If you’ve purchased anything online, chances are you’re familiar with CSC numbers even if you’ve never heard the term. After requesting your name, credit card number and expiration date, most online retailers require a Card Security Code (CSC) to complete a transaction.

Used for verification purposes, these three- to four-digit codes serve as virtual PINs designed to prevent card-not-present fraud. While Personal Identification Numbers (PINs) are used to protect and verify credit and debit card numbers during ATM transactions and in-person purchases, CSC numbers are designed to protect cards from fraud during online transactions and other situations where the physical card is not available.

EMV Certification

CSC Codes and Their Aliases

Known as a Card Verification Value (CVV) on Visas and a Card Verification Code (CVC) on MasterCards, these three-digit CSC codes are printed in small boxes beside the signature strip on the back of cards. On American Express and Discover cards, the CSC number is known as a Card Identification Number (CID). Unique to its brand, AE is also the only company with a four-digit CSC code printed on the front of its cards. Terms like CVV2 or CVC2 refer to CSC numbers generated through a second-generation process that makes it harder for them to be guessed by hackers and criminals.

The Rise of CSC Codes

Designed to validate legitimate cards during transactions, in 1997 all debit cards were required to use CVC codes, and all Visa cards were outfitted with the technology by the beginning of 2001.

Since a consumer must be in possession of a card to obtain a CSC number, these verification codes were designed to make it harder for criminals to use stolen cards during transactions. For this reason, PCI Standards prohibit CSC numbers from being stored.

Though account names, numbers and expiration dates can be stored on a merchant’s servers, CSC numbers must be reentered before every transaction, no matter how many times a consumer has shopped with a particular merchant. Designed to be unknown to everyone but the card owner and the card company, CSC numbers are also never embossed, copied or printed on receipts.

How CSC Codes Work

Created as a way to keep customers safe, providing a legitimate CSC number lets online merchants know the person on the other end of the transaction is in possession of real credit or debit card.

By requiring CSC verification codes during the authorization process, the card issuer validates or invalidates the code during the approval process. Most payment systems are set up to automatically reject transactions where the CSC code doesn’t match the card number.

Technology That Protects

As CSC codes prove, payment security is a constantly evolving industry and savvy merchants must stay one step ahead of hackers and criminals. To keep your company and customers safe and secure during transactions, contact Bluefin today to learn more about our seamless P2PE encryption solutions.