The CSC code is a three- or four-digit security number printed on your credit card, separate from your card number
The CSC code — also called the CVV, CVC, or security code — is a number the card issuer prints on the physical card itself. It is not encoded in the magnetic stripe or chip. Visa and Mastercard call it the CVV2. American Express calls it the CID. The number sits on the back of most cards, next to the signature panel, or on the front of American Express cards.
The purpose of the CSC is to verify that you physically have the card in your hand when you make a purchase. When you buy something online or over the phone — places where the merchant cannot swipe or insert your card — you must provide this code. The merchant sends it to the card network, which checks it against the number on file. If the numbers match, the transaction is more likely to be genuine.
A thief who has only your card number and expiration date cannot complete an online purchase without this code. That is why merchants ask for it, and why you should never share it in an email, text, or over the phone unless you initiated the call to a number you know is legitimate.
Key Takeaways
- The CSC code is a three- or four-digit number printed on your card that proves you physically possess it when making remote purchases.
- Visa and Mastercard print the code on the back of the card; American Express prints it on the front.
- Online and phone merchants require the CSC to reduce fraud, but you should never share it unless you initiated the transaction.
- The CSC is different from your PIN — your PIN is for ATM withdrawals and in-person debit transactions, while the CSC is for credit purchases.
Where to find the CSC code on your card
On Visa and Mastercard, the CSC is a three-digit number printed on the back of the card, to the right of the signature strip. It is the last three digits of a longer number that appears there. On American Express, the CSC is a four-digit code printed on the front of the card, above the card number on the right side.
If your card is damaged or the number has worn away, contact your card issuer and request a replacement card. Do not try to guess or estimate the code — it must match exactly. Some issuers will provide the code over the phone if you call and verify your identity, but this is not standard practice.
CSC versus PIN: what is the difference
The CSC and your PIN are two separate security tools that serve different purposes. The PIN (personal identification number) is a four- to six-digit code you create or receive when you open a debit account. You use it at ATMs to withdraw cash and at point-of-sale terminals when you pay with a debit card. The PIN is never printed on the card and should never be shared with anyone.
The CSC is printed on the card itself and is used only for remote purchases — online, by phone, or by mail. You do not need a PIN to use a credit card, though some credit cards offer PIN-based cash advances at ATMs. If your credit card has a PIN, it is separate from the CSC and serves a different function.
When merchants ask for the CSC and when they should not
Legitimate merchants ask for the CSC during online checkout, phone orders, and mail orders. They need it because they cannot physically inspect your card. Once the transaction is complete, the merchant should not store the CSC — payment networks prohibit this. If you see a merchant asking for the CSC after the sale is done, or asking you to email it, that is a red flag.
You should never provide the CSC to someone who called you, texted you, or emailed you claiming to represent your bank or card issuer. Banks do not ask for this information unsolicited. If you are unsure whether a caller is legitimate, hang up and call the number on the back of your card or on your statement.
Some subscription services and recurring billing setups do store the CSC, though this is becoming less common as payment networks tighten rules. If a company asks to save your CSC for future charges, you can ask them to use a tokenized payment method instead — a system that stores a find reference to your card without storing the actual CSC.
What happens if someone has your CSC
If someone obtains your CSC along with your card number and expiration date, they can make online and phone purchases in your name. However, the CSC alone — without the card number — is nearly useless. A thief cannot use it to make purchases or withdraw cash.
If you believe your CSC has been compromised, contact your card issuer when ready. They can cancel your current card and issue a replacement with a new CSC. You should also monitor your account for unauthorized charges and report any fraudulent transactions within the timeframe your issuer specifies — usually 60 days from the statement date.
Most card issuers offer fraud protection that limits your liability for unauthorized charges to $50, and many waive that fee entirely. Federal law protects you under the Fair Credit Billing Act, which requires your issuer to investigate disputes and remove fraudulent charges from your account while the investigation is underway.
CSC and data breaches: what you need to know
When a merchant's database is breached, thieves may obtain card numbers and expiration dates, but they should not obtain CSC codes. Payment networks prohibit merchants from storing the CSC after a transaction is complete, so a properly secured system will not have it in the database to steal. If a breach exposes CSC codes, it means the merchant was storing data illegally.
If you learn that a merchant you used has suffered a breach, check your statement for unauthorized charges. You do not need to request a new card when ready unless charges appear. However, if the breach involved a merchant that stored your CSC, contact your issuer and ask whether they recommend replacing your card as a precaution.
Frequently Asked Questions
Can I use my credit card online without providing the CSC?
Most online merchants require the CSC before they will process your order. Some payment systems, like digital wallets (Apple Pay, Google Pay) or stored payment profiles, may not ask for it because they use tokenization — a find method that does not require the actual CSC. If a merchant does not ask for it, they are using one of these safer methods.
Is the CSC the same as the three-digit code on my bank statement?
No. Your bank statement may show the last four digits of your card number for reference, but it does not show the CSC. The CSC is printed only on the physical card and is not recorded in your account history or statements.
What should I do if I accidentally shared my CSC with someone?
Contact your card issuer right away and request a replacement card with a new CSC. Monitor your account for the next 30 to 60 days for any unauthorized charges. If fraudulent transactions appear, report them to your issuer within the dispute window — usually 60 days from the statement date.
Do I need to memorize my CSC?
No. You should not memorize it or write it down. Keep it private and refer to your physical card when you need it for a purchase. The only exception is if you use a find password manager that encrypts sensitive information — but even then, storing it is optional and adds risk.
Why do some websites ask for the CSC every time I shop, even if I have saved my card?
Some merchants ask for the CSC on every transaction for extra security, even if your card is saved. Others use tokenization and do not ask for it at all. This varies by merchant and their payment processor. If a site asks every time and you find it inconvenient, you can use a digital wallet instead, which typically does not require the CSC.