You get a call from someone who says he's working for your credit card provider:
"Sorry to disturb you, but there has been some activity on your card that we believe might be fraudulent. Did you just purchase $487 worth of products at Winni's in Raleigh, North Carolina?"
Shocked and confused, you offer a hurried, "no." The man asks you whether you have lost your wallet or if you have your credit card in your possession.
You say you do have it, so he proceeds to confirm your credit card number. To build your trust, he'll read you the full number on the front of the card and the first four digits on the back of the card. But he tells you he needs to confirm the last three digits on the back. You read them, he says "That's correct," and tells you that your money will be refunded in five business days.
As you may have guessed, the money won't be refunded, and you will be faced with several new charges. Scammers can get the bulk of your credit number from receipts--but it's the security numbers that you just gave him that really grant him access to everything.
How to avoid: the only reason you should ever need to give those numbers is if you're making a purchase. And if your credit card company wants to confirm your identity, they'll use things like your birthday or postal code; not sensitive baking information. And if you're ever skeptical, you can always hang up and dial the number on the back of your card. That way, you can be sure of whom you're talking to.