How to store bank card details safely on your phone

A photo of the front and back of a card, or a note with the number and CVV, is readable by anyone who opens your unlocked phone. Photos also tend to sync to other devices and to a cloud backup, and they appear in the photo picker of every app you grant access to. A card number in a plain note is searchable in seconds.

The trouble is that these are the easiest places to put a number you will need again, so people use them. The better choice depends on why you need the number.

For everyday payments, you rarely need to see the number again. Apple Pay uses a device-specific number instead of your real card number when you pay, so a shop or app never receives your actual number.

1. 1Open the Wallet app and tap the plus (+) button.
2. 2Choose Debit or Credit Card and follow the steps to scan or enter the card. Your bank may ask you to verify it with a code.
3. 3To pay in a shop or an app, double-click the side button and look at your iPhone to authenticate (or use your passcode).

Which banks and cards support Apple Pay varies by country, so check with your bank. Many banking apps also let you lock a card, turn online payments on and off or set a limit; if your bank offers these, they are worth switching on.

AutoFill can fill in a saved card on web checkouts so you do not have to type it. You choose whether to use it.

1. 1Open Settings and go to Apps, then Safari, then AutoFill (on older iOS versions it is Settings, then Safari, then AutoFill).
2. 2Tap Credit Cards and turn it on.
3. 3Add a card, or check the ones already saved and delete any you no longer use.

The menus move a little between iOS versions. Whatever the version, remember that AutoFill is meant for convenience while you are shopping; it is not a place to look up a card number on purpose. That is the gap the next option fills.

Sometimes you do need the number in front of you: a card for a family member, a work card, a card you use on a site that does not accept Apple Pay, or the numbers you read out when you set up a subscription on another device. For those, keep it in a vault that is encrypted and locked, not in Photos or Notes.

A few habits help wherever you keep it:

• Store only what you need. A card number and expiry are often enough; think before saving more.
• Never read a card number or a one-time code out to someone who rings you, whoever they say they are. A bank will not ask for a full number or a code over the phone.
• Delete old photos of cards. Check your library for them, and remember a deleted photo stays in Recently Deleted for a while. See how to permanently delete photos on iPhone.
• Treat a card screenshot like the card itself. See how to handle sensitive screenshots on iPhone.

Lockboxy is a private, encrypted vault for iPhone, and its Wallet area is built for exactly this: structured entries rather than loose photos. Everything in it is encrypted with AES-256-GCM on your device, there is no account, and no server holds a copy.

1. 1Open Lockboxy with its passcode and go to the Wallet tab.
2. 2Tap Add entry and choose Bank / credit card.
3. 3Fill in the Title (for example, the bank and the card), the card number, the cardholder name, the expiry month and year, and the CVV. Bank name and Notes are optional.
4. 4Save. The card number and CVV are masked with dots by default; tap Show on the entry when you need to read one.
5. 5To use a value, tap Copy. Lockboxy clears the copied value from the clipboard about 30 seconds later, so it does not linger for other apps to paste.

Each sensitive field is encrypted individually, and the entry fields are marked so that iOS does not offer to save them to iCloud Keychain. If you delete an entry, it first goes to the Recycle Bin, so you can restore it if you deleted it by mistake. The same Wallet also holds passwords, Wi-Fi logins, PIN codes and 2FA or recovery codes, see how to store 2FA backup codes safely.

• Lockboxy does not pay for anything or fill in checkout forms; it is a place to keep and read a card, not a payment method. Use Apple Pay for paying.
• The vault key comes from your passcode. If you forget it, nobody, including us, can open the vault, unless you made a Recovery Key (Premium) beforehand. Keep the passcode somewhere safe.
• Entries in the Wallet are unlimited on the free plan. Which plan includes what, and the price, are on the Premium page; the app shows the exact price before you buy.
• If a card is lost or you suspect misuse, call your bank first. A vault does not replace that.

For passwords, see how to store passwords safely on your phone.