What a seller legitimately needs to know about you, and what they never do

Buying a subscription online involves giving away information as well as money. Everybody accepts that. Almost nobody has looked at how little of it is actually required.

The exercise is worth ten minutes, because once you know the short version of the list, an excessive request stops looking like paperwork and starts looking like what it is. You do not need to detect a fraud. You only need to notice a question that has no reason to be asked.

The genuinely necessary list

For a digital subscription — no parcel, no delivery driver, no premises — three facts make the transaction work.

Somewhere to send the access. An email address, or a messaging handle. The subscription has to arrive somewhere, and that somewhere is the only contact detail the arrangement structurally depends on.

Which plan you bought. How many simultaneous screens, over what term. This is a fact about the order, not about you.

A payment that cleared. Not the instrument — the outcome. A reference the seller can look up and match to your order.

That is the list. Everything else a checkout asks for is in one of three categories: it helps the payment clear, it helps the seller run a business, or it is being collected because collecting is easy. The first is fair, the second is negotiable, and the third is where the risk accumulates.

The line between a payment page and a seller

This is the single most useful distinction on the subject, and most confusion about "is this request normal" dissolves once you hold it.

A payment page — the card form itself — belongs to a payment company. It may legitimately ask for the long card number, the expiry, the security code on the back and sometimes a postcode. That is its job, those fields are why it exists, and the data goes to the processor rather than to the person selling you something.

A seller is the other side of a conversation. They may ask what you want to buy, where to send it, and how you intend to pay. They may never ask for the contents of the payment page.

Card details belong to the card form and nowhere else. There is no version of a working payment system in which a seller needs to be told a security code, and no honest explanation for asking. That single rule resolves most of what people find ambiguous about paying online.

The same logic applies to the page itself. If a link takes you somewhere that asks for card details but does not look like it belongs to a payment company — wrong domain, no company name, a form embedded in something that looks like a document — you are being asked to type your card into a collection point. What to look for is set out in why there is no checkout button on this site.

What a seller sees after you pay

Worth knowing, because it is much less than most people assume, and the gap is what makes an out-of-place request so easy to spot.

Two things follow from that table. A wallet payment is genuinely less revealing than a card payment, which is one of the few practical differences between them — the rest are compared in paying by card versus paying by wallet. And a request for anything in the third column cannot be explained by the payment process, because the payment process is specifically built to keep it away from the seller.

The nine requests to refuse outright

Each of these has been a step in a real, documented fraud. None of them has a legitimate role in buying a subscription.

• A full card number, typed or photographed in a message. There is no reading of this that is fine. It is the definitive one.
• The security code on the back of the card. Belongs to the payment form. A human being never needs it.
• A photo of the card, front or back. The polite version of the first two, and worse, because it hands over all of it at once.
• Online banking login details. Sometimes framed as "so we can confirm your payment arrived". Nobody confirms a payment from inside your account.
• A one-time code sent to you by your bank. That code exists to authorise a transaction you are making. Passing it on authorises somebody else's.
• A passport, driving licence or national ID. No function here. High value if it leaks.
• Remote access to your computer or phone. No setup problem on a streaming device requires it, and it exposes everything else on the machine.
• A payment on a rail with no reversal, when a card was on offer. Not a data request, but the same category of ask — it moves the risk to you for no benefit. The pattern is unpacked in why a seller who only accepts irreversible payment is telling you something.
• Your date of birth and mother's maiden name. These are bank security answers. A subscription has no use for them, and whoever collects them can use them somewhere that does.

Refusing all nine costs you nothing you would want. A real seller responds to a refusal by finding another way to help. That reaction is itself the test.

The grey area: postcodes, phone numbers, screenshots

Not everything unexpected is a warning. Three requests come up constantly and are usually fine, with conditions attached.

A postcode on the card page. This is address verification. Your bank compares what you typed against what it holds, and a match makes a borderline payment more likely to clear. Genuine, useful, and confined to the payment page. It should never arrive as a question in a chat.

A phone number. Reasonable when the service is delivered or supported over a messaging app, because the number is the delivery address. Less reasonable when there is no messaging channel and no stated purpose. The question to ask is what it is for; a specific answer is a good sign, and a vague one is the answer.

A screenshot. Often the fastest way to resolve something, and fine — as long as you check what is in the frame before sending it. A screenshot of a payment confirmation usually contains a reference number, which is what is wanted; sometimes it also contains an account number or a balance, which is not. Crop it. What to include is covered in what to send support so a payment problem is solved in one message.

Why an honest seller asks for so little

Data is a liability before it is an asset. Anything held about you can be leaked, subpoenaed, sold in an acquisition, or lifted by whoever compromises the mailbox it sits in. A seller who never took your address cannot lose your address.

There is also a straightforward commercial reason. Storing card details, identity documents or home addresses drags an operator into a compliance burden it has no reason to carry. Not collecting is cheaper, safer and faster, and the operations that do collect are usually doing it because the data has a second use.

So a very short list is not a sign of an unsophisticated operation. Read it the other way round: a subscription service that wants your date of birth has decided that knowing your date of birth is worth something to it, and it is worth asking what.

A checklist for the moment you are asked

• What is this for? Ask it plainly. A legitimate field has a one-sentence answer.
• Where am I typing it? A payment company's form, or a message window. Card data belongs only in the first.
• Could this be used somewhere other than here? A security code, a bank one-time code and a maiden name all can. An email address largely cannot.
• Does the request match the stage? Nothing about payment details should come up after the payment has already cleared. Late requests are the most common shape this takes.
• What happens if I say no? The most informative question of the five. A seller who offers an alternative is a seller. A seller who applies pressure has told you what the request was for.

What we ask for, and why

An order here is placed in a chat rather than through a card form on this site, and it needs two things: a phone number in international format so the order reaches the right conversation, and the plan you want — one, two or three simultaneous screens at $69, $97 and $137 for the year, listed in full on the pricing page.

We do not ask for a home address, a date of birth, an identity document, or any part of a card. When a payment is made by card or wallet it happens on the payment company's page, and what comes back to us is an approval and the last four digits. There is no stored card, and no facility to charge one again — the reasoning is in why we do not keep your card on file.

What is held, why, and for how long is written out on the privacy page. The short version is a contact detail, a plan, two dates and a payment reference, because that is what it takes to deliver a subscription and prove you paid for it. If anyone claiming to be from this desk asks you for more than that, they are not — and the channels that are genuinely ours are listed on the contact page.