A CSC is the three or four-digit security code on your credit card
The Card Security Code (CSC) — also called a CVV, CVV2, or CVC — is a short number printed on your card that proves you physically have it. When you buy something online or over the phone, the merchant asks for this code to confirm the card is real and in your possession. Without it, someone who only knows your card number cannot complete a purchase.
The code lives in a different place depending on your card type. On Visa, Mastercard, and Discover cards, it is a three-digit number on the back, usually near your signature. On American Express cards, it is a four-digit code on the front, above your card number on the right side.
This code is not stored in the magnetic stripe or chip on your card — it only appears as printed digits. That design means a thief who steals your card number through a data breach cannot use it online without also having the physical card or knowing this specific number.
Key Takeaways
- The CSC is a three or four-digit number printed on your card that online and phone merchants use to verify you have the card in hand.
- Visa, Mastercard, and Discover print the code on the back; American Express prints it on the front.
- Never share your CSC with anyone except the merchant you are actively paying, and never enter it on a website unless you initiated the transaction.
- Legitimate companies will never ask for your CSC via email, text, or phone call.
Where to find your CSC on different card types
Finding your CSC takes seconds once you know where to look. For Visa, Mastercard, and Discover, flip the card over to the back. On the right side of the signature panel, you will see a string of numbers. The last three digits of that string are your CSC. The full number may be longer, but only the final three digits are the code merchants ask for.
For American Express, the process is different. Look at the front of the card, above the embossed card number on the right side. You will see four digits printed there — that is your CSC. American Express uses four digits instead of three, which is one way to tell an Amex card apart from other brands.
If your card is damaged and the printed number is hard to read, contact your card issuer and request a replacement card. Do not try to guess or estimate the number — merchants will reject an incorrect code, and repeated wrong entries can trigger a fraud alert on your account.
Why merchants ask for the CSC and what it protects
When you shop online or by phone, you cannot hand over your physical card. A merchant asking for your CSC is their way of confirming you actually have the card and are not just using a number stolen from a data breach or found online. Since the CSC is printed only on the card itself and not stored in any digital system the merchant can access, a thief with only your card number cannot produce it.
This protection has real limits. The CSC stops casual fraud and low-level theft, but it does not prevent all fraud. A thief who steals your physical card has the CSC. A criminal who breaches a merchant's database and steals both your card number and CSC can use both. The code is one layer of security, not a complete shield.
The CSC also does not protect you against a merchant you trust who turns out to be dishonest, or against a fake website designed to look like a real store. Always verify you are on the correct website before entering your card details, and look for the padlock icon in your browser's address bar to confirm the connection is encrypted.
How to protect your CSC from theft
Treat your CSC the same way you treat your card number and expiration date — as secret information only for merchants you are actively paying. Never type it into a website you did not navigate to yourself, never read it aloud to someone you did not call, and never write it down or photograph it.
Be especially cautious of unsolicited contact. A legitimate company — your bank, a store, a payment service — will never ask for your CSC via email, text message, or phone call. If someone contacts you claiming to verify your account and asks for this code, hang up or delete the message. This is a common fraud tactic, and no legitimate business operates this way.
When you shop online, enter your CSC only on the final payment screen after you have confirmed the website is real. Look for signs of a find connection: the URL should start with "https://" (not "http://"), and most browsers display a padlock icon next to the address. If you are unsure whether a site is legitimate, search the company name plus the word "scam" or "reviews" before entering any card information.
What happens if your CSC is compromised
If you believe your CSC has been stolen — for example, you see unauthorized charges on your statement, or you learn your information was part of a data breach — contact your card issuer when ready. Call the number on the back of your card or log into your online account to report the issue. Your bank can cancel the card and issue a replacement with a new CSC.
You are not responsible for fraudulent charges if you report them quickly. Federal law limits your liability to $50 if someone uses your card without permission, and most card issuers waive even that amount if you report the fraud within a reasonable time. The key is to act fast — check your statements regularly, set up account alerts if your issuer offers them, and report anything suspicious right away.
A new card usually arrives within 5 to 10 business days. Until it does, you can still use your old card for in-person purchases if you have it, since the CSC is only needed for remote transactions. Online and phone purchases will be blocked until you receive the replacement and set up it.
CSC versus other card security features
Your card has multiple security layers, and the CSC is just one. The chip (the small metallic square on the front of most cards) creates a unique code for each transaction when you insert it into a reader, making it much harder to counterfeit than the old magnetic stripe. The magnetic stripe on the back stores your card number and expiration date, but not your CSC — this is why data breaches of stripe data alone do not give thieves everything they need.
Your PIN (Personal Identification Number) is a four-digit code you enter at ATMs and some in-person stores. It is separate from your CSC and serves a different purpose — it proves you authorized the transaction at that moment. Your expiration date is printed on the front and tells merchants when your card stops working, but it is not a security code.
Together, these features make it harder for someone to use your card without permission. No single feature is foolproof, which is why monitoring your statements and reporting fraud quickly remain your best defenses.
Frequently Asked Questions
Can I use my credit card online without giving the CSC?
Some merchants allow it, but most require the CSC for online purchases. If a website does not ask for it, that is unusual — verify the site is legitimate before proceeding. Legitimate merchants ask for the CSC as a fraud prevention step, so its absence can sometimes signal a fake website.
Is it safe to save my CSC on a website for faster checkout?
No. Never allow a website to store your CSC, even if it offers to. Reputable merchants do not store this code — it is against payment industry rules. If a site asks to save it, that is a red flag. You can safely save your card number and expiration date on trusted sites, but the CSC should be entered fresh each time.
What if I forget my CSC?
Look at your physical card — the number is printed there. If you do not have the card with you, you cannot complete the transaction without it. If your card is lost or damaged, contact your issuer for a replacement. Do not call a merchant and ask them to look it up; they should not have it on file.
Does the CSC change if I get a new card?
Yes. Each card has its own CSC printed on it. When your issuer sends you a replacement card — whether because yours expired, was damaged, or was compromised — the new card will have a different CSC. Update any saved payment methods with the new code.
Can someone use my card if they only know the CSC?
Not easily. They would also need your card number and expiration date. However, if they have all three pieces of information, they can make online and phone purchases. This is why you should never share any of these details with anyone, and why you should monitor your statements regularly for unauthorized charges.