Legitimate businesses will not ask you to reveal such sensitive information. If you receive such a request, double check the URL, visit the business’ main website, or call their hotline for clarification.