Payment histories leaked: what it means and what to do

What this data is

A list of past payments linked to your account: dates, amounts, merchants, invoice numbers and sometimes the method used. It is held by billing platforms, subscription services, utilities and payment processors.

The risk on its own

Payment history cannot be spent, and it rarely contains a full card number. It is still revealing: regular payments show your gym, your doctor, your childcare and your subscriptions, and amounts hint at income. For a scammer, it is a list of companies you will expect to hear from.

The risk combined with other data

With your name and email address, a real invoice number and a real amount make a fake billing email almost impossible to spot. Scammers use it to send payment failed messages that match your actual subscription and billing date. Patterns of payment to health, legal or gambling services can also be sensitive in their own right.

How criminals use it

• An email quotes your real last invoice amount and says the payment failed, linking to a fake page that collects your card.
• A caller poses as a utility and uses your past payment amounts to demand an overdue balance by bank transfer.
• Regular payments to a clinic, counsellor or legal firm reveal circumstances you kept private.
• A refund scam quotes a genuine past order and asks for remote access to process a refund.

What to do now

1. Check bank and card statements for charges from the breached company that you do not recognise.
2. Handle every billing problem by logging in to the company's website or app directly, never from a link in a message.
3. Change the password on the breached account and remove any saved card you no longer need there.
4. Turn on transaction alerts in your banking app so unexpected payments show up immediately.
5. Ask the company what else was included, such as card fragments or bank details, which need separate action.

Frequently asked questions

Can someone take money using my payment history?

Not directly. It does not contain enough to make a payment. It is used to make fake invoices and refund scams look genuine.

How can I tell a real payment failed email from a fake?

Ignore the link and open the app or website yourself. If the payment really failed, the account will say so.

Should I cancel the card I used?

Only if card numbers leaked too or unfamiliar charges appear. Payment history alone does not require a new card.

Breaches that exposed this data

• Ashley Madison: 2015-07-19, 31M accounts, Dates of birth, Email addresses, Ethnicities, Genders, Names, Passwords
• ClixSense: 2016-09-04, 2.4M accounts, Account balances, Dates of birth, Email addresses, Genders, IP addresses, Names
• Patreon: 2015-10-01, 2.3M accounts, Email addresses, Passwords, Payment histories, Physical addresses, Private messages, Website activity
• Ticketcounter: 2021-02-22, 1.9M accounts, Bank account numbers, Dates of birth, Email addresses, Genders, IP addresses, Names
• Oxfam: 2021-01-20, 1.8M accounts, Bank account numbers, Dates of birth, Email addresses, Genders, Names, Partial credit card data
• Eroticy: 2015-06-01, 1.4M accounts, Email addresses, IP addresses, Names, Passwords, Payment histories, Phone numbers
• WHMCS: 2012-05-21, 134K accounts, Email addresses, Email messages, Employers, IP addresses, Names, Partial credit card data
• Teracod: 2016-05-28, 97K accounts, Avatars, Email addresses, IP addresses, Passwords, Payment histories, Private messages
• JoomlArt: 2018-01-30, 22K accounts, Email addresses, Names, Passwords, Payment histories, Usernames

Tools that help

• Email Breach Check
• Phishing Link Checker
• Email Header Analyzer

Related guides

• Phishing Email Received? What to Do in the Next 15 Minutes
• Phishing Red Flags: Spot a Fake Email Before You Click
• Tech Support Scams: How They Work and What to Do Next
• What to Do After a Breach: Your Hour, Day and Month Plan