Where to Find the CSC on Your Credit Card and What It Does

The CSC is a three- or four-digit security code printed on the back of your card

The Card Security Code (CSC) — also called a CVV, CVC, or security code — is a number printed directly on your physical card. It sits on the back, usually in the signature strip area. On American Express cards, it appears on the front instead. This code is not stored in the card's magnetic stripe or chip, which is why merchants ask for it when you shop online or over the phone.

The code exists to prove you actually have the card in your hand. When you type it into a website checkout or give it to a customer service representative, you are confirming that you possess the physical card — not just its number. Someone who has stolen your card number alone cannot complete a purchase without this code.

The length varies by card type. Visa, Mastercard, and Discover cards have a three-digit code. American Express cards have a four-digit code. Both work the same way; the difference is just how the card issuer prints it.

Key Takeaways

• The CSC is printed on the back of Visa, Mastercard, and Discover cards in the signature strip; American Express prints it on the front.
• You need the CSC to complete online purchases and phone orders, but never for in-person transactions where you swipe or insert the card.
• The code is not stored in your card's chip or magnetic stripe, so a thief with only your card number cannot use it without the CSC.
• Never share your CSC with anyone except the merchant you are paying, and never type it into a website unless you initiated the transaction yourself.

Where exactly to look on your card

On the back of most cards, flip the card over and look at the signature strip — the white or light-colored panel where you would sign your name. The three-digit code appears to the right of that strip, usually printed in small numbers. It is the last three digits of a longer number that runs across the back.

On American Express cards, the four-digit code sits on the front, above the card number on the right side. This placement is different from other cards, so if you are using an Amex and cannot find a code on the back, check the front.

If your card is very old or worn, the code may be faded or hard to read. If you cannot make it out, contact your card issuer — they can read it from their system and tell you what it is over the phone.

When you need to provide the CSC

You provide the CSC whenever you make a purchase without physically handing your card to the merchant. This includes online shopping, phone orders, and mail orders. The website or person taking your order will ask for it as part of the payment information.

You do not need to provide it when you swipe or insert your card at a store, gas pump, or ATM. The card reader communicates directly with your bank through the chip or magnetic stripe, and the CSC is not part of that exchange.

Some subscription services and recurring payments also ask for the CSC when you set up the account. This is normal and expected.

Why merchants ask for it and how it protects you

Merchants request the CSC because it is a basic fraud check. If someone has your card number but not the physical card, they cannot provide the correct code. This stops many online fraud attempts before they happen.

The code also protects you because it means a data breach at a retailer's website cannot give a thief everything needed to make purchases. If hackers steal card numbers from an online store, those numbers alone are not enough — they would also need the CSC, which legitimate merchants do not store in their systems.

This is why you should never type your CSC into a website you did not visit yourself, and never give it to someone who calls you claiming to be from your bank or card company. Your bank already has your card information and would never ask for the CSC over the phone.

What to do if your CSC is visible or compromised

If your card is damaged and the CSC is worn away or illegible, contact your card issuer and request a replacement card. They will send you a new one with a fresh code printed on it. This usually takes five to ten business days.

If you believe someone has seen your CSC — for example, if you typed it into a website that looked suspicious or gave it to someone over the phone who claimed to be from your bank — contact your card issuer right away. Tell them what happened and ask them to monitor your account for unauthorized charges. Many issuers will cancel your card and send a replacement as a precaution.

If you see charges on your statement that you did not make, report them to your card issuer immediately. Federal law limits your liability for unauthorized charges, and your issuer will investigate and reverse fraudulent transactions.

CSC versus other card numbers and codes

Your card has several numbers on it, and it is easy to confuse them. The card number is the long number across the front — usually 16 digits for Visa and Mastercard, 15 for American Express. The expiration date is the two-digit month and two-digit year printed on the front. The CSC is the three- or four-digit code on the back or front.

All three are needed for online purchases. The card number identifies your account, the expiration date confirms the card is current, and the CSC confirms you have the physical card. A merchant who has only one or two of these pieces cannot process a payment.

Do not confuse the CSC with the PIN (Personal Identification Number) you use at an ATM or when you enter your PIN at a store. The PIN is a separate code you create or receive from your bank, and it is never printed on your card.

Frequently Asked Questions

Can I use my card online without providing the CSC?

Most online retailers require it, but some do not — particularly if you have an account with them and have made purchases before. However, any legitimate merchant can ask for it, and you should expect to provide it on first-time purchases or when checking out as a guest.

Is it safe to type my CSC into a website?

Yes, if you initiated the transaction and the website is legitimate. Look for "https://" in the address bar and a padlock icon, which indicate the connection is encrypted. Never type your CSC into a website you reached by clicking a link in an email or text message — go directly to the merchant's site instead.

What if I give my CSC to someone and they use it fraudulently?

Contact your card issuer immediately and report the unauthorized charge. Federal law limits your liability to $50 for fraudulent credit card charges, and most issuers waive even that amount. Your issuer will investigate and reverse the charge.

Do I need to memorize my CSC?

No. You only need it when making a purchase, and you should have your physical card in front of you to read it. Never write it down or store it anywhere — keeping it only on the card itself is the safest approach.

Why does American Express put the CSC on the front instead of the back?

American Express designed their cards differently for historical reasons related to how they printed and secured cards in their early years. The placement does not affect how the code works — it serves the same security purpose whether it is on the front or back.