# Bank Details in Customer Support: Keep Sensitive Data Out of the Case

A defensive example for writing a support case without copying full bank details or unrelated transactions.

- Canonical URL: https://www.harmate.com/en/blog/bank-details-in-customer-support-keep-sensitive-data-out-of-the-case
- Author: Harmate Team
- Published: 2026-11-15
- Updated: 2026-11-15T01:49:45.557765+00:00
- Language: en

## Content

# Bank Details in Customer Support: Keep Sensitive Data Out of the Case

A screenshot sent with a duplicate-payment question may contain far more than an agent needs. A useful case note keeps the details needed for verification and avoids copying full payment credentials or unrelated transactions. The exercise below is fictional. It offers a defensive writing check, not a legal conclusion or a guarantee of compliance.

## Start with the decision

Alex reports seeing two €42.80 entries in a banking app for a particular order. The message to support includes a full card number, an expiration date, and a screenshot that also shows unrelated purchases. In this scenario, the fictional internal policy allows a support case to keep an order reference, amount, date, payment status, and transaction reference. It excludes full payment credentials and unrelated transaction history.

The work question is specific: does the merchant ledger contain one or two events for this order? A case note does not need to retell the customer’s wider financial situation to answer that.

## Rewrite the case note

An initial draft might copy the full card number and describe other visible purchases. That adds exposure without helping the team count the merchant’s events.

A narrower working note says:

> Case CS-2033. Customer reports two €42.80 entries for order OR-2033 on November 15. Merchant payment view shows one capture, reference TX-990, checked at 10:26 a.m. The customer’s screenshot was not copied into the case. Ask Payment Operations whether the second entry is a separate merchant event or a pending item displayed by the bank. Owner: Payment Operations. Update the customer by 4 p.m. under this team’s fictional plan.

The note retains the order reference, amount, date, observation from the checked source, and check time. It leaves out the full card number, expiration date, and unrelated transactions. The 4 p.m. update is specific to this scenario; a real team should use a time it is allowed and able to meet.

## A quick review before saving

Before recording a note, ask:

1. What decision does the team need to make?
2. Which minimum fields let it make the decision and identify the source it checked?
3. Has a full bank detail, security code, entire image, or unrelated purchase been copied without a demonstrated need?
4. Which role is authorized to perform the next check?
5. What approved procedure applies to the sensitive message or attachment already received?

If the team does not know the procedure for handling a sensitive attachment, it should not invent a deletion or retention rule. Stop copying it and ask the designated owner for the approved route. A shortened case note does not prove that every copy has been removed from every system.

## Keep a useful record, not a copy of everything

The aim is not to remove information needed for an investigation: a transaction reference and a verified observation from the merchant ledger may be essential. The goal is to connect the note to the decision and its owner while avoiding the spread of data that does not help answer the question.

This example covers one situation with invented fields and policy. It defines no universal list of permitted data, guarantees no protection, and describes no Harmate feature. Before adopting the fields, check your organization’s internal procedures and applicable obligations.

To practise passing a note between teams, use the [disputed delivery test case](https://www.harmate.com/en/blog/chatbot-test-cases-for-multi-turn-conversations). The [persona template](https://www.harmate.com/en/blog/synthetic-persona-template-a-minimal-card-for-testing-an-ai-assistant) lets you repeat the exercise with entirely fictional details.