What the CID Number on Your Credit Card Actually Does
The CID is a three- or four-digit security code printed on your card that proves you physically hold it
The CID (Card Identification Data) is the small number on the back of your credit card — usually three digits, sometimes four on American Express. It sits separately from your card number and expiration date. When you type it into an online checkout or give it over the phone, you are telling the merchant "I have this card in my hands right now," which makes fraud harder.
The CID is not stored in the card's magnetic stripe or chip. It only appears printed on the physical card itself. This matters because a thief who steals your card number online cannot use it without also having the card in front of them to read this code. It is one layer of protection, not the only one.
Different card companies call it different names — Visa and Mastercard call it the CVV (Card Verification Value), American Express calls it the CID, and Discover calls it the CVC (Card Verification Code). They all work the same way. For this guide, we will use CID as the general term.
Key Takeaways
- The CID is a three- or four-digit code printed on the back of your card that you enter during online purchases to prove you physically have the card.
- The CID is never stored in your card's chip or magnetic stripe, so thieves cannot steal it from a data breach the way they steal card numbers.
- You should never give your CID to anyone who calls you or emails you, even if they claim to be from your bank.
- Merchants are not supposed to store your CID after a transaction, so if a website gets hacked, the CID should not be exposed.
Where the CID appears on your card
On Visa, Mastercard, and Discover cards, the CID is printed on the back, usually to the right of the signature panel. It is the last three digits of a longer number. On American Express, it is on the front, above your card number, and it is four digits.
The CID is printed in a specific way — it is embossed or printed in a slightly raised or recessed format that is harder to counterfeit than regular printing. This physical detail is part of what makes it useful as a security check. If someone has photocopied your card number but does not have the actual card, they cannot read the CID accurately.
Why merchants ask for it during online purchases
When you shop online, the merchant cannot see your physical card. They cannot check whether it is real or whether you actually hold it. The CID is their way of confirming you do. If you can type in the correct three- or four-digit code, the merchant knows you have the card in front of you at that moment.
This check happens in real time. The payment processor verifies that the CID matches the card number you entered. If it does not match, the transaction is declined. A thief who has only your card number — stolen from a data breach or phishing email — cannot complete a purchase without also guessing or obtaining the CID.
Phone and mail orders also ask for the CID for the same reason. It is a quick way to confirm you are the person making the purchase, not someone who found your card number.
What the CID does not protect against
The CID protects against remote fraud — someone using your card number without having the card. It does not protect you if someone steals the physical card itself. If a thief has your card in hand, they have the CID too, and they can use it to make purchases in person or online.
The CID also does not protect against fraud at the point of sale. If you hand your card to a cashier or waiter, they see both your card number and your CID. A dishonest employee can write down or photograph both. This is why many people prefer to use contactless payment or chip readers when possible — the merchant never sees the full card number or CID.
If your card number is stolen but the CID is not, you are in a better position than if both were stolen. But the CID alone is not a complete security system. Your card issuer also monitors for unusual activity and can reverse fraudulent charges.
Never share your CID over the phone or email
Your bank will never call you and ask for your CID. Your card issuer already has this information on file — they printed it on your card. If someone calls claiming to be from your bank and asks for your CID, it is a scam. Hang up and call your bank directly using the number on the back of your card.
The same rule applies to email. Legitimate companies do not ask for security codes by email. If you receive an email asking you to "verify" your card by providing the CID, delete it. It is phishing.
The only time you should enter your CID is when you are making a purchase on a website you trust, or when you are calling a merchant directly to place an order. Even then, make sure you initiated the contact, not the other way around.
What happens to your CID after you use it
By law, merchants are not supposed to store your CID after a transaction is complete. The payment processor checks it and then discards it. This is different from your card number, which merchants may store (with your permission) to make future purchases faster.
Because the CID is not stored, it cannot be stolen in a data breach the way a card number can. If a website gets hacked, the thief may get your card number and expiration date, but not your CID. This is one reason the CID is useful — it is a piece of information that exists only on your physical card and in your card issuer's system, nowhere else.
Some payment services, like subscription services or stored payment methods, may ask you to save your CID. Be cautious about this. Only save it with services you trust completely, and only if you plan to use that card repeatedly with them.
CID versus other card security features
The CID is one of several tools that protect your card. Your card also has a chip (if it is a newer card) that creates a unique code for each transaction, making it harder to counterfeit. Older cards have a magnetic stripe, which is less secure. Your card issuer also monitors for fraud patterns — unusual purchases in unusual locations trigger alerts.
When you use your card in person at a chip reader, you do not need to provide a CID. The chip does the security work. When you use contactless payment (tapping your card or phone), the same thing happens. The CID is mainly for online purchases, phone orders, and mail orders — situations where the merchant cannot read your chip or see your card.
If you are concerned about fraud, the CID is useful but not foolproof. The best protection is monitoring your statements regularly, setting up fraud alerts with your card issuer, and using strong passwords on accounts where you store payment information.
Frequently Asked Questions
Can someone use my card if they have my card number but not my CID?
They can try to use it in person at a store, but most in-person transactions use your chip or contactless payment, which do not require the CID. Online, they would be blocked because the payment processor requires a matching CID. Over the phone, they could potentially complete a purchase if the merchant does not ask for the CID, but most do.
What should I do if I think my CID has been compromised?
Contact your card issuer and request a new card. They will send you a replacement with a new CID. You do not need to wait for fraud to occur. If you believe your card information has been exposed, a new card is the fastest solution.
Is it safe to type my CID into a website?
It is safe if the website is legitimate and uses a secure connection. Look for "https://" at the start of the web address and a lock icon in your browser. Never enter your CID on a website you do not recognize or that looks suspicious. If you are unsure, call the merchant directly using a phone number from their official website.
Why does American Express put the CID on the front instead of the back?
American Express places the four-digit CID on the front of the card as part of their card design. It serves the same purpose as the three-digit code on the back of other cards. The location does not change how it works or how secure it is.
Can I use my card online without providing a CID?
Some websites do not ask for it, especially if you have used that card with them before or if you are using a digital wallet like Apple Pay or Google Pay. However, most online retailers ask for the CID as a standard security step. If a site does not ask for it, that does not mean it is unsafe — it just means they are using other verification methods.