Never type these into any website chatbot
Full card numbers, passwords, national ID or passport numbers, and full account credentials should never be typed into a chat widget — no legitimate business needs them that way, and a chat log is not designed as secure storage for sensitive data the way a proper payment processor or authentication system is.
This holds even if the chatbot seems to be asking for it directly — a legitimate business's chatbot should never request this information through chat, and if one does, that's a red flag about the business, not a reason to comply.
What's usually fine
General questions, a first name, an order number for reference, or a general location for a delivery question are typically fine — this is exactly the kind of information the chat is actually designed to help with, and sharing it doesn't create meaningful risk.
The general test: would you be comfortable if this specific piece of information were visible to a support person reading a transcript later? Most everyday chatbot questions clear that bar easily; financial and identity credentials don't.
For site owners: don't ask for more than you need
If your chatbot flow asks for anything sensitive, redirect that step to a proper secure form or your existing checkout/account system instead of collecting it through chat. This isn't just good practice for visitor trust — it also reduces your own liability, since you're not storing sensitive data in a system that wasn't built to protect it.
Review your chatbot's flows periodically with this lens: does any step ask for something it genuinely doesn't need to answer the question at hand? If so, that's worth removing.
A simple rule of thumb for visitors
If a human agent at the business wouldn't normally ask for it over a live chat window, don't type it into the AI version either. Businesses that need sensitive information — payment details, ID verification — almost always have a dedicated, secure flow for that, separate from casual chat.
