To send credit card details securely, avoid typing them into email, text or chat. Ask the hotel or vendor for a secure payment link, or call them on a verified number. If you must send the details in writing, use a one-time note that self-destructs after one view, protect it with a passcode, and share that passcode by phone.
Key takeaways
- A payment link or the merchant's own checkout is safer than sending your card number anywhere, because you type it straight into the payment system.
- A phone call to a number you looked up yourself beats email, text or chat, which keep a copy in sent folders, backups and inboxes.
- If text is unavoidable, send a one-time note that is destroyed after one view, add a passcode and share the passcode by phone.
- Never send a photo of your card, and give the security code (CVV) only by phone or into a payment form.
- If you already emailed or texted your card number, delete it, ask the recipient to delete it and call your issuer about a replacement card.
Why you shouldn't email a credit card number
When you email a credit card number, you create copies you can't control. One sits in your sent folder, one in the recipient's inbox, and more in server backups and any phone or laptop synced to either account.
Those copies last for years. If either mailbox is ever compromised, through a reused password or a phishing link, your card details are sitting there in plain text next to your name and billing address.
Email also tends to get forwarded. A hotel's front desk might pass your message to a reservations team, a shared inbox or a third-party booking agent. Every hop adds another copy. For a fuller picture, see why email isn't secure enough for sensitive information.
Text messages and WhatsApp have the same core problem. The message stays in the thread, gets backed up to the cloud and shows up on lock-screen previews.
What are the safest ways to send card details?
The best option is usually not to send your card details at all. Instead, put them directly into the merchant's payment system, where they're handled by a processor built for that job.
| Method | Leaves a copy behind? | Best for | Main risk |
|---|---|---|---|
| Payment link or online checkout | No copy in your messages | Hotels, vendors, freelancers who invoice | Fake links in phishing emails |
| Phone call to a verified number | No written copy (unless recorded) | Hotels, restaurants, small businesses | Calling a number from a scam message |
| One-time note with passcode | Note is destroyed after viewing | When the recipient insists on written details | Recipient copies it somewhere unsafe |
| Yes, in multiple places, indefinitely | Nothing involving card numbers | Inbox breach, forwarding | |
| Text, WhatsApp or chat | Yes, in threads and backups | Nothing involving card numbers | Lost phone, backups, previews |
| Photo of the card | Yes, often with the CVV visible | Never | Everything on the card in one image |
Work down the table. Ask for a payment link first, then offer to call. Only fall back to a written method if both are genuinely not available.
Use a virtual card number if your bank offers one
Many banks and card issuers let you generate a virtual card number with its own expiry date or spending limit. If you have to share card details with a vendor you don't fully know, a virtual number limits the damage if it leaks.
How to give card details to a hotel
Hotels ask for card details to guarantee a booking or cover incidentals. Most have a safer route than email, even if the first message you get says "just reply with your card number".
Ask for a payment link or secure form
Reply asking whether they can send a payment link or let you add the card through their booking page. Many hotels and booking systems can send a secure link that lets you enter the card yourself.
Call the front desk instead
Look up the hotel's phone number on its official website or your booking confirmation, not from a link in an unexpected message. Call, give the card details verbally and ask them to note the booking reference.
If they send an authorization form
Some hotels, especially when someone else is paying for your room, send a credit card authorization form to fill in and email back. That form ends up as an attachment in an inbox, which has the same problems as a plain email. Ask whether you can phone the details through instead, or whether they have an online version.
If you're an assistant booking for an executive, the same applies. Phoning the hotel is quick, and it keeps your boss's card out of your inbox and theirs.
How to send credit card details securely when text is the only option
Sometimes a vendor has no payment link, nobody answers the phone, and they insist on written details. In that case, send the card through a one-time link instead of putting it directly in a message. Here's how to do it with SecureNotes, which is free and needs no account.
- Confirm the request is real. Call or message the business on contact details you found yourself, and check they actually need the card. More on this below.
- Open SecureNotes and paste the details. Go to create a self-destructing note and type the cardholder name, card number and expiry date. Add the booking reference so the recipient knows what it's for. Leave the security code out if you can give it by phone.
- Choose when it self-destructs. Set it to be destroyed after 1 view and pick a short time limit, such as 1 hour or 24 hours, whichever comes first. If the recipient doesn't open it in time, the link stops working.
- Add a passcode. Set a passcode the recipient must enter to open the note. This protects the note if the link lands in the wrong inbox or gets forwarded.
- Send the link. Paste the link into an email or message, or have SecureNotes email it to the recipient for you. Turn on the read notification if you want an email when the note is opened.
