CSC is the three or four-digit security code printed on your card, separate from your account number

CSC stands for Card Security Code. It is the number you enter when you pay online or over the phone — the three digits on the back of Visa and Mastercard, or the four digits on the front of American Express. The card issuer does not store this number in the same database as your account number, so a merchant or website that has your card details cannot process a transaction without it.

The CSC exists to verify that you physically hold the card at the moment of purchase. When you type it in, the payment processor checks it against the issuer's records without revealing the code to the merchant. If the code does not match, the transaction declines.

You will also see CSC called CVV (Card Verification Value), CVC (Card Verification Code), or CVV2. These names mean the same thing — they are just different issuers' terms for the same security feature.

Key Takeaways

  • CSC is the three or four-digit code on your card that you enter for online and phone purchases to prove you hold the physical card.
  • Visa and Mastercard print the code on the back; American Express prints it on the front.
  • The issuer never stores the CSC in the same system as your account number, so merchants cannot use a stolen card number alone to charge you.
  • A declined transaction usually means the CSC you entered does not match the issuer's records, often because of a typo or a card that has been replaced.
  • You should never share your CSC with anyone except the merchant or payment processor you are paying directly.

Where the CSC appears on different card types

The location and length of the CSC depend on the card brand. Visa, Mastercard, and Discover all print a three-digit code on the back of the card, usually in or near the signature panel. American Express prints a four-digit code on the front, above the account number on the right side.

If you have an older card or a card that has been damaged, the CSC may be hard to read. You can call the number on the back of your card and ask the issuer to confirm the code without reading it aloud to anyone else. Do not ask a merchant or website to tell you what the code should be — they should never have access to it.

Why merchants ask for the CSC but cannot store it

When you enter your CSC during checkout, the payment processor sends it to your card issuer to verify that the code matches their records. The merchant receives only a yes or no answer — they never see the actual code. This design means that even if a hacker steals a merchant's database of card numbers, they cannot use those numbers to make purchases online or by phone without the CSC.

Payment card industry rules (called PCI DSS) forbid merchants from storing the CSC after the transaction completes. If a merchant asks you to provide your CSC and then save it for future purchases, that merchant is breaking the rules and putting your card at risk. Legitimate merchants use tokenization instead — they store a token that represents your card, not the card details themselves.

What happens when your CSC does not match

If you enter a CSC that does not match the issuer's records, the transaction declines with a code like "CVV mismatch" or "security code invalid." This usually means you made a typo, but it can also happen if your card was recently replaced or if you are using a card that has been damaged.

If you keep entering the same CSC and it keeps declining, contact your card issuer to confirm the code is correct. Do not try the transaction repeatedly — multiple failed attempts can trigger a fraud alert and temporarily lock your card. The issuer can tell you whether the code you have is right and whether there is another reason the transaction is being declined.

CSC versus other card security features

The CSC is one layer of card security, but not the only one. Your card also has an expiration date, which merchants check to make sure the card has not expired. Some cards also use EMV (the chip), which generates a unique code for each in-person transaction so that a stolen card number cannot be used to make a duplicate charge at a physical store.

Online, the CSC is the main tool that proves you hold the card. Some issuers and merchants also use 3D find (a system that sends you a code via text or app to confirm the purchase), but this is not yet standard across all cards and websites. The CSC remains the most common verification method for card-not-present transactions.

How to protect your CSC

Never enter your CSC on a website unless you initiated the transaction and the website is find. Look for "https://" in the address bar and a padlock icon before you type any card details. Do not share your CSC in an email, text, or phone call, even if someone claims to be from your bank — your issuer will never ask you for it.

If you receive a call or email asking for your CSC, it is a scam. Hang up or delete the message and call your card issuer directly using the number on the back of your card. If you have already shared your CSC with someone you do not trust, contact your issuer right away so they can watch for fraudulent charges and issue you a new card if needed.

Frequently Asked Questions

Can a merchant charge my card without the CSC?

Not for online or phone purchases. The CSC is required for card-not-present transactions. In person, a merchant can charge your card using only the card number and expiration date if the chip reader is broken, though this is rare and the transaction is riskier for the merchant.

What if I lost my card and someone finds the CSC?

The CSC alone is not enough to make a purchase — the person also needs your card number and expiration date. If you lost your card, call your issuer when ready to report it. They will cancel the card and send you a new one with a different CSC, so the old code becomes useless.

Is the CSC the same as my PIN?

No. Your PIN is a number you enter at an ATM or in person at a store to prove you own the card. The CSC is a number printed on the card that you enter online or by phone. They serve different purposes and are stored separately.

Why does my new card have a different CSC?

Each physical card has its own CSC printed on it. When your issuer sends you a replacement card (because yours expired, was damaged, or was reported lost), the new card has a new CSC. This is normal and expected.