Phone systems that give you the prompt, “Press # for more options” etc are called Interactive Voice Response (IVR) systems. If you encounter an IVR that asks for credit card info, social security number, etc, don’t enter it in! If you stay silent, you will usually be routed to an agent, though that varies on whichever system you are calling into.

Even if the system is designed for completely non-nefarious purposes, the IT people who maintain the phone system can analyze call logs to pull electronic keypresses (DTMF) and reconstruct every digit entered to capture your data. Most IT people would never consider abusing this access, but some organizations contract or sub-contract their phone support out to the lowest bidding third parties and might not do a great job of vetting their techs.

Giving this information to a live agent has its own risks, but if you initiated a call to a documented telephone number for the organization you are trying to reach, it is generally a safer option than keying in sensitive digit strings to an IVR. It is much harder for anyone outside of the call center to scan recorded audio for information like this. (Though technology is closing that gap)