We only need statement-level totals — never a card number, account number, or login. Two short steps.