The CID is a three or four-digit security code printed on your card, separate from your card number
The CID (Card Identification Data) is the small number on the back of your credit card — usually three digits for Visa, Mastercard, and Discover, or four digits for American Express (which calls it the CVC). It sits apart from your card number and expiration date, printed directly on the card itself rather than embossed into it.
This code exists to verify that you physically hold the card when you make a purchase. When you enter it during an online transaction or give it to a merchant over the phone, the merchant sends it to your card issuer, who checks whether the number matches their records. If it does not match, the transaction is declined. The code is never stored in the merchant's system after the transaction completes — by design, it cannot be retrieved from a receipt or a database.
The CID is one layer of fraud prevention, but not the only one. It works alongside your card number, expiration date, and the merchant's own security systems. It does not protect you against someone who steals your physical card, because they have the CID too. It also does not protect you if your card number is compromised through a data breach — the thief would still need the CID to make online purchases.
Key Takeaways
- The CID is a three or four-digit code printed on your card that proves you physically hold it when making online or phone purchases.
- Merchants cannot store the CID after a transaction, so it does not appear on receipts or in their databases.
- You should never give your CID to anyone who calls you or emails you, even if they claim to represent your bank.
- The CID protects against some fraud scenarios but not others — it does not prevent theft of a physical card or protect a compromised card number alone.
- Different card networks use different names: Visa and Mastercard call it CVV, Discover calls it CID, and American Express calls it CVC.
Where the CID appears on different card types
The location and length of the security code varies by card network. On the back of Visa, Mastercard, and Discover cards, the three-digit code appears to the right of the signature strip, usually printed in a small box. On American Express cards, the four-digit code is on the front, above the card number on the right side.
Some cards issued by smaller banks or credit unions may print the code in a slightly different location, but the principle is the same: it is always printed on the card itself, never embossed. If you cannot find it, your card issuer's customer service line (the number on the back of your card) can tell you where to look or read it to you over the phone.
When you need to provide your CID and when you should not
You will need to enter your CID when you make an online purchase and the merchant's checkout page asks for it. You may also need to provide it over the phone if you are ordering from a catalog or calling a business directly. In both cases, you are initiating the transaction and you know who you are paying.
You should never give your CID to someone who calls you, texts you, or emails you — even if they claim to represent your bank or card issuer. Your bank already has your CID on file and will never ask you for it. Scammers use this tactic to collect the last piece of information they need to make fraudulent purchases. If someone contacts you asking for your CID, hang up or delete the message and call your card issuer directly using the number on the back of your card.
Similarly, do not enter your CID on a website unless you initiated the visit and the page is secure. Look for the padlock icon in your browser's address bar before entering any card information. If you are unsure whether a website is legitimate, close the page and contact the business directly using a phone number or website you find independently.
How the CID protects you — and what it does not protect against
The CID is designed to catch one specific type of fraud: someone who has your card number and expiration date but does not have the physical card. This might happen if your card number is stolen from a data breach or skimmed from a gas pump. When that person tries to make an online purchase, they will be asked for the CID and will not have it, so the transaction fails.
The CID does not protect you if someone steals your physical card, because they have the CID too. It also does not protect you against in-person fraud at a store or restaurant, because merchants are not required to ask for it in person. If your card is lost or stolen, contact your card issuer immediately — they can freeze the card and issue a replacement before fraudulent charges appear.
The CID also does not protect you against a compromised card number if the thief also has your CID. This can happen if your card information is stolen from a merchant's database that was not properly secured. In this case, the CID alone cannot stop the fraud. This is why your card issuer monitors your account for unusual activity and why you should review your statements regularly.
The difference between CID, CVV, and CVC
The three-digit code on the back of most credit cards is called different names depending on which card network issued it. Visa calls it the CVV2 (Card Verification Value 2). Mastercard calls it the CVC2 (Card Verification Code 2). Discover calls it the CID (Card Identification Data). American Express calls it the CVC (Card Verification Code) and uses four digits instead of three.
In everyday conversation, people often use CVV as a catch-all term for all of these codes, and most merchants' websites will accept that term regardless of which card network you are using. The function is identical across all card networks: it verifies that you hold the card. The name difference exists only because each network developed its own version of the technology.
What happens if you lose your CID or forget it
If you cannot see your CID because your card is damaged or worn, you can request a replacement card from your card issuer. You can usually do this through your online account or by calling the customer service number on the back of your card. A replacement card typically arrives within 7 to 10 business days.
If you forget your CID while making a purchase, you can look at your physical card or call your card issuer to ask them to read it to you. Your issuer will verify your identity before providing it. You can also check your card issuer's mobile app — many apps display your card details including the CID, though this varies by issuer.
Do not write your CID down and store it separately from your card. The whole point of the CID is that it is difficult for a thief to obtain. If you write it down, you defeat that purpose. If you need to reference it frequently, use your card issuer's app or call them when you need it.
How merchants handle your CID after you provide it
When you enter your CID during a transaction, the merchant's payment processor sends it to your card issuer for verification. The issuer checks whether the code matches their records and either approves or declines the transaction. The merchant never stores the CID in their system — this is required by payment card industry standards.
This is why your CID does not appear on your receipt, even if other card details do. It is also why a data breach at a merchant's company cannot expose your CID — they do not have it to steal. The only copy of your CID that exists outside your card is in your card issuer's secure database, and they use it only to verify transactions.
Some merchants may ask you to save your card information for future purchases. When you do this, the merchant stores your card number and expiration date but not your CID. If you make another purchase using the saved card, you will not be asked for the CID again — the merchant already has your card on file and the transaction is treated differently than a new purchase.
Frequently Asked Questions
Is my CID the same as my PIN?
No. Your PIN is a number you create and use at ATMs and in-person at stores to authorize debit card transactions. Your CID is a fixed number printed on your card that you use for online and phone purchases. They serve different purposes and are not interchangeable.
Can someone use my card number and expiration date without the CID?
Not for most online purchases. Most online merchants require the CID before they will process a transaction. However, some merchants — particularly subscription services or businesses you have shopped with before — may not ask for it on repeat purchases. This is why monitoring your statements for unauthorized charges is important.
What should I do if I think my CID has been compromised?
Contact your card issuer immediately and request a replacement card. A new card will have a new CID. You can usually do this by calling the number on the back of your card or through your online account. Your issuer can also review your recent transactions to check for fraud.
Do I need to provide my CID for in-person purchases at a store?
No. In-person transactions do not require a CID. The merchant swipes or inserts your card, and you may be asked to enter your PIN or sign a receipt. The CID is used only for online and phone purchases where the merchant cannot physically see your card.
Why is American Express's code four digits instead of three?
American Express uses a four-digit code because it includes additional security information beyond what Visa and Mastercard include in their three-digit codes. The extra digit makes it slightly harder to guess, though both three and four-digit codes serve the same purpose: verifying that you hold the card.