On this page
  1. Why it matters
  2. Mask before it’s stored
  3. Ask customers not to do it
  4. What your team should say
  5. Never ask for it
  6. Keep less, for less time
  7. The takeaway

It happens to every support team eventually. A customer, trying to be helpful, types their full card number into the chat: “Payment failed, my card is 4111 1111 1111 1234, can you check?”

Now that number sits in your chat history, visible to every agent and stored for months. Here’s how to prevent it and what to do when it happens anyway.

Why it matters

Full card numbers, ID numbers and similar data in a chat log create risk with no benefit. Your team can’t process payments through chat, so storing the number helps no one — and anyone with access to the history can see it.

Five layers that keep card numbers out of transcripts
  1. Mask before storing
  2. Ask customers not to
  3. One script for the team
  4. Never ask for it
  5. Keep less
  6. for less time

Mask before it’s stored

The best protection is automatic: replace sensitive numbers before the message is saved. With masking on in AskCub:

  • card numbers (recognised with a checksum, so ordinary order numbers are left alone),
  • Chinese national ID numbers,
  • phone numbers,

are replaced so only the last four digits remain — in both directions, visitor and agent. The inbox marks the message as masked, so your team knows why digits are missing. The full number was never stored.

Ask customers not to do it

Masking is a safety net, not an invitation. Add a line where it will be seen:

  • in your greeting: “Please don’t share full card numbers here.”
  • in a canned reply your team can use when payment comes up.

What your team should say

When a customer shares a card number, don’t ignore it and don’t scold them. Something like:

Thanks — for your security, please don’t share full card numbers in chat; we’ve masked it automatically. I can see the last four digits, which is all I need to look into the failed payment.

Then solve the actual problem.

Never ask for it

Make it a rule: your team never asks for a full card number, CVV or password in chat, email or anywhere else. If a process seems to need one, the process is wrong.

Keep less, for less time

Combine masking with short retention. If you don’t need conversations older than 90 days, don’t keep them. Data you don’t have can’t leak.

The takeaway

Assume customers will share sensitive numbers, mask them automatically before storage, ask them politely not to, and never ask for them yourself.

Tagsmaskingsecurityprivacy
Related featureChat Visitor PrivacyYou chatted on a website that uses AskCub: what is stored on your device, what the site can see, how AI and translation work, and how to delete it.See how it works

Related articles

Trust & privacy2 min read

How long should you keep chat transcripts?

Keeping every conversation forever feels safe but adds risk. A practical way to choose a retention period — and what to do before data is deleted.

Read article

Trust & privacy3 min read

Telling customers they’re talking to AI

Hiding an AI behind a human name damages trust and is increasingly against the rules. How to disclose AI clearly, and why customers prefer it.

Read article

AI customer service4 min read

When should an AI agent hand a conversation to a person?

Five hand-off triggers that keep customers from getting stuck with a bot — and the three mistakes that make AI support feel worse than no support.

Read article

Try it on your own site

A free plan with no time limit, AI agent included. One line of code.

Start free