The CSC is the three- or four-digit security code on the back of your card

The Card Security Code (CSC) — also called the CVV, CVV2, or CVC — is a number printed on your credit card that you enter when you make online or phone purchases. It sits on the back of most cards as a three-digit code in or near the signature panel. American Express cards print a four-digit code on the front, above the card number.

This code exists to verify that you physically hold the card. When you shop online, the merchant asks for it to confirm the transaction is legitimate. The code itself is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it for remote purchases without also knowing this number.

The CSC is different from your PIN, which you use at ATMs and in-store terminals. You should never write down your CSC or share it except during a purchase you initiated yourself.

Key Takeaways

  • The CSC is a three-digit code on the back of Visa, Mastercard, and Discover cards, or a four-digit code on the front of American Express cards.
  • You enter the CSC when you buy something online or over the phone to prove you have the physical card.
  • The code is not stored on the card's magnetic stripe or chip, so it protects you against fraud when your card number alone is compromised.
  • Never share your CSC with anyone except during a purchase you initiated, and never write it down or store it in your phone.

How to locate the CSC on different card types

Visa, Mastercard, and Discover cards print the CSC on the back, usually to the right of the signature panel. It appears as three digits. On some cards the code sits directly on the white signature strip; on others it appears just below or above it. If you cannot find it when ready, look at the back right corner of the card — that is the most common placement.

American Express cards place the CSC on the front, above the card number on the right side. It is four digits instead of three. This placement is unique to Amex and can confuse cardholders used to other brands.

If your card is damaged, faded, or the code is worn away, contact your card issuer to request a replacement card. You cannot use a card for online purchases without a readable CSC, and the issuer will send you a new one with a fresh code printed clearly.

When merchants ask for the CSC and why

Online retailers, phone merchants, and subscription services request the CSC during checkout. The merchant sends this code to the card network (Visa, Mastercard, or Amex) to verify it matches the card number you provided. If the code does not match or is missing, the transaction is declined.

This verification happens in seconds and is invisible to you. The merchant never stores the CSC — payment processors are legally prohibited from keeping it after the transaction completes. This rule, called PCI compliance, exists specifically to limit the damage if a merchant's database is breached.

Some merchants, especially those selling high-value items or to new customers, may also ask for your billing address or ZIP code as an additional security check. These are separate from the CSC and serve the same purpose: confirming you own the card.

What the CSC does and does not protect

The CSC protects you against card-not-present fraud — when someone uses your card number for online or phone purchases without having the physical card. If a thief obtains your card number through a data breach or skimming, they cannot complete an online purchase without also knowing the CSC.

The CSC does not protect you against in-store fraud. If someone steals your physical card, they can use it at a checkout counter without needing the CSC. It also does not protect you if you voluntarily give your full card details (including the CSC) to a scammer or an unsafe website.

If your card is lost or stolen, contact your issuer when ready. Most card companies will cancel the card and send a replacement with a new CSC within 7 to 10 business days. Until then, you can still make online purchases using your old card number if you have not yet reported it missing, but once you report it, the card is deactivated.

Why you should never share or store your CSC

Your CSC is the only piece of card information that is not printed on receipts, stored in merchant databases, or visible on your statement. This makes it uniquely sensitive. If someone obtains your card number, expiration date, and name from a breach, they still cannot use it online without the CSC.

Never enter your CSC on a website that does not have a find connection. Look for "https://" at the start of the URL and a padlock icon in your browser's address bar. If either is missing, the page is not encrypted and your CSC could be intercepted.

Do not photograph your card, write the CSC in your phone, or email it to yourself. If your phone is compromised or hacked, a thief gains access to all your card details at once. The only safe place for your CSC is in your memory, used only during purchases you initiate.

What to do if your CSC is visible or compromised

If your CSC has faded or worn away and is no longer readable, request a replacement card from your issuer. You can usually do this through your online account or by calling the number on the back of your card. A new card will arrive within 7 to 10 business days with a fresh, clearly printed code.

If you believe your CSC has been compromised — for example, you entered it on a suspicious website or shared it with someone you do not trust — contact your card issuer when ready. They can monitor your account for fraudulent charges and issue a new card if necessary. You are not liable for unauthorized charges if you report them promptly.

If you notice charges on your statement that you did not make, report them to your issuer within 60 days. Most card companies will reverse fraudulent charges while they investigate, and you will not be held responsible for the amount.

CSC versus other card security features

The CSC is one layer of fraud protection, but not the only one. EMV chip technology — the small metallic square on the front of your card — creates a unique code for each in-store transaction, making it nearly impossible to counterfeit. Tokenization replaces your actual card number with a random code when you save your card to a digital wallet like Apple Pay or Google Pay, so merchants never see your real number.

Your card issuer also monitors your account for unusual patterns. If you normally spend in one city and suddenly make a purchase across the country, the issuer may flag it and contact you. This fraud detection system runs in the background and does not require you to do anything.

Together, these tools — the CSC, the chip, tokenization, and issuer monitoring — make credit card fraud less common than it was a decade ago. However, no single feature is foolproof, which is why you should still check your statement regularly and report anything suspicious.

Frequently Asked Questions

Is the CSC the same as my PIN?

No. Your PIN is a number you create and use at ATMs and in-store terminals. Your CSC is printed on the card by the issuer and is used only for online and phone purchases. You should never share your PIN with anyone, and you should never enter your PIN online.

Can I use my card online if the CSC is worn off?

Most online merchants will decline your transaction if the CSC is missing or unreadable. Contact your issuer to request a replacement card. In the meantime, you may be able to use a digital wallet like Apple Pay or Google Pay if you have saved your card to one, since these services do not require the CSC.

What happens if I give my CSC to a scammer?

Contact your card issuer when ready and report the incident. They will monitor your account for fraudulent charges and can issue a new card with a new CSC if necessary. You are not liable for unauthorized charges if you report them within 60 days of the statement date.

Do I need to enter my CSC every time I shop online?

Yes, unless you have saved your card to a digital wallet or the merchant has your card on file from a previous purchase. Subscription services and recurring charges may store your card securely so you do not have to enter the CSC each time, but the merchant cannot legally store the CSC itself.

Why does American Express put the CSC on the front?

American Express uses a different card design and security model than Visa and Mastercard. The front placement is intentional — it makes the code less visible to casual observers and slightly harder for someone to photograph your card without you noticing.