Elon Musk Gives Financial Advice To 'Take a Picture of Your Credit Card', and Replies Are Hilarious

Elon Musk has urged shoppers to 'just take a picture of your credit card' and send it to his Grok AI bot to buy items online, triggering privacy warnings, mockery and fresh questions over payment security.

On Saturday 10 October 2026, the billionaire told X users they could simply upload a photo of their credit card to Grok Bot, an AI assistant designed to carry out tasks such as shopping. His follow-up LEGO shopping demonstration then appeared to reveal checkout details in a publicly shared screenshot.

The controversy began when Musk promoted Grok Bot as a shopping helper and suggested bypassing the usual process of manually entering card details during checkout.

'To buy stuff, you can just take a picture of your credit card, drop it in the chat and Grok @Bot will scour the Internet for the best deal on the item you want and order it,' Musk wrote in his X post.

The post described a possible shopping method but did not explain how card photographs would be handled. Musk later claimed Grok had ordered LEGO products, although that did not verify the photograph-based payment method.

Why Musk's Grok Credit Card Tip Sparked Privacy Questions

A Community Note on Musk's post contrasted his suggestion with the company's published guidance on personal data. It cited both an earlier consumer privacy policy and separate terms governing Grok Bot.

'xAI explicitly warns users not to include personal information in prompts, yet credit card photos may contain such information. Grok Bot's terms state that user data and credentials may be stored in its cloud environment and require human review for financial transactions,' the note said.

That warning requires a qualification. The company's privacy policy effective 24 August told users not to submit personal information in prompts. An updated version, dated 11 October, removed that blanket instruction from the same section.

The newer policy discusses payment information and content supplied by users. It states that Grok accessed through X falls under X's privacy rules rather than this consumer policy. Grok Bot's separate terms also operate under applicable customer agreements, not automatically every X conversation.

Those terms call for appropriate human review of financial transactions. Meanwhile, Grok Bot's official changelog describes a purchasing process introduced on 28 August, involving Stripe's Link wallet.

Under that documented process, shoppers see a purchase amount and choose whether to allow or deny the transaction. Stripe says its agent wallet uses temporary payment credentials without giving an AI agent access to raw card details.

Musk did not specify whether his proposed photograph method uses those safeguards. Uploading an image containing card details is not the same as approving a payment through a wallet.

According to Mashable, Grok itself offered a caution when asked whether the idea was 'totally safe or stupid and dangerous.' The chatbot reportedly answered 'neither,' then advised users to 'not drop an actual credit card photo.' Its response was not an independent security assessment.

Jokes, Memes And A LEGO Test Order

Online responses supplied plenty of ridicule. One X user asked Grok for Musk's own credit card, while another joked about handing over an entire DNA sequence. In a Reddit discussion, one commenter replied, 'Yeah that's gonna be a hard pass.'

Then Musk offered an example of the shopping experience. On Sunday, 11 October, he posted a screenshot appearing to show Grok Bot arranging an order for five LEGO Star Wars sets.

'I just asked Grok @Bot to research the most fun Lego Star Wars kits for young kids and order them. As easy as that,' he wrote in his follow-up post.

The image appeared to contain shipping and billing details, an email address, an order reference and partial payment information. Those details became public because Musk posted the screenshot, not because a breach of Grok or LEGO was established.

Musk said an address visible in the image was where his security team received mail, not his home. After another X user claimed to have cancelled the order, Musk disputed that account. No independently verified successful cancellation has been established.

The screenshot provided a glimpse of Grok Bot's shopping capability but could not establish how the order was paid for. It also left the original question unresolved. Whether customers can safely submit card photographs through the suggested process remains undocumented in the material reviewed.