CID is the three or four-digit security code printed on your card
CID stands for Card Identification Data, though you may also see it called CVV (Card Verification Value), CVV2, CVC (Card Verification Code), or CSC (Card Security Code). The terms are used interchangeably by different card issuers. It is the small number printed on the back of your card — three digits for Visa, Mastercard, and Discover, or four digits for American Express (which prints it on the front).
The CID exists to verify that you physically have the card when you make an online or phone purchase. When you enter it during checkout, the merchant sends it to your card issuer, who checks whether it matches the code on file. If it does not match, the transaction is declined. The issuer never stores the CID after the transaction, so even if a merchant's database is breached, the thief cannot use a stolen CID to make purchases elsewhere.
You should never share your CID with anyone except during a legitimate purchase with a merchant you trust. It is not the same as your PIN (Personal Identification Number), which you use at ATMs and in-person. Your PIN is encrypted and stored; your CID is not.
Key Takeaways
- CID is the three or four-digit code on the back (or front, for American Express) of your card that merchants ask for during online and phone purchases.
- The code verifies that you have the physical card; the issuer checks it against the code on file and then discards it rather than storing it.
- You should only enter your CID during a purchase with a merchant you recognize, never in response to an unsolicited email or phone call.
- If someone asks for your CID over the phone or email without you initiating the transaction, it is a sign of fraud or a scam.
Where the CID appears on different card types
Visa, Mastercard, and Discover cards print the CID on the back, usually to the right of the signature strip. It is the last three digits of a longer number. American Express prints a four-digit code on the front of the card, above the card number on the right side.
Some older cards or specialty cards may not have a visible CID printed at all. If your card does not have one, you can call the customer service number on the back of your card to request the code. The issuer will verify your identity and provide it over the phone.
Why merchants ask for the CID during checkout
When you shop online or by phone, the merchant cannot physically see your card or verify your signature. The CID is one way they confirm you have the card in your possession. Without it, a thief who has only your card number and expiration date could make purchases.
The CID is not required for in-person purchases because the cashier can see the card and check your signature or ID. It is also not required for recurring charges (like a subscription or automatic bill payment) after the first transaction, because the merchant already verified you had the card when you set up the recurring payment.
Some merchants, particularly those selling high-value items or operating in high-risk categories, may decline a transaction if the CID does not match — even if the card number and expiration date are correct. This protects both the merchant and your account from fraud.
The difference between CID and other card security features
Your card has several numbers on it, and it is important to know which is which. The card number itself (usually 16 digits) is what identifies your account. The expiration date tells the merchant when the card expires. The CID is separate from all of these and serves only to verify you have the physical card.
Your PIN is different again. It is a number you create or receive from your issuer, and you use it at ATMs and when you pay in person at some retailers. The PIN is encrypted and stored in the issuer's system. The CID is not stored after the transaction, which is why it is safer to share during a purchase than your PIN would be.
Some cards also have a hologram or other physical security feature on the front or back. These are harder to counterfeit but do not serve the same verification purpose as the CID during online or phone transactions.
What to do if your CID is compromised
If you believe your CID has been compromised — for example, if you gave it to someone you did not trust or if you see unauthorized charges on your statement — contact your card issuer immediately. You do not need to wait for a statement to arrive; call the customer service number on the back of your card or log into your online account.
Your issuer can cancel your current card and issue a new one with a different CID. The new card will have a new number, expiration date, and CID, so the old information will no longer work. There is no charge for this replacement, and it usually arrives within 7 to 10 business days.
If you see fraudulent charges, report them to your issuer at the same time. Most card issuers offer fraud protection that limits your liability for unauthorized charges, though the specifics vary by issuer and card type. You may be asked to sign an affidavit stating that you did not authorize the charges.
When you should and should not share your CID
You should share your CID only when you are making a purchase with a merchant you initiated contact with — for example, when you are checking out on a website you navigated to yourself, or when you called a company to place an order. In these cases, the merchant needs the CID to process your payment.
You should never share your CID in response to an unsolicited email, text, or phone call, even if the message appears to come from your card issuer or a company you do business with. Legitimate companies will never ask for your CID by email or phone. If you receive such a request, it is a phishing attempt or scam. Do not respond; instead, hang up or delete the message, then call the company directly using the number on your card or statement.
Do not write your CID down or store it in your phone, email, or computer. The only place it should exist is on your physical card. If you need to reference it during a purchase, look at the card itself rather than relying on a saved copy.
How issuers protect the CID on their end
Card issuers are required by payment industry standards (called PCI DSS, or Payment Card Industry Data Security Standard) not to store the CID after a transaction is complete. This means that even if a hacker breaks into the issuer's system, they cannot retrieve CIDs for past transactions.
Merchants are also prohibited from storing your CID. If a merchant's database is breached and your card number is stolen, the thief cannot use it for online purchases without the CID — and the CID will not be in the stolen data because the merchant never kept it.
This design is one reason why the CID is considered more secure than your card number alone. Your card number can be used for in-person fraud if someone has a physical counterfeit card, but the CID cannot be counterfeited or reused because it is verified in real time against the issuer's records and then discarded.
Frequently Asked Questions
Is my CID the same as my PIN?
No. Your CID is the three or four-digit code printed on your card that you enter during online or phone purchases. Your PIN is a separate number you create or receive from your issuer, used at ATMs and in-person at some retailers. The PIN is encrypted and stored; the CID is not.
What happens if I enter the wrong CID during a purchase?
The transaction will be declined. The merchant will ask you to re-enter it or will cancel the order. If you repeatedly enter an incorrect CID, your card issuer may temporarily block the card to prevent fraud. Check that you are reading the correct digits from your card — the CID is separate from your card number and expiration date.
Can someone use my card number without the CID?
For online and phone purchases, no — most merchants require the CID. For in-person purchases, a thief would need a physical card or a counterfeit, not just the number. However, some older merchants or subscription services may not require a CID, so it is still important to monitor your statement for unauthorized charges.
Do I need to memorize my CID?
No. You should look at your physical card each time you need it rather than memorizing or writing it down. This reduces the risk that someone will see or intercept the number. The only exception is if you use the same merchant repeatedly and they store your card on file after the first purchase — but even then, you should not write it down.
What if my card does not have a CID printed on it?
Call your card issuer's customer service number on the back of your card. They will verify your identity and provide your CID over the phone. You can then use it for online and phone purchases. Some older or specialty cards may not have a printed CID, but your issuer can always provide one.