A CID is a security code printed on your card that proves you physically have it
A CID stands for Card Identification Data, and it's the three or four-digit number on your credit card that you enter when you shop online or over the phone. It's also called a CVV (Card Verification Value), CVV2, CVC (Card Verification Code), or security code — different card companies use different names for the same thing. The number sits on the back of most cards, usually after the last four digits of your card number, though American Express prints it on the front.
The CID exists to prove you actually have the physical card in your hand. When you type it in during an online purchase, you're telling the merchant "I have this card right now." A thief who only has your card number — stolen from a data breach or skimming — won't have the CID unless they also have the card itself. This makes online fraud harder, though not impossible.
The CID is not the same as your PIN (the number you enter at an ATM or store terminal). Your PIN is for in-person transactions where you're using a debit card or withdrawing cash. The CID is only for remote purchases — online, by phone, or by mail.
Key Takeaways
- A CID is the three or four-digit security code on your credit card that you enter for online and phone purchases.
- Different card companies call it different names: CVV, CVV2, CVC, or security code, but they all mean the same thing.
- The CID proves you have the physical card, which makes it harder for someone with only your card number to commit fraud.
- You should never share your CID with anyone except the merchant you're paying, and legitimate companies will never ask for it by email or phone.
- Your card issuer cannot see your CID after you enter it, so they cannot retrieve it for you if you forget it.
Where to find your CID on your card
On Visa, Mastercard, and Discover cards, the CID is a three-digit number printed on the back of the card, to the right of the signature strip. It comes after the last four digits of your card number. Look at the back of your card and you'll see a long string of numbers — the CID is the short one at the end.
American Express is different. The CID on an Amex card is a four-digit number printed on the front, above the card number on the right side. If you're shopping online and the form asks for a three-digit code but you have an American Express card, enter only the first three digits of the four-digit code.
If your card is new or you've had it replaced, the CID will be different from your old card's CID. Each physical card gets its own code. If you order a replacement card because yours was lost or damaged, the new card will have a new CID printed on it.
Why merchants ask for your CID during checkout
When you buy something online or over the phone, the merchant asks for your CID to verify that you have the card. Without it, they have no way to know whether you're the real cardholder or someone who stole your card number. The CID is one of the main fraud-prevention tools available to merchants who can't see you in person.
The merchant sends your CID to your card issuer (your bank or credit card company) along with your card number and the purchase amount. The issuer checks whether the CID matches the one on file for that card. If it does, the transaction is approved. If it doesn't, the transaction is declined. This happens in seconds, behind the scenes.
Importantly, your card issuer does not store your CID after the transaction. They use it to verify the purchase and then discard it. This is by law — merchants and payment processors are not allowed to save your CID. If a merchant stores it, they're breaking the rules and putting your card at risk.
How to protect your CID from fraud
Treat your CID like you treat your card number — keep it private. Never share it with anyone except a merchant you're actively paying. Legitimate companies will never ask for your CID by email, text, or phone. If someone contacts you claiming to be from your bank or a store and asks for your CID, it's a scam. Hang up or delete the message.
When you shop online, only enter your CID on a secure website. Look for the padlock icon in your browser's address bar, which means the site is encrypted. If you're on a public Wi-Fi network, avoid entering your CID — wait until you're on a private network at home. Public Wi-Fi is easier for hackers to intercept.
If your card is lost or stolen, call your card issuer right away. They will cancel the card and send you a replacement with a new CID. Until the replacement arrives, your old CID is useless because the card is no longer active.
What happens if you forget your CID
If you forget your CID, you have the card in your hand — just look at the back (or front, if it's an American Express card). The code is printed right there. You don't need to call your bank or look it up online.
If you can't find your card or the number is worn off and unreadable, contact your card issuer. They cannot tell you what your CID is because they don't store it. However, they can send you a replacement card with a new CID printed on it. This usually takes five to ten business days.
If you're in a hurry and need to make a purchase before the replacement arrives, you have a few options. You can use a different payment method, ask the merchant if they accept payment by phone (though you'll still need the CID), or wait for the new card. Some merchants also accept digital wallet payments like Apple Pay or Google Pay, which don't require you to enter the CID manually.
CID versus other card security features
Your CID is one layer of fraud protection, but it's not the only one. Your card also has an expiration date, which tells merchants when the card expires. Your card number itself is unique to you. Your name is printed on the card. Together, these pieces of information are supposed to prove you're the real cardholder.
Newer cards also have a chip (an embedded microchip on the front of the card). When you insert a chip card into a reader at a store, the chip creates a unique code for that transaction. This code is different every time, so even if a thief intercepts it, they can't reuse it for another purchase. The chip is more secure than the magnetic stripe on the back of older cards, which stores the same information every time and is easier to clone.
Online, you might also encounter 3D Secure, a system that adds an extra step to checkout. When you use 3D Secure, your bank sends you a code by text or email, and you enter that code to complete the purchase. This proves you have access to your phone or email, adding another layer of verification beyond just the CID.
Frequently Asked Questions
Can someone use my card number without the CID?
It's harder, but not impossible. A thief with only your card number can't complete most online purchases because the merchant will ask for the CID. However, they might be able to use it for in-person fraud at a store that doesn't check the CID, or they might try to use it at a merchant with weak security. This is why you should monitor your card statement regularly and report any unauthorized charges.
Is it safe to give my CID to a website I've never used before?
Only if the website is secure and legitimate. Look for the padlock icon in your browser's address bar and check that the website address starts with "https://" (the "s" means secure). Read reviews of the website before you shop. If something feels off — the site looks poorly made, the prices seem too good to be true, or you can't find contact information — don't enter your card information.
What if I see a charge on my statement that I don't recognize?
Contact your card issuer right away. Tell them the date, amount, and merchant name of the charge. Your issuer will investigate and may reverse the charge while they look into it. You're not responsible for unauthorized charges, but you need to report them within a certain time frame — usually 60 days. Check your card's terms for the exact deadline.
Do I need to memorize my CID?
No. Your CID is printed on your card, so you can look it up whenever you need it. You should never write it down or save it in your phone, email, or computer. The only time you should type it in is during an actual purchase, and you should delete it from your browser's memory after you're done shopping.
Why does my new card have a different CID than my old one?
Each physical card gets its own CID. When your card issuer sends you a replacement card — whether because yours expired, was lost, or was damaged — the new card has a new CID printed on it. This is normal and expected. If you have any recurring charges set up with your old card's CID, you'll need to update them with the new CID before your next billing cycle.