I was recently the victim of credit card fraud and I suspect it is from a merchant somewhere keeping track of my credit card details.
I cancelled the card and received a new one, but I would like to make it as difficult as possible for criminals in brick-and-mortar stores to copy my card details.
What parts of the credit card can I save to a password vault and obscure by scratching over/off and still have it be valid?
If you deface a credit card, you are likely to find it will be rejected for all transactions. The merchant really needs all the info on the card to be valid - it's part of how they protect themselves from fraud.
So my answer would be: none!
Instead of worrying about that, concern yourself more with how the merchants handle your card. In the UK, for example, a customer never needs to let go of the card in most stores now, as contactless is almost ubiquitous. But if you have to hand over your card, watch it like a hawk. Handheld terminals brought to you are safer than letting someone take your card away.
And remember, if the merchant commits fraud, your bank will reimburse you so it's not the end of the world.
I put a small sticker over the CVV to avoid it being casually seen. The CVV is the three-digit code on the back of the card beside the signature, needed when you buy things on the Internet but not otherwise. A merchant who takes your card and checks the signature can easily remember the three digits, and I think this was what happened the one time my credit card details were abused.
Not having the CVV visible doesn't prevent normal operations, and I can remember it easily. I chose not to scratch it out since it is actually etched into the card, and scratching it to the point of illegibility would have noticeably damaged the card. The sticker would be easy to scratch off if I ever needed to. Nobody has ever asked me to... but I have a European card, I use chip-n-pin, I cannot remember anyone ever looking at the back of the card since the incident where I think my details were stolen.
The better answer is to use Virtual Credit Cards. You can create a throwaway number with a transaction limit and time limit for dealing with each unknown vendor/merchant, you can also set an amount limit on recurring billings. Check what virtual CC setup either your CC vendor (Mastercard, Visa) or issuing bank (BoA, Citi) has. Check the amount of time to setup each VCC number, the ease of setup (website/app?), the minimum time it can be alive for.
Don't expose your real CC number and CSC to untrusted people/merchants. That's a more scalable solution than exposing it. Even now that the US is belatedly moving to smartchip technology, decades behind other countries.
The way you phrase your question seems to indicate that you think it's a bad apple at a merchant who is stealing your credit card, namely by using a manual method of writing down card details. Let me tell you, that that is extremely unlikely. All of your card's basic information (name, account number, etc.) is embedded within chip data, as well as in the mag-stripe. I can tell with you very near certainty that your old credit card information was stolen electronically, probably through a merchant with a compromised system.
There is literally nothing you can do to protect against electronic theft (when you use it as a card-present transaction) other than use more modernized encrypted transactions (e.g. chip), or tokenized transactions (Apple Pay, Samsung Pay, Google Wallet). If you're really paranoid about it (you don't really need to be), you can just use cash if the store doesn't accept EMV chip or tokenized.
Additionally, like others have stated, physically defacing your card is not only flatly ineffective against protecting you from 99% of modern card information theft (i.e. electronic theft), but it's also a huge red-flag for anyone that would physically handle it. They are instead likely to suspect that it is you who is a fraudster, trying to pass a counterfeit card off as a real on, as in this over-simplified scenario:
You: "Oh, you can just disregard the name on the card... it just wore off."
Them: "Uhuh... That doesn't happen. Give me a fully legible card, and a matching ID, or your sale is denied."
Yor credit card has the card number, expiration date, cardholder name, and possibly an additional short security code that you could conceivably remove from the physical card and store in a password safe.
But all of these (except, I think, the additional security code) are needed by the merchant. So you can't tamper with any of them.
Besides, the merchant checks those, along with your signature, a hologram if present, whether the magnetic stripe is intact, whether the card chip looks tampered with, etc to determine if the card is a fake. In fact, credit card companies instruct merchants to consider any sign of tampering with the card as suspicious. Google "spot fake credit card" and you get relevant best practice documents.
Which parts of a credit card can I obfuscate and still have it be valid?
You can obfuscate all of it if you use Samsung Pay (No scratching necessary, in fact, scratching your card is a bad idea. Do not scratch anything).
Note, I did not say Apple Pay (like another answer did), I said Samsung Pay. Skip to my 4th point if you want to see how Samsung Pay specifically differs from Apple Pay.
You enter your credit card information into your phone
When you need to make a payment, you trigger Samsung Pay and you authenticate by using a PIN or your fingerprint.
The phone generates a unique credit card number for each transaction.
Important part: Samsung Pay is also backward-compatible. So even if the payment terminal doesn't accept mobile NFC payments, you can just tap the back of your phone to where the magnetic reader is and your phone will mimic the magnetic strip of the unique credit card it generated (this will work on all US terminals that have their magnetic readers on the edge of its machine and not embedded deeply within the machine itself).
If it's a pre-authorization, it initially shows up as a $1 amount with the bank, which will later morph into whatever amount the establishment decides to finally charge you. If they make you fill out a paper form in addition to the electronic pre-authorization, you only put the last four digits of the generated credit card number on the form, along with asterisks in front of it. And if they want to check the authenticity of your signature, you present your phone (or your watch to them) so they can compare signatures.
If this answer looks a little bit familiar, it's because it's self-plagiarized and modified from an answer I wrote to a question on traveling in the US for work using a government credit card.
