Is it safe to keep a photo of your credit card?
Why a card photo is different
The US Federal Trade Commission (FTC) says your account number is enough for someone to use your account, even if your card was never lost or stolen. A photo of the card puts that number in your camera roll, along with the rest.
The 3 or 4 digit security code is the part many people forget. The card industry's security council says it is typically used for payments where the card isn't present, such as online, and that businesses must not keep it once a payment is approved. That tells you how seriously it's treated.
What to do with the picture
- Find it. Here's how to look. Check both sides of the card.
- Delete it if you don't need it. Deleted photos stay in Recently Deleted for 30 days, then are removed from your iPhone, iCloud and other devices. With iCloud Photos on, a deletion applies to all your devices. Empty Recently Deleted if you want it gone sooner. That can't be undone, so be sure.
- For paying, use a wallet instead. Apple says that with Apple Pay, neither Apple nor your device sends your actual card number to the shop or app. Apple Pay uses a device-specific number instead. This is our advice: a card in Wallet does the job a photo was doing.
- If you must keep a picture, lock it away in the Vault or another place with its own lock. Here's how the options compare.
- Keep your bank's phone number, not the card number. Save your bank's customer-service number in your contacts now, taken from its official app or website, so you have it if the card is lost.
If the picture was already seen or shared
Call your bank first, before cleaning up pictures, and ask for a new card. Deleting your copy doesn't delete one in someone else's chat or phone. If you think a card photo was seen, the surest step is to ask the bank for a new card, because a new number makes the old one useless. This is our advice.
- The FTC says to report a lost or stolen card to the bank or credit union that issued it as soon as possible. Use the number on the back of the card or in the bank's own app.
- Look through your statements often and report charges you don't recognise.
- In the US, the FTC says federal law limits what you can owe for charges you didn't approve, and the limit depends on the card type and how quickly you report. Other countries have their own rules, so ask your bank.
- Be wary of anyone who calls and asks for your card number. The FTC warns that scammers posing as card companies are often after only the account number.
How FirstHour helps
Protect looks through your pictures on your iPhone for photos of cards and card details, and shows them in a group called Card numbers. They stay blurred until you're ready, and you decide what happens to each one. You can move a whole group to the Vault, or save a copy with solid black boxes over the number. Nothing is uploaded.
It can miss things. Raised card digits, blurry or cropped pictures and handwriting are often missed, and the back of a card may not be found. It doesn't check videos or your Hidden album, and it can't see inside other apps. It can't tell you whether a card was seen, and it can't replace a card for you.
Questions
Is the Hidden album enough?
It's better than the camera roll, but it opens with your Face ID, Touch ID or iPhone passcode, and Apple says you can turn that lock off. Anyone who knows your passcode can open it.
What if I only photographed the back, with the code?
The code is the part that matters most for online payments, so treat it the same way. Delete it, or lock it away.
Is a screenshot of my card in a shopping app any different?
No. If it shows the full number, it carries the same risk. Screenshots of bank details are covered in their own guide.
Sources
- Lost or Stolen Credit, ATM, and Debit Cards, Federal Trade Commission
- FAQ: Can card verification codes/values be stored for card-on-file or recurring transactions?, PCI Security Standards Council
- Apple Pay security and privacy overview, Apple Support
- Delete or hide photos and videos on iPhone, Apple Support