“Never give your credit card number over the phone” is one of those pieces of advice that is too simplified to be helpful. You’ve probably done it without a second thought, such as when you were booking a hotel, ordering takeout, or calling your own credit union to ask about your account. None of that should be dangerous. So when and what should you be cautious about?
The real answer is about whether you called them, or they called you.
You Called Them
Safe
When you pick up the phone and call a business (for example, a hotel chain you trust, a restaurant you’ve ordered from before, or Latitude 32 Credit Union using the number on the back of your card), you know and trust the organization you’re calling. You either looked up the number yoruself, or you’re using one you already know is real. That means you can be sure there’s no one on the other end pretending to be someone they’re not to get your payment information. There is little difference between giving your card number in this scenario and typing it into a trusted website that you navigated to directly.
They Called You
Unsafe
The risk shows up the moment someone else initiates contact in any way: through a call, an email, or a text with a number to call back. And here’s the tricky part that catches even careful people off guard from time to time: caller ID isn’t proof of anything. Scammers can make a call display your bank’s actual name and number through a technique called caller ID spoofing. That means that the information on your screen can be deliberately falsified (“spoofed”) to disguise who’s really calling. A call that appears to be coming from Latitude 32 Credit Union can unfortunately be coming from anyone, anywhere.
This is exactly the setup behind a huge share of credit card fraud calls. The FCC’s guidance on these scams is direct: never confirm or provide financial information during a call you didn’t initiate, even if it sounds like your card issuer calling about suspected fraud.
What to Do If You’re Not Sure
If someone calls claiming to be your bank, a merchant, or anyone asking to “verify” your card number, the move is the same every time: hang up. Then call back using a number you find yourself — the back of your card, a recent statement, or the official website you type in yourself. Never use a callback number the caller gives you, and never let them “transfer” you to someone else, even if that person also sounds legitimate.
The FTC’s current guidance on unexpected calls puts it well: get the basic details of who says they are calling and why, then hang up and verify the request or information independently. A legitimate caller will never object to you calling them back through a number you looked up yourself. A scammer, on the other hand, most definitely will object and try to keep you on the phone.
The Short Version
Phones themselves aren’t the primary risk. It’s answering someone else’s call and trusting what your screen tells you about who’s on the other end that puts you in a dangerous position. If you called someone you trust, then you’re all set. But if they called you, please call the number you have for that organization yourself and verify everything then before you say a single digit of your card number out loud.
For more on protecting your accounts against scams that rely on impersonation, visit our Fraud Prevention & Cybersecurity Resource Center.