CID is a three or four-digit security code printed on your card, separate from your account number
CID stands for Card Identification Data, though you may also see it called CVV (Card Verification Value), CVV2, CVC (Card Verification Code), or CID2 depending on which card network issued your card. It is the small number on the back of your card — or sometimes the front, for American Express — that merchants ask for when you pay online or over the phone.
The code exists to prove you physically have the card in your hand. When you type it in during an online purchase, the merchant sends it to your card network to verify. If the number matches what the network has on file, the transaction moves forward. If it does not match, the purchase is declined. This is why a thief who steals your card number alone cannot easily use it online — they would need the CID as well.
The CID is not the same as your PIN (Personal Identification Number), which you use at ATMs and in-person at checkout terminals. It is also not your account number. Those three pieces of information do different jobs.
Key Takeaways
- CID is the three or four-digit security code on your card that proves you physically possess it when you pay online or by phone.
- Visa and Mastercard print a three-digit code on the back; American Express prints a four-digit code on the front.
- You should never give your CID to anyone who calls you or emails you, even if they claim to represent your bank or card issuer.
- If your card is lost or stolen, contact your card issuer when ready — they can cancel the card and issue a replacement with a new CID.
- Merchants are not supposed to store your CID after a transaction, so it cannot be stolen from a retailer's database the way a card number can.
Where the CID appears on different card types
Visa and Mastercard print the CID on the back of the card, in or near the signature panel. It is the last three digits of a longer number. American Express prints a four-digit code on the front of the card, above the account number on the right side.
Discover cards also use a three-digit code on the back, positioned similarly to Visa and Mastercard. If you have multiple cards from different networks, you will find the code in slightly different places, but the principle is the same: it is printed on the physical card and nowhere else.
Why merchants ask for your CID
Online and phone transactions are called "card-not-present" purchases because the merchant cannot see or swipe your physical card. Without the CID, a thief who obtained your card number through a data breach could make purchases when ready. The CID adds a second layer of verification that only someone holding the actual card would know.
This is why the CID requirement has become standard for online shopping, subscription services, and phone orders. It is a straightforward fraud check that catches many unauthorized transactions before they go through. The card network verifies the CID in real time and tells the merchant whether it matches — the merchant never sees whether you entered it correctly, only whether the network approved the transaction.
What to do if someone asks for your CID over the phone or email
Do not give it to them. Your bank or card issuer will never call or email you asking for your CID, your PIN, or your full account number. Scammers use this tactic regularly, claiming there is a problem with your account or a suspicious charge that needs verification.
If you receive such a call or email, hang up or delete it when ready. If you are concerned about your account, call the number on the back of your card — the official customer service number — and ask about the issue yourself. This way you know you are speaking to your actual card issuer, not someone pretending to be.
The same rule applies to text messages. Legitimate card issuers do not ask for security codes via text. If you receive one, report it to your card issuer using the number on your card.
How the CID protects you from fraud
Because the CID is printed on the card and not stored in the magnetic stripe or chip, a thief who skims your card number at a gas pump or restaurant cannot get the CID at the same time. They would need to physically see or photograph your card to obtain it. This makes online fraud significantly harder for criminals working with stolen card numbers alone.
Merchants are also required by payment networks not to store your CID after a transaction is complete. This means even if a retailer's database is hacked, the thief cannot retrieve CID codes the way they can retrieve card numbers. The code is meant to be used once and then discarded.
What happens if your card is lost or stolen
Contact your card issuer when ready using the number on your statement or the back of another card you have. Tell them your card is lost or stolen. They will cancel it right away, which means the CID on that card becomes useless — even if someone has your card number and CID, the card network will reject any transaction because the card itself is no longer active.
Your issuer will mail you a replacement card with a new account number and a new CID. This usually takes five to ten business days. In the meantime, you can still use your account for online purchases if your issuer offers a temporary card number or digital wallet option.
CID versus other card security features
The CID is one layer of fraud protection, but not the only one. Your card also has a chip (if it is a newer card) that creates a unique code for each transaction, making it much harder to counterfeit than the old magnetic stripe. You also have your PIN for in-person purchases, and your card issuer monitors your account for unusual spending patterns.
Together, these features make it difficult for a thief to use a stolen card number for long. The CID stops many online fraud attempts before they happen. The chip stops counterfeit cards at checkout. Your PIN stops someone from using a lost card in a store. And your issuer's fraud detection catches what slips through.
Frequently Asked Questions
Is my CID the same as my CVV?
Yes. CVV, CVC, CID, and CID2 are all names for the same three or four-digit security code. Different card networks and issuers use different names, but they all refer to the printed code on your card that you enter for online purchases.
Can I use my card online without entering the CID?
Most online retailers require it, but some do not — particularly if you have saved your card information with them before or if you are using a digital wallet like Apple Pay or Google Pay. Digital wallets use different security methods and do not require you to enter the CID manually.
What if I enter the wrong CID by accident?
The transaction will be declined. You can try again with the correct code. Entering the wrong CID a few times will not hurt your credit or lock your account, but repeated failed attempts may trigger a fraud alert from your issuer.
Should I write my CID down somewhere for safekeeping?
No. Write down your account number and customer service phone number if you want a backup, but keep your CID only on the physical card. If you write it down, you defeat the purpose of having a separate security code.
Can someone use my card if they have my number but not my CID?
They can try to use it in person or at retailers that do not require a CID, but most online purchases will be blocked. In-person fraud is also caught by the chip on your card and by your PIN requirement, so the CID is just one of several protections working together.