TL;DR: The last 4 digits of your card are not a secret. RBI rules let merchants keep them, bank SMS alerts show them, and data breaches leak them next to phone numbers. Scammers use them to sound like your bank so you’ll share an OTP or install an app. Knowing your last 4 digits proves nothing. Hang up and call your bank yourself.
Where the last 4 digits come from
Usually nobody hacked anything. The digits are stored and shown in many places, often right next to your phone number:
- Every app you’ve paid on. Since card tokenisation, merchants can’t store your full card number. But the RBI circular explicitly lets them keep the last four digits and the card issuer’s name for tracking. That’s why checkout pages show “HDFC card ending 4417”. Each of those apps also has your phone number.
- Data breaches. When those companies leak, the last 4 digits can leak too. In the DoorDash breach, for example, some customers had their card’s last four digits exposed (see our DoorDash breach guide).
- Bank SMS alerts. “Rs 2,500 spent on card XX4417” lands on your phone. Anyone who can read your SMS, through a malicious app, a stolen SIM or a borrowed phone, gets it.
- Receipts and screenshots. Printed slips, invoices and payment screenshots shared in groups all show them.
- Social engineering. Someone calls a support desk pretending to be you, and the agent “confirms” the last 4 as a check.
Leaked records get combined and sold in lookup bots, so a scammer can type in a phone number and get back a name, email, address and sometimes card details. See how your phone number gets exposed.
Why scammers want them
Four digits can’t be used to spend money. Their value is credibility. “Ma’am, I’m calling from your bank about the card ending 4417” sounds real, and that is the whole point. The follow-up is always one of these:
- “Read me the OTP we just sent to block the transaction.”
- “Confirm your full card number and expiry date.”
- “Install this app so we can help you.” (Usually a fake APK or a remote-access tool.)
- “Let me merge the bank’s line”, which is the call merging scam.
What to do when a caller knows your card details
- Don’t confirm anything. Not the digits, not your name, not “yes”.
- Hang up and call the number on the back of your card. Your bank will never ask for an OTP, PIN, CVV or full card number on a call.
- If you already shared something, block the card in your bank app and report on 1930. Our card fraud reporting guide has the steps.
Reduce how often your digits are out there
- Use tokenised cards and remove saved cards from apps you no longer use. RBI encourages tokenisation.
- Crop card details out of screenshots before sharing them.
- Run a free email exposure check to see which breaches your details are already in.
Frequently Asked Questions
How do scammers know the last 4 digits of my card?
From apps that store them, data breaches, bank SMS alerts, receipts and screenshots, or by tricking support staff. RBI rules let merchants keep the last four digits for tracking.
If a caller knows my card's last 4 digits, are they from my bank?
No. The last 4 digits are not secret, so they prove nothing. Hang up and call the number on the back of your card.
Can someone use my card with only the last 4 digits?
Not to make payments. Scammers use them to sound genuine so you'll share an OTP, full card number or install an app.
Can someone find my card details from my phone number?
Leaked databases often link phone numbers to names, emails and sometimes the last 4 card digits, and these get sold in lookup bots.
Sources
- RBI: Tokenisation, permitting Card-on-File Tokenisation (CoFT) services
- RBI press release: RBI encourages cardholders to tokenise their cards
- National Cyber Crime Reporting Portal