What is the Card Security Code (CSC)?

The Card Security Code (CSC) is an authentication procedure established by credit card companies to further efforts towards reducing fraud for Internet transactions. It consists of requiring a cardholder to enter the CSC number at transaction time to verify that the card is on hand. The CSC code is a security feature for "card not present" transactions (for example, Internet transactions), and now appears on most (but not all) major credit and debit cards. This feature is a three-digit or four-digit code, which provides a cryptographic check of the information embossed on the card. Therefore, the CSC code is not part of the card number itself. It helps ascertain that the customer placing the order actually possesses the credit/debit card and that the card account is legitimate, because the CSC appears only on the card and not on receipts or statements.

Each credit card company has its own name for the CSC code, but it functions in the same manner for all major card types. (VISA refers to the code as CVV2, MasterCard calls it CVC2, American Express, and Discover call it CID.)

The back panel of most Visa, MasterCard, and Discover cards contain the full 16-digit account number, followed by the 3-digit CSC (CID/CVV2/CVC) code. Some banks, though, only show the last four digits of the account number followed by the 3-digit code. American Express contains the 4-digit CSC (CID) code on the front of the card near the account number. To aid in the prevention of fraudulent credit card use, your website should require the 3 or 4 digit code be entered at the time of the transaction.

Not all U.S. issuing banks, international issuing banks and/or processors currently support the CSC (CID/CVV2/CVC) system, so it may or may not be available for a given transaction.