- Send the passcode another way. Text or call the recipient with the passcode. Never put the link and the passcode in the same message, or the passcode adds nothing.
- Confirm they got it. Once you get the read notification, check the recipient has what they need. If the link shows as already opened but they say they never saw it, assume someone else read it and call your card issuer.
The passcode step matters most here. For guidance on choosing one and delivering it, see how to send a passcode safely.
Be honest with yourself about the limits. A one-time note keeps your card out of message threads and backups, but once the recipient opens it, they can copy it anywhere. It protects the delivery, not what happens after.
What to include, and what to leave out
Send only what the recipient needs to process the payment or hold the booking.
- Usually needed: name on the card, card number, expiry date, booking or invoice reference.
- Sometimes needed: billing postcode or ZIP code.
- Give by phone if at all: the three- or four-digit security code (CVV). Merchants generally aren't permitted to keep it after a payment is authorized, so there's rarely a good reason for it to sit in writing.
- Never needed: your PIN, online banking password, one-time verification codes sent by your bank, or a photo of the front and back of the card.
If anyone asks for your PIN or a code your bank just texted you, stop. No legitimate hotel or vendor needs those, and that request is a strong sign of fraud.
Common mistakes that still expose your card
Even careful people slip up in a few predictable ways.
Replying to a fake request
Scammers send convincing messages that look like hotel or booking confirmations, asking you to "re-verify" your card. Never act on a request that arrives out of the blue. Contact the business through details you looked up yourself. The same fraud tactics apply to account numbers, covered in how to send bank details securely.
Sending the link and passcode together
If both arrive in one email, anyone who gets into that inbox can open the note. Use a second channel, ideally a phone call or text.
Photographing the card
A photo captures the number, expiry, name and often the security code in one image. It also lands in your camera roll and cloud photo backup. Type the details instead.
Leaving copies in drafts and notes apps
People often type the card into a notes app or email draft first, then copy it across. Delete those drafts afterwards, and check that your notes app hasn't synced the text to other devices.
Setting a long expiry
A note that stays live for 30 days gives a forwarded or intercepted link plenty of time to be used. For card details, pick 1 view and the shortest time limit that works for the recipient.
What to do if you already sent your card number by email or text
It happens. Here's how to limit the damage.
- Delete your copy. Remove the message from your sent folder and trash, or delete it from the chat thread.
- Ask the recipient to delete theirs. A reputable hotel or vendor will do this once they've processed the payment.
- Turn on transaction alerts. Most card apps can notify you of every charge, so you'll spot misuse quickly.
- Watch your statements. Look for small test charges, which fraudsters often run before larger ones.
- Request a new card if in doubt. If you sent the details to the wrong person, to a shared inbox you don't trust or in reply to what turned out to be a scam, call your issuer and ask for a replacement. It's usually free and takes a few minutes.
Next time, start with a payment link or a phone call, and keep the one-time note with a passcode as your fallback.
Frequently asked questions
Is it safe to give credit card details over the phone?
Giving card details by phone is generally safer than email or text, because no written copy is left in an inbox or message thread. The key is calling a number you found yourself, such as on the hotel's official website or your booking confirmation. Never give card details to someone who called you unexpectedly claiming to be from your bank or a hotel.
Can a hotel ask for a photo of my credit card?
Some hotels ask for a photo of the card, often to verify a third-party booking, but it's risky. A photo captures the number, expiry, name and sometimes the security code, and it sits in your camera roll and cloud backups. Ask if you can verify the card at check-in, phone the details through or use a payment link instead.
Is it safe to text a credit card number?
No. Texts stay in the conversation on both phones, get backed up to the cloud and can appear in lock-screen previews. Anyone who picks up either phone or accesses a backup can read the number. If you must send it in writing, send a one-time link that self-destructs after one view, and share a passcode for it separately.
Should I give my CVV to a hotel or vendor?
Only if they need it to process a payment right now, and preferably by phone or through a payment form. Merchants generally aren't permitted to store the security code after a payment is authorized, so there's little reason for it to be written down. Never send it in an email, text or authorization form if you can avoid it.
Can someone use my card with just the number and expiry date?
Often, yes. Many online merchants and some phone orders accept a card with only the number, expiry date and name, especially for smaller purchases. The security code and billing address make fraud harder but not impossible. That's why the number and expiry date deserve the same care as the full card, and why transaction alerts are worth turning on.
Is a credit card authorization form safe to email?
An emailed authorization form has the same weaknesses as a plain email: it sits as an attachment in inboxes, backups and sometimes shared mailboxes. If a hotel or vendor requires one, ask whether they offer an online version, or whether you can phone the card details through and email only the signed form without the card number.
