Card security code
What is a card security code?
Card security code (CSC) is a three- or four-digit number printed (not embossed) on a payment card that verifies the person entering the card details physically holds the card. It's checked during online, phone, and mail-order payments, where no one can inspect the card in person.
Card networks introduced the CSC in the late 1990s to add a fraud check for e-commerce, and each network adopted it under its own name and format. The code is printed on the card surface and is never written to the magnetic stripe or chip, so copying a card's stored data doesn't capture it. At checkout the merchant collects the CSC in a dedicated field and sends it to the issuer with the card number and expiry date; the issuer returns a match or no-match result, and the merchant discards the value once the payment is authorized.
Key facts
- Also known as: CVV2 (Visa), CVC2 (Mastercard), CID (American Express), and CSC (Discover) – all names for the same printed .
- Length: three digits on Visa, Mastercard, and Discover; four digits on American Express.
- Location: printed on the back of Visa, Mastercard, and Discover cards; on the front of American Express cards.
- Where it's used: – online, phone, and mail order.
- Not a standalone approval: the CSC verifies possession only; the card number, expiry, and any required authentication still apply.
- Storage: card data security standards bar merchants from keeping the code after a payment is authorized.
Card security code by network
Each network uses a different name for the same printed code:
| Network | Name | Digits | Location |
| Visa | Card Verification Value 2 (CVV2) | 3 | Back |
| Mastercard | Card Validation Code 2 (CVC2) | 3 | Back |
| American Express | Card Identification Number (CID) | 4 | Front |
| Discover | Card Security Code (CSC) | 3 | Back |
Security code on debit, virtual, and chip cards
The code works the same way across card types, but where it appears can differ:
- Debit and prepaid cards: carry the same code, in the same place, as credit cards on that network.
- Virtual cards: have no physical surface, so the issuer shows the code in its banking app or online banking next to the card number.
- Dynamic codes: some issuers replace the fixed printed code with one that changes periodically and is shown in the app or on a small display on the card.
- Numberless cards: print no card details at all; the number, expiry, and security code are only visible in the issuer's app.
- Chip and contactless payments: the chip generates its own electronic value (iCVV) for in-person payments. That's a different value from the printed code and never replaces it online.
Because merchants can't store the code, only the can show it again if the card is lost or the printed digits have worn off.
How it compares
The "2" in CVV2 and CVC2 separates the printed code from the verification value encoded in the card's magnetic stripe (CVV1 / CVC1). The stripe value is read automatically when a card is swiped in person, so it only applies to card-present payments. The printed CSC covers the opposite case: it confirms possession of the card when there's no terminal to read the stripe or chip. This is why a stolen card number and expiry date alone often fail at an online checkout that asks for the CSC. For the broader concept behind both values, see .
When the security code isn't requested
Not every card payment asks for the code. The most common cases follow from the rule that merchants can't store it:
- Recurring and merchant-initiated charges: the cardholder enters the code on the first payment only. Later and other are sent without it, relying on the stored credential and the earlier approval instead.
- Card on file: one-click checkouts that reuse a often skip the field for the same reason, sometimes adding another check such as 3D Secure.
- Wallets and tokens: a payment sends a one-time cryptogram tied to a credential, and the device's fingerprint, face, or passcode check replaces the printed code.
- In-person payments: a reads the chip or stripe, so the printed code isn't needed.
The code also has clear limits. It doesn't stop phishing, where the cardholder is tricked into typing it into a fake checkout, and fraudsters can guess it by spreading attempts across many merchants. That's why issuers treat a match as one signal among several, not as proof of identity.
Why it matters
The CSC gives merchants and issuers a signal that's hard to fake without the physical card.
- Because the code is printed and never stored in the stripe or chip, card data lifted through or a database breach won't include it.
- In a , a matching CSC is one of the few signals that the person entering the details is holding the card rather than keying in a stolen number.
- A CSC mismatch acts as a risk indicator: the can decline the authorization, or the merchant can route the payment through for a stronger identity check.
- Card data security standards bar merchants from keeping the code after authorization, so it stays useless to anyone who later breaks into stored card records.
