How to prevent misusing my Account details
This is more legal and less personal finance question. You should immediately lodge a police complaint mentioning that some persons are using your PAN card details for activities not authorized by you. In the meantime also engage the services of a CA and reply back to income tax authorities. Do not ignore the notice.
"This question has the [united kingdom] tag, so the information about USA or other law and procedures is probably only of tangential use. Except for understanding that no, this is not something to ignore. It may well indicate someone trying to use your id fraudulently, or some other sort of data-processing foul-up that may adversely impact your credit rating. The first thing I would do is phone the credit card company that sent the letter to inform them that I did not make his application, and ask firmly but politely to speak to their fraud team. I would hope that they would be helpful. It's in their interests as well as yours. (Added later) By the way, do not trust anything written on the letter. It may be a fake letter trying to lure or panic you into some other sort of scam, such as closing your ""compromised"" bank account and transferring the money in it to the ""fraud team"" for ""safety"". (Yes, it sounds stupid, but con-men are experts at what they do, and even finance industry professionals have fallen victim to such scams) So find a telephone number for that credit card company independently, for example Google, and then call that number. If it's the wrong department they'll be able to transfer you internally. If the card company is unhelpful, you have certain legal rights that do not cost much if anything. This credit company is obliged to tell you as an absolute minimum, which credit reference agencies they used when deciding to decline ""your"" application. Yes, you did not make it, but it was in your name and affected your credit rating. There are three main credit rating agencies, and whether or not the bank used them, I would spend the statutory £2 fee (if necessary) with each of them to obtain your statutory credit report, which basically is all data that they hold about you. They are obliged to correct anything which is inaccurate, and you have an absolute right to attach a note to your file explaining, for example, that you allege entries x,y, and z were fraudulently caused by an unknown third party trying to steal your ID. (They may be factually correct, e.g. ""Credit search on "", so it's possible that you cannot have them removed, and it may not be in your interests to have them removed, but you certainly want them flagged as unauthorized).  If you think the fraudster may be known to you, you can also use the Data Protection Act on the company which write to you, requiring them to send you a copy of all data allegedly concerning yourself which it holds. AFAIR this costs £10. In particular you will require sight of the application and signature, if it was made on paper, and the IP address details, if it was made electronically, as well as all the data content and subsequent communications. You may recognise the handwriting, but even if not, you then have documentary evidence that it is not yours. As for the IP address, you can deduce the internet service provider and then use the Data Protection act on them. They may decline to give any details if the fraudster used his own credentials, in which case again you have documentary evidence that it was not you ... and something to give the police and bank fraud investigators if they get interested. I suspect they won't be very interested, if all you uncover is  fraudulent applications that were declined. However, you may uncover a successful fraud, i.e. a live card in your name being used by a criminal, or a store or phone credit agreement. In which case obviously get in touch with that company a.s.a.p. to get it shut down and to get the authorities involved in dealing with the crime. In general, write down everything you are told, including phone contact names, and keep it. Confirm anything that you have agreed in writing, and keep copies of the letters you write and of course, the replies you receive. You shouldn't need any lawyer. The UK credit law puts the onus very much on the credit card company to prove that you owe it money, and if a random stranger has stolen your id, it won't be able to do that. In fact, it's most unlikely that it will even try, unless you have a criminal record or a record of financial delinquency. But it may be an awful lot of aggravation for years to come, if somebody has successfully stolen your ID. So even if the first lot of credit reference agency print-outs look ""clean"", check again in about six weeks time and yet again  in maybe 3 months. Finally there is a scheme that you can join if you have been a victim of ID theft. I've forgotten its name but you will probably be told about it. Baically, your credit reference files will be tagged at your request with a requirement for extra precautions to be taken. This should not affect your credit rating but might make obtaining credit more hassle (for example, requests for additional ID before your account is opened after the approval process). Oh, and post a letter to yourself pdq. It's not unknown for fraudsters to persuade the Post Office to redirect all your mail to their address!" Generally just giving a Bank Account Number does not cause damage. It depends on what other information the user has and the country you are in.  Generally Bank take telephone instruction for certain [non-transactional] activities , and they would authenticate you by asking account number, address, date of birth and some additional info. In today's world this info can be pretty easily accessible, for example facebook or a details posted on Jobsites etc. It is best avoided to give the bank account details, unless you are sure of the person.  Typical other misuse is using your bank account to Launder black money. The typical modus is transfer funds to you and then ask you to transfer it elsewhere. At times its also a scam and you loose money as they trick you in sending money before you receive it. Of course not, this is confidential information in the same way that I cannot phone up your bank and ask to see a list of the transactions that you have made. Any bank has to be extremely careful about protecting the private transactions of it's customers and would be subject to heavy fines if it revealed this information without the customer's consent. "Not knowing anything about your situation or what makes it so complex, I would have to agree with the other commenters.  If your accountant screws up your business goes under, but at least your personal finances are safe from that and you'll recover (unless all your wealth is tied up in your business).  