The Card Security Code (CSC) a.k.a. Card Verification Value (CVV) - is a security feature for credit card transactions on the Internet and over the phone. It is a 3 or 4 digit value printed nowhere except on the card, and can theoretically be used to verify that the buyer has the card in their physical possession, giving some protection against credit card fraud. Credit cards A credit card system is a type of retail transaction settlement and credit system, named after the small plastic card issued to users of the system. ... Credit card fraud is one of many form of frauds that involve credit cards, charge cards, debit cards, or prepaid cards. ...

Unfortunately, the primary way that criminals get credit card information for use in online (or phone) fraud is via phishing scams, which also will result in the capture of the CSC codes for the compromised credit card. This fact of life has reduced the real-world effectiveness of the CSC codes as an anti-fraud device. This phishing attempt, disguised as an official email from Charter One Bank, attempts to trick users into giving away their account information by confirming it at the phishers linked website. ...

The code is be found in different places on the various families of cards, and is referred to by several different names:

• Mastercard, Visa and Discover cards have a 3 digit code, called the "CVC2" (card validation code), "CVV2" (card verification value) and "Cardmember ID" respectively. It is not embossed like the card number, and is always the final group of numbers printed on the back signature panel of the card.

• American Express cards have a 4 digit code printed on the front side of the card above the number, referred to as the "CID", or Card Identification Number. It is printed flat, not embossed like the card number.

Another potential value of CSC codes is for subscription-based services. Again theoretically, a merchant who needs to rebill a credit card would not store the CSC code after the initial transaction. That way, if the merchant's credit card database were to be compromised the thieves wouldn't get access to the CSC codes. MasterCard Incorporated is a membership organization owned by the 25,000 financial institutions that issue its card. ... Visa is a brand of credit card and debit card operated by the Visa International Service Association of San Francisco, California, USA, an economic joint venture of 21,000 financial institutions that issue and market Visa products. ... Discover Card is a brand of credit card operated by Discover Bank, a subsidiary of Morgan Stanley headquartered in Riverwoods, Illinois. ... American Express NYSE: AXP is a diversified global financial services company headquartered in the United States. ...

Unfortunately, the only way this works is if the use of CSC codes is optional (otherwise the merchant would need it to rebill the credit card as well)... and if that is the case CSC codes aren't actually needed by the thief anyway.