stripe or chip on your card, a merchant who only has your card number can't complete a transaction without it.

When you see "CSC" on a receipt or in a payment form, the system is asking for this code to verify that you're the person making the purchase, not someone who stole your card number from a data breach or a receipt.

Key Takeaways

• CSC is a three- or four-digit code printed on your physical card that merchants ask for during online and phone purchases.
• Visa, Mastercard, and Discover use three digits; American Express uses four digits.
• The CSC is a security measure because it's not stored in your card's magnetic stripe or chip, so a thief with only your card number cannot use it.
• You should never share your CSC with anyone except the merchant you're paying directly, and legitimate companies will never ask for it via email or phone.

Where to find your CSC on different card types

For most cards — Visa, Mastercard, and Discover — flip your card over to the back. On the right side of the signature panel, you'll see a three-digit number printed after a longer number. That three-digit number is your CSC. It's usually printed in a slightly different color or font than the rest of the card to make it stand out.

American Express cards are different. The CSC on an Amex card is four digits, and it's printed on the front of the card, above your card number on the right side. Because Amex cards have a different layout, the code is in a different spot than on other cards.

Some older cards or specialty cards may have the code in a slightly different location, but the principle is the same: it's a short number printed separately from your main card number, and it's meant to be visible only to someone holding the physical card.

Why merchants ask for your CSC during online purchases

When you buy something online, the merchant can't swipe your card or insert it into a chip reader. They have no way to verify that you actually have the card in your hand. Asking for the CSC is their way of checking that you do.

The CSC is not stored in the data that gets transmitted when your card is swiped in a store or inserted into an ATM. It lives only on the physical card itself. This means that if a hacker steals a database of card numbers from a retailer, those stolen numbers are useless without the CSC. The thief would need the physical card to get the code, which they don't have.

For phone purchases, the same logic applies. A customer service representative can't see your card, so they ask for the CSC to confirm you're the cardholder. Legitimate companies will ask for it only during the payment step, never before and never separately.

CSC versus other card security features

Your card has several security layers, and the CSC is just one of them. Your card number itself is one layer. Your name and expiration date are printed on the front. The magnetic stripe on the back and the chip embedded in the card are two more layers. Each one serves a different purpose.

The expiration date tells the merchant when your card stops being valid. The chip (if your card has one) creates a unique encrypted code for each transaction, making it harder to use a stolen card number repeatedly. The magnetic stripe (on older cards or as a backup) stores encoded card data. The CSC is the only piece of information that proves you have the physical card without being stored in any of those other systems.

Some cards also use tokenization, a system where your actual card number is replaced with a random string of numbers for online purchases. This is an additional layer that works alongside the CSC, not instead of it.

When you should and shouldn't share your CSC

Share your CSC only with a merchant you're paying directly — meaning you initiated the transaction and you're entering the code yourself into their payment form, or you're reading it to a customer service representative you called. That's it.

Never share your CSC via email, text message, or phone call that you didn't initiate. Legitimate companies will never ask for it that way. If someone claiming to be from your bank or a retailer calls you asking for your CSC, hang up and call the company's official number from the back of your card or their website. Scammers often pose as customer service to steal this information.

Don't write your CSC on receipts, and don't photograph it. If you're storing your card information for recurring payments (like a subscription service), the merchant should store the card number and expiration date but not the CSC. If a form asks you to save your CSC for future purchases, that's a red flag — reputable merchants don't store it.

What happens if your CSC is compromised

If someone has your card number and expiration date but not your CSC, they can't complete most online purchases. They might be able to use your card at a physical store that doesn't have updated security systems, but most modern retailers require the chip or a signature, which they also don't have.

If someone has your CSC along with your card number and expiration date, they can make online and phone purchases. If you suspect this has happened — for example, if you see unauthorized charges on your statement — contact your card issuer immediately. Most credit card companies have fraud protection that limits your liability for unauthorized charges, but you need to report it quickly.

You don't need to worry about your CSC being visible when you hand your card to a cashier in person. The risk is only when the code is shared digitally or written down where it could be photographed or intercepted.

CSC and recurring payments or saved cards

When you save your card to a website for future purchases — like on Amazon or a subscription service — the merchant stores your card number and expiration date so you don't have to enter them again. They should not store your CSC. Each time you make a purchase, you may be asked to enter the CSC again, or the system may not require it if the merchant has other ways to verify you (like your login credentials).

If a website asks you to save your CSC for future use, don't do it. That's not how secure payment systems work. The CSC is meant to be entered fresh each time, proving that you have the physical card at that moment.

For subscription services that charge your card automatically, you typically enter the CSC once during setup, but the company shouldn't store it. They store only what they need to process the recurring charge without asking you every month.

Frequently Asked Questions

Is CSC the same as CVV?

CSC and CVV are two names for the same thing. CVV stands for Card Verification Value. Visa calls it CVV2, Mastercard calls it CVC2, and Discover calls it CID, but they all refer to that three-digit security code on the back of your card. American Express calls theirs CID (Card Identification) or sometimes just the four-digit code. The terms are used interchangeably.

What if I can't find the CSC on my card?

Check the back of your card first, on the right side of the signature panel. If your card is very old or worn, the number might be faded. If you genuinely can't read it, contact your card issuer and they can provide it or send you a replacement card. Never guess or make up a number — entering an incorrect CSC will cause the transaction to fail.

Can someone use my card if they only have the CSC?

No. The CSC alone is useless without your card number and expiration date. A thief needs all three pieces of information to make an online purchase. This is why the CSC is printed separately from your card number — it's designed so that stealing one piece of information isn't enough.

Do I need to enter my CSC at an ATM or in a store?

No. ATMs and in-store card readers don't ask for your CSC. They read your card number and expiration date from the chip or magnetic stripe. If a machine is asking for your CSC, it's not a legitimate payment terminal — stop the transaction and report it to the merchant or your bank.

Should I memorize my CSC?

You don't need to memorize it, but you should know where it is on your card so you can find it quickly when making online purchases. There's no harm in memorizing it if you make frequent online purchases, but it's not necessary. What matters is that you're the only person who can see it on your physical card.