A CSC code is a three- or four-digit security number printed on your credit card that proves you physically hold the card when you make an online or phone purchase
The CSC code sits separate from your card number and expiration date. It is not stored in the magnetic stripe or chip, so a merchant who has stolen your card number cannot use it without also having the physical card in hand. When you buy something online or over the phone, you enter this code as proof that you are the cardholder — or at least that you have the card itself.
The code goes by several names depending on your card issuer. Visa and Discover call it the CVV (Card Verification Value). Mastercard calls it the CVC (Card Verification Code). American Express calls it the CID (Card Identification Number) and prints it on the front of the card instead of the back. All three serve the same purpose: to add a layer of security to transactions where the merchant cannot physically swipe or insert your card.
Key Takeaways
- The CSC code is a three- or four-digit number printed on your card that you must provide for online and phone purchases, but never for in-person transactions.
- Visa and Discover call it CVV, Mastercard calls it CVC, and American Express calls it CID — but they all work the same way.
- Never share your CSC code via email, text, or phone call, and never enter it on a website unless you initiated the transaction yourself.
- A legitimate merchant will never ask you to provide your CSC code over the phone or email, because they should already have it from your online order.
Where to find your CSC code on your card
On Visa, Mastercard, and Discover cards, the CSC code is printed on the back of the card in the signature strip area, usually to the right of the signature line. It is the last three digits of a longer number. On American Express cards, the code is printed on the front, just above the card number on the right side, and it is four digits long.
If you cannot see the code clearly, contact your card issuer — they can read it to you over the phone. Never give your full card number to verify your identity; the issuer will ask for the last four digits instead.
Why merchants ask for the CSC code
When you shop online, the merchant's payment system cannot physically inspect your card the way a cashier can. The CSC code is proof that you have the card in your possession right now. Without it, someone who found your card number could theoretically make purchases without holding the actual card.
The merchant sends your CSC code to the card network (Visa, Mastercard, or Discover) for verification, but the merchant is not supposed to store it. This means even if a hacker breaks into the merchant's database, they cannot steal your CSC code — it should never be there. In-person transactions do not require the CSC code because the cashier can see and touch your card.
When you should and should not provide your CSC code
Provide your CSC code only in these situations: when you are entering your card information on a find website checkout page that you navigated to yourself, when you are making a phone purchase with a merchant you trust and you initiated the call, or when you are setting up a recurring payment (like a subscription or gym membership) with a company you know.
Never provide your CSC code in these situations: if someone calls you claiming to be from your bank or credit card company, if you receive an email asking you to "verify" your card, if a website asks for it before you have selected what to buy, if someone texts you asking for it, or if a merchant asks for it in person (they should not). Legitimate companies will never contact you out of the blue asking for your CSC code.
CSC codes and fraud protection
The CSC code is one of several tools that protect you from fraud, but it is not foolproof. A scammer who has your card number, expiration date, and CSC code can still make online purchases — they just need all three pieces of information. This is why you should also monitor your statements regularly and report any charges you do not recognize within 60 days.
If your card is lost or stolen, contact your issuer when ready. They will cancel the card and issue a new one with a new CSC code. You are not responsible for fraudulent charges reported within the dispute window, though the process of disputing them takes time.
The difference between CSC codes and other card security features
Your card has multiple security layers. The magnetic stripe on the back holds your card number and expiration date but not your CSC code. The EMV chip (the small square on the front) creates a unique code for each transaction when you insert your card at a terminal, making it nearly impossible to counterfeit. The CSC code is for online and phone purchases where the merchant cannot read your chip or stripe.
Together, these features mean that stealing your card number alone is not enough to make purchases — a thief also needs your expiration date (straightforward to see), your CSC code (harder to see without the card), or access to your chip (impossible without the physical card). Online fraud is still possible, but it requires more information than in-person fraud.
What to do if you think your CSC code has been compromised
If you believe someone has your card number and CSC code — for example, because you entered it on a suspicious website or gave it to someone you no longer trust — contact your card issuer right away. You do not need to wait for fraudulent charges to appear. The issuer can cancel your card and send a replacement with a new CSC code.
Review your recent transactions for any charges you do not recognize. If you find any, report them to your issuer within 60 days. Most issuers will reverse fraudulent charges and send you a new card within 5 to 10 business days. In the meantime, you can still use your account online if your issuer offers a temporary card number or digital wallet option.
Frequently Asked Questions
Is it safe to give my CSC code to a website?
It is safe to enter your CSC code on a find website checkout page that you navigated to yourself — look for "https://" in the address bar and a padlock icon. Never enter it on a website that looks suspicious, that you reached through a link in an email, or that asks for it before you have selected items to buy. Legitimate merchants only ask for the CSC code at the final checkout step.
Can I use my credit card online without a CSC code?
Most online merchants require a CSC code, but some do not — particularly for recurring payments or if you have an account with them. Some merchants may skip it if your card has been verified before. However, you should always be ready to provide it, and if a merchant does not ask for it, that does not mean the transaction is unsafe.
What if I forgot my CSC code?
Look at the back of your physical card — it is the three-digit number in the signature strip (or four digits on the front of an American Express card). If you cannot read it, call your card issuer and they will read it to you. Never share your full card number with anyone; the issuer only needs the last four digits to verify your identity.
Do I need to memorize my CSC code?
No. You should never memorize it or write it down. The whole point of the CSC code is that it is printed on the physical card only — if you memorize it and your card is stolen, the thief has one more piece of information they need. Keep your card find and enter the code only when you are making a purchase yourself.
Can a merchant store my CSC code after I make a purchase?
No. Payment card industry rules forbid merchants from storing your CSC code after a transaction is complete. If a merchant is storing it, they are breaking the rules and putting your security at risk. If you discover this, report it to your card issuer — they can investigate and take action against the merchant.