If your virtual assistant uses your personal information to take all your money, ruin your credit, or any number of other things, you're going to spend a loooong time trying to get things ""back to normal"". If the few hours per month spent managing your finances is starting to add up, I might suggest looking into other ways to automate and manage them.  For instance, are all of your bills (or as many as you can) e-bills that can be issued electronically to your bank?  Have you set up online bill pay with your bank, so that you can automatically pay all the bills when they arrive?  Have you tried using any number of online services (Mint, Thrive, your bank's ""virtual wallet/portfolio"") to help with budget, expense tracking, etc.? Again, I don't know your exact situation, but hopefully some of these suggestions help.  Once I started automating my savings and a lot of my bill paying, it gave me a lot of peace of mind." Allowing others to share access to your Bank Account; i.e. giving then the login id and password has its risks; I use another solution: debit card with an account kept empty most of the time and another account in the same bank without any card. I keep the money on the second card-less account, and when I want to buy something, I instantly transfer the appropriate amount to the account with the card and pay. That way money is on the account tied to a debit card only for a minute before payment, and normally it is empty - so even if someone would try to fraudulently use my card number - I don't care - the transaction will be rejected. I think its the perfect solution - no fraud possible, and I don't have to worry about possibly having to bother calling my bank and requesting a chargeback, which is stressful and a waste of time and harmful to peace of mind (what if they refuse the chargeback)? I prefer to spend a minute before each transaction to transfer the money between the two accounts, and that time is not a waste, because I use it to reconsider the purchase - which prevents impulse-buying. I keep one card just for monthly bills (power company,car loan, etc.).  This one is unlikely to get hacked so I won't have to go change the credit card information on my monthly bills.  I pay the credit card from my bank account.  I just don't want a lot of businesses with direct access to my bank account. "In Britain it's standard practice to use an electronic bank transfer, otherwise known as a ""standing order"" for the monthly rent payment. Many letting agents insist on it here in Britain. It's rare to hear of fraud. It is possible to setup a Direct Debit with the account numbers, as happened in a famous case where Jeremy Clarkson claimed losing account numbers wasn't a problem. If a direct debit is taken from your account, then you are protected by the the Direct Debit guarantee which means that you get a full and immediate refund if there is any fraud or unexpected payments spotted. Some landlords, particularly of bedsits accept plain old cash, however that's not recommended as there is no trace of it being paid, which could lead to legal disputes." If it is a well known company that wants to give you a refund, I would not worry about giving them your credit card number.  However, I would never type my credit card number into an e-mail message. E-mail messages are very insecure, and can be read by many people along its way to the destination. They also can be archived in many places, meaning that your number will continue to be posted out there for someone to grab in the future.  If you need to give this company your credit card number, do it over the phone.  Having said that, ultimately you are not generally responsible for fraudulent charges if your card number is stolen and misused. I've had so many fraudulent charges, despite my being relatively careful with my number, that I don't really worry much anymore about losing my number. I just check my statement for false charges, and when they happen,  the bank cancels the charge and issues me a new number. It has happened to either my wife or I maybe 5 times over the last two years. Aside from the fact that you could now get spam calls and mailings, nothing negative at all. With your account number, anyone can send you money (which you probably wouldn't mind), but otherwise, no access is possible. In Germany, every company and many people publish their account number, so they can receive payment. Every invoice contains address, phone number, and account numbers of the company that bills you, so you are able to send them money to pay the invoice. Nobody can access the money or details of your account with only the name and number; it needs your online login user id and password, or your (government issued) ID to do so. You don't need to worry at all. I can't address the psychology of trust involved in your question, but here are some common sense guidelines for dealing with your issue. Make sure you know who you are talking to.  Call the company you need to speak to via a publicly available phone number. An email or something you got in a letter might be from a different source.  If you use a website, you should be sure you are on the correct website. Keep careful records.  Make good notes of each phone call and keep all emails and letters forever. Note the time, name and/or ID of the person you spoke to and numbers called in addition to keeping notes on what actions should be done.  Keep your faxing transmission receipts and shipping tracking numbers too. If you are nervous, ask them why they want the info.  The fraud department should be able to explain it to you.  For example, they probably want your social because that is how your credit report is identified.  If they are going to fix a credit report, they will need a social.  It is doubtful they would have a good explanation why they need your mother's maiden name. Ask for secure transmission, or confirm they have it.  Postal mail isn't so secure, but I'll go out on a limb and say most fax machines today are not really fax machines, but software that deals in PDFs.  At some point you will have to realize you will have to transmit something.  No method is perfect, but you can limit your exposure. Help them do their jobs.  If you are (understandably) nervous, consider their motivations: corporate profit.  BUT that could very well mean not running afoul of the law and (with any luck) treating customers the best way they know to earn business.  If you stymy the fraud department, how can they help you? If the ID theft was serious enough, document your issue for future law enforcement so you getting pulled over for speeding doesn't result in you going to jail for whatever crime the other person did.  Perhaps the fraud department you are dealing with can assist there. Finally, while you work with fraud departments to clear up your name and account, work on the other end to limit future damage.  Freeze your credit.  See if you bank or credit card have monitoring.  