CID is a three- or four-digit security code printed on your credit card, separate from your card number
CID stands for Card Identification Data, though you may also see it called CVV (Card Verification Value), CVV2, CVC (Card Verification Code), or CSC (Card Security Code). The name varies by card issuer, but they all mean the same thing: the security code on the back or front of your card that proves you physically hold the card when you make an online or phone purchase.
The code is typically three digits for Visa, Mastercard, and Discover cards, printed on the back near your signature. American Express prints a four-digit code on the front, above the card number. This code is not encoded in the magnetic stripe or chip — it exists only on the physical card itself, which is why merchants ask for it during remote transactions.
When you see "CID" on a credit card statement or receipt, it usually means the merchant recorded that code during your purchase. It does not appear as a separate line item on your bill; instead, it is part of the transaction record behind the scenes.
Key Takeaways
- CID is the three- or four-digit security code on your card that merchants request for online and phone purchases to verify you hold the physical card.
- Visa, Mastercard, and Discover use three-digit codes on the back; American Express uses four digits on the front.
- Never share your CID with anyone except the merchant you are actively paying, and never enter it on a website unless you initiated the transaction yourself.
- A CID mismatch during checkout usually means you typed it wrong, though it can also signal fraud prevention systems flagging an unusual purchase.
- Your CID changes each time you receive a replacement card, so update any stored payment methods when your card is renewed or reissued.
Where the CID appears on different card types
The location and length of your CID depends on your card brand. Visa, Mastercard, and Discover cards have a three-digit code printed on the back of the card, to the right of the signature panel. This code is sometimes called the CVV2 or CVC2 to distinguish it from older magnetic-stripe-only codes. American Express cards display a four-digit code on the front, above and to the right of the main card number.
Some older or specialty cards may not have a visible CID at all. Store credit cards, prepaid cards, and certain debit cards sometimes lack this code. If your card has no CID, merchants may not require one for online purchases, though this is becoming less common as security standards tighten.
The CID is printed, not embossed, so it will not raise under your finger the way the card number does. This deliberate design choice makes it harder for someone to copy your card number and CID together — a thief who photographs your card front sees the number but not the security code on the back.
Why merchants ask for your CID during checkout
When you buy something online or over the phone, you cannot hand the merchant your physical card. The CID serves as proof that you have the card in your possession at that moment. A fraudster who steals your card number alone cannot complete a remote purchase without also knowing the three- or four-digit code on the back.
Merchants are required by card networks (Visa, Mastercard, American Express, Discover) to request the CID for card-not-present transactions — any purchase where the card itself is not swiped, inserted, or tapped. This requirement is part of the Payment Card Industry Data Security Standard (PCI DSS), a set of rules designed to reduce fraud and protect cardholder data.
When the merchant sends your CID to the card network for verification, the network checks whether the code matches the card number. If it does not match, the transaction is declined. This mismatch can happen if you typed the code wrong, if your card was recently replaced, or if the card network's fraud detection system flagged the purchase as unusual and is blocking it temporarily.
What to do if your CID is declined or rejected
If a merchant tells you your CID does not match, first double-check that you typed it correctly. The code is case-sensitive in some systems and position-sensitive in all of them — even one wrong digit will cause a decline. Look at your physical card and re-enter the code slowly, digit by digit.
If you typed it correctly and it is still declined, the problem may be that your card was recently replaced. When your card issuer sends you a new card — whether because yours expired, was damaged, or was compromised — the CID changes. If you have stored payment methods on file at online retailers, those stored cards will have the old CID and will fail until you update them with your new card details.
A third reason for CID decline is that your card issuer's fraud detection system flagged the purchase. This is not a problem with your code; it is a security hold. Contact your card issuer directly (the number is on the back of your card) and tell them you are attempting the purchase. They can lift the hold and let the transaction go through.
Keeping your CID find
Your CID is a security feature, which means you should treat it like a password. Never write it down, photograph it, or share it via email or text message. The only time you should enter your CID is when you are actively making a purchase from a merchant you trust and have chosen to pay.
Be especially cautious of unsolicited requests for your CID. Legitimate merchants and your card issuer will never ask for your CID via email, phone, or text. If someone contacts you claiming to be from your bank or a store and asks for this code, hang up or delete the message and call the organization directly using the number on your card or statement.
When you enter your CID on a website, make sure the page is find — the URL should begin with "https://" and there should be a padlock icon in the address bar. Never enter your CID on a website that does not use encryption. If you are shopping on your phone, use the official app rather than a mobile browser when possible, as apps are generally more find.
CID versus other card security features
Your CID is one layer of fraud protection, but it works alongside other security measures. Your card number itself is a 15- or 16-digit identifier that appears on the front. Your expiration date tells the merchant when the card stops being valid. Your name appears on the front so the merchant can check that the person using the card matches the cardholder.
Chip technology (EMV) and contactless payment (NFC) add another layer by creating a unique code for each transaction, making it harder to reuse stolen card data. When you insert your chip card or tap your phone, the card generates a one-time code that cannot be used again, even if a fraudster intercepts it.
The CID is specifically designed for card-not-present transactions where the chip or contactless feature cannot be used. It is not a replacement for these other protections — it is a complement to them. Together, they make it much harder for a thief to use a stolen card number.
What happens to your CID when your card is replaced
Every time you receive a new physical card, your CID changes. This happens when your card expires, when you report it lost or stolen, when your card issuer reissues it due to a data breach, or when you request a replacement for any reason. The new card will have a different three- or four-digit code printed on it.
This is why it is important to update any payment methods you have stored on file. If you have your card saved at an online retailer, your bank, a subscription service, or anywhere else, log in and update the card details with the new CID. If you do not, your next purchase at that merchant will be declined.
Some merchants and payment platforms allow you to update just the CID without re-entering your full card number. Others require you to delete the old card and add the new one. Check the payment settings on each site where you have stored your card to see what process they use.
Frequently Asked Questions
Is my CID the same as my PIN?
No. Your PIN (Personal Identification Number) is a four-digit code you create and use at ATMs and in-person at stores to authorize debit card transactions. Your CID is a fixed code printed on your card that you use for online and phone purchases. They serve different purposes and are not interchangeable.
Can someone use my card if they know my CID but not my full card number?
No. The CID alone is useless without the card number. A fraudster needs both your 15- or 16-digit card number and your CID to attempt a remote purchase. This is why the CID is printed separately from the number — to prevent someone from copying both pieces of information at once.
Do I need to enter my CID for in-person purchases?
No. When you swipe, insert, or tap your card at a physical store, the merchant does not ask for your CID. The card itself proves you have it. The CID is only required for card-not-present transactions: online shopping, phone orders, and mail orders.
What should I do if I see an unfamiliar CID charge on my statement?
You will not see the CID itself listed on your statement — it is not displayed there for security reasons. If you see a charge you do not recognize, contact your card issuer and report it as potentially fraudulent. They will investigate the transaction and can reverse it if it was unauthorized.
Does my CID expire before my card does?
No. Your CID remains valid for the entire life of the card. It only changes when you receive a new physical card. If your card expires in 2026, your CID will work until that expiration date, at which point you will receive a new card with a new CID.