CID is the three or four-digit security code printed on your card, not stored in the magnetic stripe
CID stands for Card Identification Data, though you may also see it called CVV (Card Verification Value), CVV2, CVC (Card Verification Code), or CSC (Card Security Code). The name varies by card issuer, but they all mean the same thing: the security code you see printed on the back or front of your physical card.
The reason this code exists is simple: when you give your card number to someone over the phone or online, they can't see the card itself. The CID proves you actually have the card in your hand. A thief who steals your card number from a data breach won't have this code unless they also have the physical card or a photo of it.
The code is printed on the card but never stored in the chip or magnetic stripe. This means a merchant who swipes or dips your card can't read the CID from the card itself — you have to tell them what it is. That separation is intentional and makes the code harder to steal in bulk.
Key Takeaways
- CID is the three or four-digit security code on your card that you enter when shopping online or by phone to prove you have the physical card.
- The code is printed on the card but not stored in the chip or stripe, so merchants can't read it automatically during a transaction.
- Never share your CID with anyone except the merchant you are actively paying, and never enter it on a website you don't trust.
- If your card is lost or stolen, call your card issuer immediately to report it; the CID alone cannot be used to make purchases without the card number.
Where the CID appears on your card
For Visa, Mastercard, and Discover cards, the CID is a three-digit code printed on the back of the card, usually to the right of the signature panel. For American Express cards, it is a four-digit code printed on the front, above the card number on the right side.
The position matters because it tells you where to look when a merchant asks for it. If you're entering it online, you'll see a field labeled "CVV," "CVC," "Security Code," or "Card Code." The merchant is asking for the same number, just using a different name for it.
Why merchants ask for the CID
When you shop in a store and insert or tap your card, the merchant's terminal reads the chip or stripe and can verify the card is real. But when you shop online or by phone, the merchant never touches your card. They only have the card number you typed or said aloud.
Asking for the CID is a way to check that you actually have the card. If a thief has only your card number (from a stolen receipt, a data breach, or a skimming device), they won't have the CID unless they also have the physical card or a photo of it. This extra step stops many fraudulent purchases before they happen.
The CID is not a perfect security tool — a determined thief with a photo of your card can use both the number and the code. But it does raise the bar and catches casual fraud.
What to do if someone asks for your CID
Only enter your CID when you are actively making a purchase from a merchant you trust. This means a website with a secure checkout (look for "https://" in the address bar and a lock icon), a phone call you initiated to a company you know, or a store where you're handing your card to a cashier.
Never give your CID to someone who calls you, texts you, or emails you asking for it. Your card issuer will never ask for your CID this way. If someone claiming to be from your bank or credit card company contacts you asking for security information, hang up and call the number on the back of your card to verify.
Do not take a photo of your card and send it to anyone, and do not write your CID down and leave it lying around. Treat it the same way you treat your PIN — as a secret that only you should know.
CID versus other card security features
Your card has several layers of security, and the CID is just one of them. The chip in your card (if you have one) creates a unique code for each transaction, making it nearly impossible for a thief to reuse a stolen transaction. The magnetic stripe has a similar feature called a security code, though it is weaker than the chip.
Your card issuer also watches for unusual activity. If you live in New York and someone tries to use your card in Tokyo an hour later, the issuer's fraud detection system will usually catch it and block the transaction. You may then receive a call or text asking you to confirm the purchase.
The CID is the one security feature you control directly. The chip and fraud detection happen behind the scenes. This is why merchants ask for the CID during online and phone purchases — it's the only verification they can do without the card itself.
What happens if your card is lost or stolen
If your card goes missing, call your card issuer right away. The phone number is on your statement or on the issuer's website. Your issuer will cancel the card and send you a new one with a new CID.
A thief who has only your card number and CID cannot make purchases without the card itself, because modern merchants require the card to be present (either physically or as a chip read). However, if a thief has a photo of your card or the physical card, they can use both the number and the CID to shop online.
This is why speed matters. The sooner you report the card missing, the sooner your issuer can block it and stop any fraudulent charges. Most card issuers have zero-liability policies, meaning you won't be charged for fraudulent purchases made after you report the card lost, but you do need to report it.
CID and data breaches
When a retailer's database is hacked and card numbers are stolen, the CID is usually not included in the breach. This is because merchants are not supposed to store the CID after a transaction is complete. Payment processors are required by law to delete it.
If a merchant does store your CID, they are violating the Payment Card Industry Data Security Standard (PCI DSS), a set of rules that all businesses handling card data must follow. This is one reason why large data breaches often include card numbers but not security codes — the codes were never stored in the first place.
That said, if a thief gets a photo of your card or steals the physical card, they will have the CID. This is why you should never leave your card unattended and should keep photos of your card secure.
Frequently Asked Questions
Can someone use my card number without the CID?
In a store with a chip reader, yes — the merchant doesn't need the CID because they can read the chip. Online or by phone, most merchants will ask for the CID before processing the payment. Some older or less secure websites may not ask for it, which is a red flag that you should not shop there.
Is it safe to enter my CID on any website?
Only on websites you trust and that use secure checkout. Look for "https://" in the address bar and a lock icon. If you're unsure about a website, don't enter your card information. You can also use a virtual card number or a digital wallet like Apple Pay or Google Pay, which don't expose your full card details.
What if I forget my CID?
Look at the back of your card (or front, if it's American Express). If you don't have the card with you, you can call your card issuer and they can help you, though they may not read the code aloud for security reasons. You can also log into your online account with your issuer — some show the CID there.
Does the CID change if I get a new card?
Yes. Every time your card issuer sends you a new card, it will have a new CID printed on it. This is true even if you're just getting a replacement for a damaged card, not a new account.
Can I use my card online without entering the CID?
Some websites and digital wallets don't ask for the CID, especially if you've saved your card information with them before. However, the first time you use a card on a new website, most will ask for it. If a site never asks for the CID, it may not be secure.