Use CreditKarma.com or a similar if you cannot find a free service.  (Please don't ever pay for credit monitoring.) You could make an entry for the disputed charge as if you were going to lose the dispute, and a second entry that reverses the charge as if you were going to win the dispute.  You could then reconcile the account by including the first charge in the reconciliation and excluding the reversal until the issue has been resolved. "File a John Doe lawsuit, ""plaintiff to be determined"", and then subpoena the relevant information from Mastercard.  John Doe doesn't countersue, so you're pretty safe doing this.  But it probably won't work.  Mastercard would quash your subpoena.  They will claim that you lack standing to sue anyone because you did not take a loss (which is a fair point).    They are after the people doing the hacking, and the security gaps which make the hacking possible.  And how those gaps arise among businesses just trying to do their best.  It's a hard problem.  And I've done the abuse wars professionally.  OpSec is a big deal.  You simply cannot reveal your methods or even much of your findings, because that will expose too much of your detection method.  The ugly fact is, the bad guys are not that far from winning, and catching them depends on them unwisely using the same known techniques over and over.  When you get a truly novel technique, it costs a fortune in engineering time to unravel what they did and build defenses against it.  If maybe 1% of attacks are this, it is manageable, but if it were 10%, you simply cannot staff an enforcement arm big enough - the trained staff don't exist to hire (unless you steal them from Visa, Amex, etc.)  So as much as you'd like to tell the public, believe me, I'd like to get some credit for what I've done -- they just can't say much or they educate the bad guys, and then have a much tougher problem later.  Sorry!  I know how frustrating it is! The credit card companies hammered out PCI-DSS (Payment Card Industry Data Security Standards).  This is a basic set of security rules and practices which should make hacking unlikely.  Compliance is achievable (not easy), and if you do it, you're off the hook.  That is one way Amy can be entirely not at fault.  Example deleted for length, but as a small business, you just can't be a PCI security expert.  You rely on the commitments of others to do a good job, like your bank and merchant account salesman.  There are so many ways this can go wrong that just aren't your fault.   As to the notion of saying ""it affected Amy's customers but it was Doofus the contractor's fault"", that doesn't work, the Internet lynch mob won't hear the details and will kill Amy's business. Then she's suing Mastercard for false light, a type of defamtion there the facts are true but are framed falsely.   And defamation has much more serious consequences in Europe.  Anyway, even a business not at fault has to pay for a PCI-DSS audit.  A business at fault has lots more problems, at the very least paying $50-90 per customer to replace their cards.  The simple fact is 80% of businesses in this situation go bankrupt at this point.   Usually fraudsters make automated attacks using scripts they got from others.  Only a few dozen attacks (on sites) succeed, and then they use other scripts to intercept payment data, which is all they want. They are cookie cutter scripts, and aren't customized for each site, and can't go after whatever personal data is particular to that site. So in most cases all they get is payment data. It's also likely that primary data, like a cloud drive, photo collection or medical records, are kept in completely separate systems with separate security, unlikely to hack both at once even if the hacker is willing to put lots and lots of engineering effort into it.  Most hackers are script kiddies, able to run scripts others provided but unable to hack on their own.   So it's likely that ""none was leaked"" is the reason they didn't give notification of private information leakage.  Lastly, they can't get what you didn't upload.  Site hacking is a well known phenomenon.  A person who is concerned with privacy is cautious to not put things online that are too risky.  It's also possible that this is blind guesswork on the part of Visa/MC, and they haven't positively identified any particular merchant, but are replacing your cards out of an abundance of caution." When you want to pay a bill on line there are several ways to do it. You can give them your credit card details: Name on Card, zip code, credit card number, and 3 or 4 digit security code on the back. Most of the information is available on the card or via an easy Google search. If the crook has your card they can use it to buy something.  You can contact your bank's website and establish a one time or recurring transfer. You provide the information about the person/company. Your bank knows who you are because you used a secure system and your password. Their bank accepts the money because who would refuse money, they don't care who you are. You can provide the company with your bank info (bank number, your account number, and your name). If your bank limits their transactions via this method only to legitimate organizations, then your money will only be sent to legitimate organizations. But if the organization has no way of knowing who is on the other end of the phone or webpage, they may be withdrawing money from a bank account without the account owners permission.  In the example article a person found a charity that had lax security standards, they were recognized by the bank as a legitimate organization, so the bank transferred the money. The charity will point to the form and say they had permission from the owner, but in reality they didn't.  The subject of the article was correct, all the info required is on every check. It is just that most people are honest, and the few security hurdles that exist do stop most of the fraud. While it's wise, easier and safer to check your transactions online a few times a month, I opt to receive and file paper statements as a hard copy back up of account history. Any reconciliation I perform is a quick glance to make sure the numbers sound right. It's probably a small waste of time and space, but it settles some of my paranoia (due to my training as a computer engineer)  about failure of electronic banking systems. If someone tampers with bank records or a SAN explodes and wipes out a bunch of account data, then I will have years worth of paper statements to back up my numbers.  Having years worth of statements printed on the banks stationary will have better credibility in court than a .pdf or printout thereof that could have been doctored, in case I ever needed to take my bank to court. A little piece of mind for the price of a letter opener, a square foot file box and a couple of minutes a month.