Partial credit card data leaked: what it means and what to do
Risk level: high. Can you change it: yes. Found in 39 breaches in this directory.
What this data is
Fragments of a payment card rather than the full number, typically the first six or last four digits, the card brand, the expiry date or the cardholder name.
The risk on its own
A partial card cannot be used to buy anything online, because merchants need the full number and usually the security code. The risk is that these fragments are exactly what customer service teams and people use to confirm a card is genuine. That makes them powerful props for social engineering.
The risk combined with other data
With your name, address and phone number, the last four digits and expiry let a caller sound exactly like your bank's fraud team. Fragments from different breaches can also be pieced together, and first six plus last four digits narrows the full number considerably. Some retailers have accepted the last four digits as proof of ownership for account changes.
How criminals use it
A fake fraud team call reads out your card's last four digits and expiry, then asks you to read back a one time code that approves a real purchase.
An attacker quotes the last four digits to a shop's support team to change the delivery address on your account.
Fragments from two different leaks are combined to reconstruct enough of the number to test online.
A phishing email shows the correct card ending and asks you to update the card details on a fake payment page.
What to do now
Check recent statements for small test transactions and anything you do not recognise.
Turn on push notifications for every card transaction in your banking app.
Never read a one time code to anyone who calls you. Banks do not ask for it, whatever card details they quote.
Ask your bank for a replacement card if the breach also included the full number, the security code or suspicious charges have appeared.
Remove saved cards from the breached account and switch to a digital wallet such as Apple Pay or Google Pay where possible.
Frequently asked questions
Do I need a new card if only the last four digits leaked?
Usually not. Watch transactions and be alert to calls that quote the digits. Replace the card if the full number or unexplained charges appear.
Can someone shop online with part of my card number?
No. Online payments need the full number, and most also require the security code or a verification step.
Why do scammers want the last four digits?
Because people and support desks treat them as proof. Quoting them makes a caller or an email look like it really came from your bank or a shop you use.
Breaches that exposed this data
Hot Topic: 2024-10-19, 57M accounts, Dates of birth, Email addresses, Genders, Names, Partial credit card data, Phone numbers
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.