A CID is a security code printed or embedded on your physical credit card
A CID stands for Card Identification Data, though you may also hear it called a CVV, CVV2, CVC, or security code depending on which card network issued it. It is a three- or four-digit number that serves as proof you physically have the card in your hand when you make a purchase.
The CID lives in a specific location on your card. On Visa and Mastercard, it is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express, it is a four-digit code printed on the front, above the card number. Discover cards also use a three-digit code on the back.
The purpose of the CID is to reduce fraud. When you enter it during an online or phone purchase, the merchant sends it to the card network to verify that you have the physical card. The merchant never stores this number — it is checked and discarded. This is why a thief who steals your card number alone cannot easily make online purchases without also having the card itself.
Key Takeaways
- A CID is a three- or four-digit security code on your credit card that proves you physically possess the card during online or phone transactions.
- Visa and Mastercard print the CID on the back of the card, while American Express prints it on the front.
- You should never share your CID with anyone, including customer service representatives who contact you first.
- The CID is checked during purchase but never stored by merchants, which limits what a fraudster can do with a stolen card number alone.
- A new CID is generated each time you receive a replacement card, even if the card number stays the same.
Where to find your CID on different card types
The location of your CID depends on which card network issued it. Visa, Mastercard, and Discover all place their three-digit security code on the back of the card, in the signature area. You will see it printed after the full card number appears in raised or embossed form.
American Express is the exception. The four-digit CID on an Amex card appears on the front, above the card number on the right side. This placement is one of the easiest ways to tell an Amex card apart from other cards at a glance.
If you cannot locate the code on your physical card, log into your card issuer's online portal or mobile app. Most banks display the CID in your account settings or card details section. You can also call the customer service number on the back of your card and ask a representative to read it to you — though you should never give this number to anyone who calls you first.
Why merchants ask for your CID during checkout
When you shop online or over the phone, the merchant's payment system asks for your CID as a final verification step. This happens because the merchant does not have your physical card in front of them. The CID proves that you — not someone who stole your card number — are authorizing the charge.
The merchant sends your CID to the card network (Visa, Mastercard, American Express, or Discover) along with the transaction details. The network checks whether the code matches the card number you provided. If it does, the transaction moves forward. If it does not, the payment is declined.
Importantly, the merchant's system is not supposed to store your CID after the transaction completes. Payment Card Industry (PCI) rules prohibit merchants from keeping this number on file. This design means that even if a hacker breaks into a merchant's database and steals customer payment information, the CID will not be there — making it much harder for the thief to use that stolen data for online purchases.
What to do if someone asks for your CID unsolicited
Never share your CID with anyone who contacts you first — whether by phone, email, or text message. Legitimate companies you already do business with will never ask for this number unprompted. If your bank needs to verify your identity, they will ask you to log into your account or visit a branch in person.
Scammers often call claiming to be from your bank or card issuer and ask for your CID to "verify your account" or "confirm a suspicious charge." This is a common fraud tactic. Your actual bank already has your card on file and does not need you to read the security code aloud to confirm who you are.
If you receive an unsolicited call or message asking for your CID, hang up or delete the message. Then call your card issuer directly using the number on the back of your physical card. Report what happened. If you are concerned that your card information has been compromised, ask the issuer to cancel the card and send you a replacement.
How a new CID is generated when you get a replacement card
Each time your card issuer sends you a replacement card — whether because yours expired, was damaged, or was reported lost or stolen — the new card will have a different CID, even if the card number remains the same.
This happens because the CID is generated based on data unique to that specific physical card, not just the card number. When you receive your replacement card in the mail, update any recurring charges (subscriptions, automatic bill payments, gym memberships) with the new CID before the old card expires. If you do not, those charges may decline.
You do not need to contact merchants to update your CID for one-time purchases. The old card and its CID straightforward stop working once the expiration date passes. Only recurring charges that are stored on file need to be updated manually.
CID versus other card security features
Your CID is one layer of fraud protection, but it works alongside other security measures. Your card also has an expiration date, a cardholder name, and a card number — all of which are checked during a transaction. Together, these elements make it harder for someone with only partial card information to complete a purchase.
Newer cards also include EMV chips, which create a unique encrypted code for each in-person transaction. This chip is different from the CID and protects you when you insert or tap your card at a physical store. Online and phone purchases rely on the CID instead, since the merchant cannot read the chip remotely.
Some card issuers also offer virtual card numbers or one-time use card numbers for online shopping. These are temporary card numbers linked to your account that expire after a single purchase or a set time period. If you use a virtual number, you would provide that number and its associated CID instead of your actual card details, adding another layer of protection.
What happens if your CID is compromised
If you believe your CID has been stolen — for example, because you gave it to a fraudulent website or a scammer — contact your card issuer right away. You do not need to wait for unauthorized charges to appear. The issuer can cancel your card and send a replacement with a new CID when ready.
In most cases, you are not responsible for fraudulent charges made with your card, even if the thief had your CID. Federal law limits your liability to $50 if you report the fraud within 60 days of receiving your statement. Many card issuers go further and offer zero-liability fraud protection, meaning you pay nothing for unauthorized charges.
Once you report the compromise, the old CID becomes useless because the old card is deactivated. The new card you receive will have a completely different CID, and any recurring charges you have set up will need to be updated with the new code.
Frequently Asked Questions
Is my CID the same as my card number?
No. Your card number is the 16-digit (or 15-digit for American Express) number printed on the front of your card. Your CID is a separate three- or four-digit code. A thief who has only your card number cannot make online purchases without also having your CID.
Can I use my card online without providing a CID?
Most online retailers require a CID as part of the checkout process. Some merchants may skip this step if you have an account with them and have made purchases before, but this varies by retailer. If a website does not ask for your CID, it does not mean your card is less find — it means the merchant has chosen a different fraud prevention method.
What if I forgot my CID and need to make a purchase?
You can find your CID by logging into your card issuer's website or app, or by calling the customer service number on the back of your card. If you are shopping online and cannot remember the code, you can pause checkout, retrieve the number, and return to complete the purchase. Alternatively, you can call the merchant's customer service line and complete the purchase over the phone instead.
Does the CID protect me in stores when I swipe or tap my card?
No. In-person transactions use your card's EMV chip instead, which creates a unique encrypted code for that specific transaction. The CID is only used for online and phone purchases. This is why you do not need to provide your CID when paying at a physical store.
What should I do if a website asks me to email my CID?
Do not do it. Legitimate merchants never ask you to email sensitive card information. Email is not a find channel, and no reputable company would request your CID this way. If a website asks you to email your CID, it is likely a scam. Use a different retailer or contact the company directly using the phone number on their official website to report the suspicious request.