Among the internet banking users, few of them exposed their codes on security card by themselves due to the phishing/pharming. In this paper, we analyze the types of pharming attack, then we propose an improved method. Our method compliments the existing methods, it applied instruction number pool. From the key pool, instruction number codes are extracted as several key subset. Security card code array is composed by these subset. Consequently, our method lowered the security card information leakage risks by human error compared to the existing methods.