When you type your real card number into a website, its safety depends on every system that stores it, and when one of those merchants is breached, you replace the card and update every subscription that used it. Virtual card numbers break that dependency by giving each merchant or purchase its own number that you can limit, pause or delete without touching your main account. This guide explains the types of virtual card (single-use, merchant-locked, category-locked, spend-limited), how they differ from wallet tokens such as Apple Pay, what they do and do not protect, how they interact with refunds and legal protections, and how to use them well. It is for individuals, finance and procurement teams who issue cards to staff, and security teams advising both.
Key takeaways
- A virtual card is a separate number on the same account. It has its own 16-digit number, security code and expiry date, so a leak exposes only that number, not the card you use everywhere else.
- Merchant locking is the most useful control. A number locked to one merchant is useless to a thief who steals it from that merchant's database or payment page.
- Single-use numbers suit one-off purchases, not subscriptions. Use a merchant-locked number with a spend limit for anything recurring, so you can cancel by deleting the card.
- Your legal protections come from the funding account. A credit-funded virtual card normally carries credit card protections; a debit or prepaid-funded one carries the weaker debit protections.
- Virtual cards do not stop scams you authorise. If you knowingly pay a fake shop, the number worked as intended; dispute rules, not the card, decide whether you get money back.
What a virtual card number is
A virtual card number is an additional card number linked to an existing credit, debit or prepaid account, generated in an app or online banking and normally used only for online, phone or in-app payments. Capital One, for example, describes each of its virtual cards as having its own 16-digit number, security code and expiry date, and says a virtual card can be locked or deleted without affecting the underlying credit card account. Charges appear in the same transaction history as the main card.
The idea is the same one behind network tokens, applied by the consumer instead of the merchant: the credential a merchant holds should work only where it is supposed to. Merchants and payment providers use network tokens to protect cards they store; virtual cards let the cardholder impose the restriction themselves. See the Network Tokenisation for Payments Guide for the merchant side.
Types of virtual card
| Type | How it behaves | Best for | Watch out for |
|---|---|---|---|
| Single-use (disposable) | Works for one transaction, then closes or regenerates | One-off purchases from unfamiliar shops, marketplace sellers, one-time bookings | Refunds still return to the account, but partial shipments, pre-authorisations and later charges can fail |
| Merchant-locked | Locks to the first merchant that charges it and declines everywhere else | Subscriptions, utilities, regular online shops | A merchant that bills through a different processor or entity name may be declined |
| Category-locked | Works only at merchants in a defined category | Business spend controls (travel, software, advertising) | Merchant category codes are set by the merchant's acquirer and are not always accurate |
| Spend-limited | Declines above a per-transaction, monthly or lifetime limit | Free trials, price-capped subscriptions, staff cards | Price rises and currency conversion can cause declines |
| Open ("everywhere") | Works at any merchant until paused or deleted | Masking the main card where locking is not possible | Least protection if the number leaks |
Not every provider offers every type. Privacy.com, a US provider, lists single-use, merchant-locked, category-locked and "everywhere" cards with spend limits and pause or close at any time, funded from a linked US checking account. Capital One offers merchant-specific virtual numbers, some of which can be set to expire after a single use. Provider names are given only to illustrate the feature types, not as recommendations; check your own bank's documentation, as features change.
Virtual cards, wallet tokens and other options compared
| Option | What the merchant receives | Can you cancel one merchant without a new main card? | Works in shops? |
|---|---|---|---|
| Main card number typed in | Your real card number | No: a leak means replacing the card | Yes |
| Virtual card number | A separate number you control | Yes: delete or pause that number | Usually not; Capital One says its virtual cards cannot be added to digital wallets for tap-to-pay in stores |
| Device wallet (Apple Pay, Google Pay) | A device-specific token; Apple describes Device Account Numbers held in the device's Secure Element and managed by its servers | You can remove the card from the wallet; merchants never received the real number | Yes, contactless |
| Merchant-stored network token | A token restricted to that merchant, provisioned by the merchant's provider | Not directly by the cardholder in most cases | Not applicable |
| Prepaid or gift card | A separate card number with a fixed balance | Yes, but the balance is at risk | Sometimes |
Choosing: in shops, a device wallet already avoids exposing the real number. Online, where the merchant asks you to type a number and may store it, a merchant-locked virtual card gives the most control. Use single-use numbers where you never expect another charge.
