CSC is the three-digit security code on the back of your credit card
CSC stands for Card Security Code. It is the three-digit number printed on the back of your card, usually in or near the signature strip. Visa calls it CVV2, Mastercard calls it CVC2, and American Express prints a four-digit version on the front. All three serve the same purpose: to verify that you physically have the card when you make an online or phone purchase.
The CSC is not encoded in the card's magnetic stripe or chip — it only appears printed on the card itself. This means a merchant who has stolen your card number from a database cannot complete an online transaction without also having the physical card in hand. It is one of the few pieces of information that proves you own the card right now.
You will see CSC requested whenever you buy something online, over the phone, or through a mail order. It is not used at a physical store where you swipe or insert your card, because the card reader already confirms you have the card. It is also not used for recurring charges after the first transaction, because the merchant already verified you once.
Key Takeaways
- CSC is the three-digit security code on the back of your card (four digits for American Express), and merchants ask for it to confirm you physically own the card.
- Never give your CSC to anyone who calls you or emails you, even if they claim to be from your bank — your bank already has this information.
- CSC protects online and phone purchases but does not protect you if someone steals your full card number, expiration date, and CSC together.
- Losing your CSC to a data breach is less serious than losing your card number, because the CSC alone cannot be used to make purchases.
Why merchants ask for the CSC instead of just using your card number
When you shop in a store, the card reader physically connects to your card and confirms it is real. Online and over the phone, the merchant never touches your card, so they have no way to know whether you are the real owner or someone who found your card number in a stolen database.
The CSC closes that gap. Because it is printed on the card and not stored anywhere else, only someone holding the physical card can read it. A criminal who buys your stolen card number on the dark web will have the number and expiration date, but not the CSC — and most online merchants now refuse to process a transaction without it.
This is why the CSC is sometimes called a "security code" or "verification code." It is not a password you set. It is a permanent feature of the card itself, printed by the card issuer when they make the card.
What happens if someone gets your CSC
If a criminal has only your CSC and nothing else, they cannot use it. The CSC is useless without the card number and expiration date. But if they have all three pieces of information together — your full card number, expiration date, and CSC — they can make online purchases as if they were you.
This is why data breaches at large retailers are serious. When hackers steal from a payment system, they often get the card number and expiration date. If they also get the CSC, the damage is worse. However, many modern payment systems are designed to keep the CSC separate from the card number, so a breach may not expose both.
If you suspect your CSC has been compromised, contact your card issuer and ask them to reissue your card. They will send you a new card with a new CSC. You do not need to wait for fraudulent charges to appear — prevention is faster and simpler than disputing charges later.
CSC is different from your PIN and your CVV
Your PIN (Personal Identification Number) is a four-digit code you create and memorize. You enter it at an ATM or when you insert your card at a store. Your bank is the only one who knows your PIN, and you should never tell anyone what it is.
Your CVV is another name for the CSC. Visa uses CVV2, Mastercard uses CVC2, and Discover uses CID. They all mean the same thing: the three-digit security code on the back. American Express uses a four-digit code on the front and calls it CID or CVV4. When a merchant asks for your "CVV," they are asking for your CSC.
The CSC is not a password. You do not create it, and you do not memorize it. It is printed on your card, and you read it off when a merchant asks. This is why you should never enter your CSC into a website that you did not navigate to yourself — if someone emails you a link and asks you to "verify" your CSC, that is a phishing scam.
When you should and should not share your CSC
You should share your CSC only when you are making a purchase from a merchant you trust. This means typing it into a website you navigated to yourself, or reading it over the phone to a company you called. It is normal for online stores, subscription services, and phone orders to ask for it.
You should never share your CSC with anyone who contacts you first — not by phone, email, text, or social media. Your bank will never ask for your CSC. Your credit card company will never ask for your CSC. If someone claims to be from your bank and asks for it, hang up or delete the message and call your bank directly using the number on the back of your card.
Be especially careful with CSC requests that come with urgency or threats. Scammers often say your account has been compromised or will be closed unless you verify your information when ready. Real banks do not work this way. If you are unsure, end the conversation and call your bank yourself.
How CSC fits into your overall card security
The CSC is one layer of protection, not the whole system. It stops criminals who have only your card number from making online purchases. But it does not protect you if someone steals your physical card, because they will have the CSC too. It also does not protect you from a merchant who is dishonest or whose system is poorly secured.
Your real protection comes from your card issuer's fraud monitoring. Banks watch for unusual purchases — charges in a different state, large amounts, or patterns that do not match your normal spending. If they spot something suspicious, they will contact you or block the charge. This monitoring happens whether or not the CSC was used correctly.
You also have legal protection. Under federal law, your liability for fraudulent charges is limited to $50 if you report the fraud quickly. Most card issuers go further and offer zero liability, meaning you pay nothing for charges you did not make. This protection exists regardless of whether the CSC was involved.
Frequently Asked Questions
Is it safe to write my CSC on my card?
No. If you write your CSC on your card, you defeat its entire purpose. The CSC only works because it is not stored anywhere else — only on the physical card. If you write it down, you are creating a second copy that could be lost or stolen. Keep the CSC printed on your card only.
Can I use my card online without giving the CSC?
Most major online retailers now require the CSC. Some smaller merchants may not ask for it, but this is becoming rare. If a website does not ask for your CSC, that does not mean it is safer — it may mean their security is weaker. You cannot control whether a merchant asks for it; you can only decide whether to shop there.
What should I do if I see a charge I did not make?
Contact your card issuer when ready. Call the number on the back of your card or log into your online account. Report the charge as fraudulent. Your bank will investigate and typically remove the charge within a few days. You do not have to pay for it while they investigate.
Does the CSC change if I get a new card?
Yes. Every time your card issuer sends you a new card — whether because yours expired, was damaged, or was compromised — the new card will have a different CSC. This is why you cannot save your CSC for future purchases. You must enter it fresh each time.
Can someone use my CSC if they only have a photo of my card?
Yes, if the photo shows the CSC clearly. This is why you should never post a photo of your card on social media or send it to someone you do not trust. Even if you cover the card number, a clear photo of the CSC combined with your card number from another source gives a criminal everything they need for online purchases.