Risk level: critical. Can you change it: yes. Found in 7 breaches in this directory.
What this data is
Your card number, usually with the expiry date and cardholder name, and sometimes the billing address. Some breaches hold only a partial number showing the last four digits.
The risk on its own
A full card number with its expiry date can be used at merchants that do not ask for the security code, and it can be sold to people who will try. If only the last four digits leaked, the risk is much lower: that fragment cannot be spent, but it is used to sound convincing on the phone. Check the breach description to see which you are dealing with.
The risk combined with other data
With your name, billing address and email, the card can pass address checks at online shops, and a scammer can ring you as your bank's fraud team with every detail correct. The last four digits alongside your address are also used to talk support agents into account changes. Stolen cards are often tested with small charges before real spending starts.
How criminals use it
Tiny test purchases confirm the card works before larger spending begins.
A fake bank fraud call quotes your card number and asks you to read out a one-time passcode to block a transaction, which actually approves it.
The last four digits and your address convince a retailer's support agent to change the email address on your account.
Recurring subscriptions are started on your card in the hope that small monthly charges go unnoticed.
What to do now
Check the breach notice. If full numbers leaked, call your issuer on the number on the card and ask for a replacement with a new number.
Review statements for the past few months, including tiny charges, and dispute anything you do not recognise.
Turn on real-time notifications for every transaction in your banking app.
Use card controls where available to block online, overseas or contactless use you do not need.
Never share a one-time passcode with a caller. Your bank will not ask you to read one out to stop fraud.
Pay online with a digital wallet such as Apple Pay or Google Pay where you can, since the merchant then receives a token instead of your real card number.
Frequently asked questions
Only the last four digits of my card leaked. Do I need a new card?
No. Those four digits cannot be used to pay. Stay wary of callers who quote them as proof they are from your bank.
Is a debit card leak worse than a credit card leak?
Often yes, because fraud on a debit card takes money straight from your account while the dispute is investigated. Report it just as quickly.
The breach was years ago. Is my card still at risk?
If the card has since been replaced with a new number, the leaked number is dead. Renewal cards often keep the same number with a new expiry, so if in doubt ask for a new number.
Breaches that exposed this data
Genesis Market: 2023-04-05, 8.0M accounts, Browser user agent details, Credit card CVV, Credit cards, Dates of birth, Email addresses, Names
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.