What virtual cards protect against, and what they do not
- Merchant breaches and payment page skimming: stolen merchant-locked or used single-use numbers fail elsewhere. Large-scale theft of stored card data from retailers, such as the AI Agent Retail Card Theft Campaign 2026, is exactly the situation in which a locked number is worth far less to the thief. See the Web Skimming Incident Playbook for how payment pages are compromised.
- Unwanted renewals and hard-to-cancel subscriptions: deleting the number or setting a low limit stops future charges. You may still owe the merchant under the contract; the card only stops the payment. See the Fake Renewal and Refund Scams Guide.
- Card testing: criminals test stolen numbers with small charges. A paused or locked number fails those tests. See the Card Testing and Carding Attacks Defence Guide.
- Linking your identity across merchants: separate numbers stop merchants or data brokers matching you across shops by card number, though name, billing address and email still identify you. Pair with the Email Aliases and Masked Email Guide.
- Not protected: account takeover. If someone takes over your banking app, they can create virtual cards too. Strong authentication on the banking login matters more than any card setting.
- Not protected: authorised push scams and fake shops. The number did its job when you paid; recovery depends on dispute rights. See the Protecting Your Personal Finances Online guide.
Legal protections depend on the funding account
Virtual card numbers do not create new legal rights; they inherit the protections of the account behind them. The figures below are taken from the official rule texts (CFPB eRegulations for Regulation Z and E, legislation.gov.uk for the Consumer Credit Act) as checked in November 2026. This section summarises and is not legal advice. Confirm against the official text before relying on it.
| Jurisdiction and funding | Rule | What it says |
|---|---|---|
| US, credit card | Regulation Z, 12 CFR 1026.12(b) | According to 12 CFR 1026.12(b), cardholder liability for unauthorised use does not exceed the lesser of $50 or the amount obtained before the issuer is notified; a lower amount applies if state law or the agreement sets one. The FTC consumer guidance on disputing charges also advises that a billing error dispute letter should reach the issuer within 60 days after the first bill with the error was sent. |
| US, debit card or account transfer | Regulation E, 12 CFR 1005.6(b) | According to 12 CFR 1005.6(b), liability is up to the lesser of $50 or the amount taken if reported within two business days of learning of the loss or theft; up to $500 if later; and potential liability for later transfers if an unauthorised transfer on a statement is not reported within 60 days of the statement being sent. |
| UK, credit card | Consumer Credit Act 1974, section 75 | Under section 75 as published on legislation.gov.uk, for a single item with a cash price over £100 and up to £30,000, the card provider is jointly and severally liable with the supplier for misrepresentation or breach of contract. |
Practical consequence (NHI Mgmt Group recommendation): where you have the choice, fund virtual cards from a credit account rather than a debit account, especially for merchants you do not know. Debit-funded virtual cards (common with app-based banks and some US providers that link a checking account) still protect the main number, but losses come from your current account while disputes run.
How to set up and use virtual cards
- Find out what your bank or card issuer offers. Many issue virtual numbers in the app; eligibility rules apply. Capital One, for example, requires identity verification and notes some customers may wait about 30 days after account opening.
- Secure the banking login first. Use a strong unique password, app-based or passkey sign-in and transaction notifications, because anyone in your banking app can mint cards.
- Create one merchant-locked card per recurring merchant and name it after the merchant, so you know which number to delete when a breach is announced.
- Set limits: slightly above the expected charge for subscriptions; at the exact amount, or single-use, for one-off purchases.
- Use single-use numbers for unfamiliar shops, marketplaces and one-off bookings. Avoid them where the merchant pre-authorises and charges later (hotels, car hire, deposits) or where partial shipments are common.
- Keep a list of active virtual cards in your password manager notes or the bank app, and review it every few months: delete cards for merchants you no longer use.
