CID is a three- or four-digit security code printed on your card, separate from your card number

CID stands for Card Identification Data, though you may also hear it called CVV (Card Verification Value), CVV2, or CVC (Card Verification Code). It is the small number on the back of your card — or sometimes the front, depending on your card type — that exists for one reason: to prove you physically have the card when you are not swiping it in person.

When you shop online, over the phone, or through a mail order, the merchant cannot see your card. The CID is your proof that you have it. You type or speak it, the merchant sends it to your bank, and your bank checks whether that number matches what they have on file for your card. If it does not match, the transaction stops.

This matters because someone who has stolen your card number alone cannot use it online without the CID. They would need both pieces of information — and the CID is not printed on receipts, not stored in merchant databases (in theory), and not visible when someone looks at your card from the front.

Key Takeaways

  • CID is the three- or four-digit code on your card that proves you physically have it when shopping online or by phone.
  • Visa and Mastercard call it CVV2; American Express calls it CID and prints it on the front; Discover calls it CID and prints it on the back.
  • Never give your CID to anyone who calls you or emails you claiming to be your bank — your bank already has it.
  • If your card is lost or stolen, call your bank immediately; a new card will have a new CID, making the old one useless.

Where the CID appears on different card types

The location and name vary by card network. Visa and Mastercard print a three-digit code on the back of the card, usually to the right of the signature strip. They call it CVV2 or CVV, though many people just say "CVV" for any card. American Express prints a four-digit code on the front of the card, above the card number on the right side, and calls it CID. Discover prints a three-digit code on the back, like Visa and Mastercard, and also calls it CID.

The difference in length and location does not change what the code does — it is still a security check for remote transactions. The reason for the differences is historical: each network designed its system separately before the industry settled on common standards.

Why merchants ask for it and what they do with it

When you enter your CID during an online purchase, the merchant's payment system sends it to the card network (Visa, Mastercard, American Express, or Discover) along with your card number. The network checks whether the CID you provided matches the one on file for that card. The merchant never sees the actual CID — they only get back a yes or no answer.

This is why legitimate merchants will always ask for the CID but should never store it. If a merchant stores it, they are breaking the rules of the payment card industry, and if that merchant gets hacked, your CID could be exposed. In practice, some merchants do store it illegally, which is why you should never use the same card at a merchant you do not trust.

How to protect your CID

The simplest rule: never give your CID to anyone who contacts you. Not by phone, not by email, not by text. Your bank already has it. If someone claiming to be from your bank asks for it, hang up and call your bank directly using the number on the back of your card. Scammers often call pretending to be fraud investigators and ask for your CID to "verify" your account — this is a theft technique, not a security check.

When you shop online, only enter your CID on a website you trust and that shows a padlock icon in the address bar (meaning the connection is encrypted). If you are shopping on a public Wi-Fi network, use a virtual private network (VPN) if possible, though this is less critical for the CID than for your full card number because the CID alone is not enough to make a purchase.

If your card is lost or stolen, call your bank immediately. Your bank will cancel the card and issue a new one with a new CID. The old CID becomes useless because it no longer matches any card in the system.

CID versus other card security features

Your card has several security layers, and the CID is just one. Your card number itself is the primary identifier. Your name and expiration date are printed on the front. Your signature (or lack of one, on newer cards) is another check. Chip technology, which many cards now have, creates a unique encrypted code for each transaction, making it much harder to clone a card than it was when only the magnetic stripe existed.

The CID is specifically designed for remote transactions — online, phone, and mail order — where the merchant cannot see the physical card. In a store, when you swipe or insert your card, the merchant does not ask for the CID because they can see the card itself. This is why online fraud is a bigger risk than in-person fraud: the CID is your only proof of possession, and if someone has your card number and CID, they can shop online as if they were you.

What to do if your CID has been compromised

If you believe someone has your card number and CID — for example, if you entered it on a website that turned out to be fraudulent, or if a merchant you used was hacked — contact your bank immediately. Do not wait to see if fraudulent charges appear. Your bank can cancel the card and issue a replacement before any damage is done.

When you report the compromise, your bank will review recent transactions with you and dispute any charges you did not make. You are not responsible for fraudulent charges on a credit card, though you may have to sign a dispute form. The process usually takes a few weeks, but your bank will typically issue a temporary credit while they investigate.

After the card is replaced, monitor your credit report for a few months. You can check it free once a year at annualcreditreport.com, which is the official site run by the three major credit bureaus (Equifax, Experian, and TransUnion). If you see accounts or inquiries you did not authorize, report them to the bureau immediately.

Frequently Asked Questions

Can someone use my card if they have the number but not the CID?

Not for online purchases — the CID is required. They could potentially use it in person if they had a physical card, but if you report your card stolen, your bank will cancel it immediately. For phone orders, it depends on the merchant; some require the CID and some do not, which is why you should only give your card number to merchants you trust.

Is it safe to text my CID to a merchant?

No. Text messages are not encrypted, and your phone may store them. Only enter your CID on a secure website (look for the padlock icon) or read it aloud during a phone call to a merchant you called yourself — never to a number someone else gave you.

What if I forgot my CID and need to make an online purchase?

Look at the back of your card (or front if it is American Express). If you cannot find it, call your bank and they can read it to you over the phone. Do not use a card you cannot verify — if you have lost the card, report it and request a replacement.

Do I need to memorize my CID?

No. You should never memorize it or write it down. Look at your card each time you need it. The only person or system that should have your CID stored is your bank.

Why does American Express put the CID on the front instead of the back?

American Express designed its card security system before the industry standardized on back-of-card placement. The front placement does not make it less secure — the CID is still only useful for remote transactions, and it is still a four-digit code instead of three, which makes it slightly harder to guess.