Innomerc What does each detail mean?
Card number + expiry
Payment details. Use only for an intended transaction through a verified payment route. Do not post, email or send card photos to an unexpected requester.
CVV / CVC
Short security code. A verified checkout may request it. Keep it out of chats, screenshots and support messages. It is not the same as your PIN.
PIN
Keep to yourself. Use an authorized terminal, ATM or the bank’s own verified process. Never read it to a caller or enter it in an ordinary shopping form.
OTP / approval code
Read its purpose. Enter only for an action you started and understand in the genuine service. Never forward it to someone asking to stop fraud.
Name / last four digits
Not proof of identity. These may help identify a record in a verified support interaction, but knowing them does not authenticate a caller.
ID cards + document photos
Verify necessity. A legitimate institution may require identity checks. Verify the recipient and purpose; use a secure official submission route and share the minimum needed.
Never enter real card details into learning tools. If details were exposed, contact your issuer promptly. Financial rights and reporting deadlines vary by country and provider.
One useful thing to do today
End unexpected requests and call your issuer using the number on the card or its official app.
More everyday safety lessonsChoose your depth. Learn at your own pace.
Understand it
Keep your PIN, banking password, payment approval codes and recovery codes to yourself. Do not send photos of either side of a card or post card details in chats, email or social media. A name or the last four digits is not proof that a caller is your bank.
A verified checkout may legitimately ask for your card number, expiry date and security code (CVV/CVC). Enter only what is needed when you chose the purchase and checked the seller. A PIN is for an authorized terminal, ATM or your bank’s own verified process—not a caller or ordinary shopping form.
Under the hood
A card number identifies a payment account; a CVV is an additional check for some transactions, not a universal requirement. A payment can sometimes proceed without a CVV or an OTP. An issuer challenge can authorize a particular action; read its amount, payee and purpose before approving.
Practitioner perspective
Map payment data across checkout, support tickets, logs and analytics. PCI DSS prohibits merchants retaining card verification codes after authorization, even encrypted. Prefer hosted payment collection and minimize access; outsourcing collection does not by itself prove compliance. Never use real customer card details in training.
Watch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
Where do your card details go?
Compare an unexpected request with a payment you chose. All details are fictional; never enter real payment information here.
A refund story can conceal an attempt to obtain payment information.
How to use this example
Select Next step to read at your own pace, or Animate step to watch one exchange. Nothing advances until you choose.
What it means
Everyday example
State in this scenario
Inspect components & read every step
- You
The person making the decision in this fictional example.
Example: You decide whether to share information, approve a request or check it first.
- Unknown caller
Someone contacting you whose identity you have not independently checked. A familiar name on the screen is not proof of who is calling.
Example: A caller says they are from your bank and asks for a photo of your card. End the call and use a contact route you already trust.
- Verified checkout
The payment process for a purchase you deliberately chose through a merchant you checked. A padlock alone does not prove a seller is honest.
Example: You open a known shop yourself and pay for the item you selected. This differs from sending a card photo to a caller.
- Your bank
The institution that manages your account or issued your card. Contact it using its official app or a known number.
Example: If you shared card details, contact the issuer promptly to discuss blocking the card and reviewing transactions.
Unexpected caller
A refund story can conceal an attempt to obtain payment information.
- Unknown caller You: Refund claim. An unknown caller requests a photo of your card.
- You Unknown caller: Card photo. Sending both sides exposes payment details to the caller.
- Unknown caller Your bank: Payment attempt. The caller may attempt a payment; additional checks vary.
Purchase you chose
Only submit necessary payment details through a verified checkout for an intended purchase.
- You Verified checkout: Chosen purchase. You checked the seller and chose this purchase.
- Verified checkout Your bank: Payment request. The payment provider routes an authorization request to the issuer.
- Your bank You: Check details. If challenged, read the bank’s stated amount, payee and action.
- You Your bank: Your decision. Approve only an action you started and understand.
- Your bank Verified checkout: Payment result. The issuer returns a result; the seller’s honesty is a separate matter.
Already shared details
Contact the actual issuer promptly; a card lock and recovery options depend on the provider.
- You Your bank: Report exposure. Use the official app or number on your card, not the caller’s number.
- Your bank You: Protect + review. Discuss locking, replacement and any transactions needing review.
- You Your bank: Activity checked. Provide transaction references through the verified support route.
Fictional teaching trace. One moving dot represents an exchange, not a measured network capture.
Open the detailed lesson walkthrough
Explore the system
Caller
A stranger claims a refund needs a card photo.
Read every step without animation
Unexpected refund call
- Caller. A stranger claims a refund needs a card photo.
- Details sent. Both sides of the card are copied.
- Payment risk. The stranger can attempt a transaction.
Exposure creates risk even without a shared PIN.
Verify first
- Pause. Do not send the card photo or code.
- Official contact. Open the bank app independently.
- Issuer checks. Ask whether the request exists.
The caller does not receive payment secrets.
What could go wrong
In this fictional refund call, a caller asks for a card photo and an approval code. The information may support a payment rather than a refund.
What you can do
- End unexpected requests and call your issuer using the number on the card or its official app.
- If details were exposed, lock the card if available and contact the issuer promptly about replacement and disputed transactions.
- Review statements and alerts; keep case numbers. Refund rights and reporting deadlines depend on your location and provider.
Common mistakes
- Withholding the CVV alone does not make an exposed card number safe.
- A padlock means the connection is encrypted; it does not prove the seller is honest.
Check your understanding
Active recall: explain this idea in 30 seconds
Keep your PIN, banking password, payment approval codes and recovery codes to yourself. Do not send photos of either side of a card or post card details in chats, email or social media. A name or the last four digits is not proof that a caller is your bank.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
- PCI SSC: Card verification codes after authorization
- FTC: Verification codes and impersonation
- FTC: What to do if you were scammed
- FTC: Online shopping
Content reviewed 2026-09-10. Read the editorial policy.