- When a merchant reports a breach, delete that merchant's number and issue a new one. Your main card and other merchants are unaffected. See the What to Do After a Data Breach Guide.
Rolling back: if a merchant keeps declining a locked or limited card, raise the limit or create a fresh merchant-locked number rather than falling back to the main card.
For organisations: virtual cards for staff and supplier spend
- One card per supplier or SaaS subscription: spend is attributable, and cancelling a tool is a card deletion, not a hunt through statements.
- Owner on every card: record which person or team owns each card; a card owned by a leaver is an orphaned recurring payment, the same way an orphaned account is an orphaned identity.
- Shadow IT signal: virtual card statements show SaaS bought outside procurement; feed them into your SaaS discovery process. See the Shadow SaaS and Unsanctioned App Discovery Guide.
- Approval and limits: require approval to create cards above a threshold and use category locks for travel or advertising spend.
- Agents and automation: where AI agents or scripts are allowed to buy, give them their own merchant-locked, spend-limited cards that can be revoked instantly. See the AI Shopping Agents Safety Guide.
Detection and measurement
- Turn on real-time notifications for every transaction and for every new virtual card created; an unexpected new card is a strong sign of banking account takeover.
- Watch for declines on locked cards: a decline at an unrelated merchant on a merchant-locked number means the number leaked, which tells you which merchant to suspect.
- Metrics: share of recurring merchants on merchant-locked numbers; share of active virtual cards with an owner (organisations) and a spend limit; number of cards unused for 90 days or more; number of locked-card declines from unexpected merchants (leak signals); time from merchant breach notice to number replaced.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SI-12(1) Limit Personally Identifiable Information Elements | Giving each merchant a different, restricted payment credential limits what each holds |
| NIST SP 800-53 Rev. 5 | AC-21 Information Sharing | Deciding which credential is shared with which external party |
| NIST CSF 2.0 | GV.SC-05 | Supplier requirements; for organisations, card controls tie spend to approved suppliers |
| PCI DSS v4.0 | Merchant obligations (see the PCI DSS 4.0 Guide) | Virtual cards reduce the cardholder's exposure when a merchant fails to protect stored card data; they do not change the merchant's PCI DSS duties |
Common failure patterns
- Using single-use numbers for subscriptions or hotels: the next charge or the final bill fails, and service is cut off.
- Funding everything from debit: the main number is protected, but a fraudulent charge on the virtual number still drains the current account during the dispute.
- Weak banking app security: an attacker in the app creates their own virtual cards, which bypasses the whole idea.
- No inventory: dozens of open "everywhere" cards with no names or limits give little more protection than the main card.
- Believing a virtual card makes a payment refundable: it does not change dispute rights for payments you authorised.
- Orphaned business cards: staff leave and their supplier cards keep paying.
Practitioner checklist
NHI Mgmt Group recommends the following checks.
- Check what virtual card types your issuer offers and whether they are credit or debit funded.
- Secure the banking login with strong authentication and turn on transaction and new-card notifications.
- Use a merchant-locked, spend-limited number for every recurring merchant.
- Use single-use numbers for one-off purchases from unfamiliar merchants, not for hotels or pre-authorisations.
- Prefer credit-funded virtual cards for stronger dispute rights.
- Name each card after its merchant and review the list quarterly.
- Replace a merchant's number as soon as it reports a breach.
- Organisations: one owned, limited card per supplier or SaaS tool, with leaver checks.
Standards and references
- CFPB: Regulation Z 12 CFR 1026.12 Special credit card provisions
- CFPB: Regulation E 12 CFR 1005.6 Liability of consumer for unauthorized transfers
- legislation.gov.uk: Consumer Credit Act 1974 section 75
- FTC: Using Credit Cards and Disputing Charges
- Apple: Apple Pay component security
- Capital One: Virtual card numbers
- Privacy.com: Virtual cards
Related NHI Mgmt Group resources: Payment Fraud Guide · Network Tokenisation for Payments Guide · EMV 3-D Secure Guide · Credit Freezes and Fraud Alerts Guide. This guide summarises consumer payment protections and is not legal advice.