Educational only · Digital card security
Virtual cards &
safer online payments.
Virtual cards are digital card numbers that sit on top of your physical credit card account. They can be disposable, merchant-locked or time-limited — designed to reduce the impact of data breaches and online fraud.
This guide explains how virtual cards work, how tokenization differs from “just another card number”, and what to pay attention to before you rely on virtual cards for everyday use.
- How virtual card numbers are created and managed.
- Different models: single-use, merchant-locked, time-limited.
- What happens if a virtual number is leaked in a breach.
Informational only. Not financial advice or a recommendation to use any specific product or provider.
Key ideas in this guide
- Virtual cards sit on top of your underlying card account.
- Many issuers let you generate multiple digital numbers for different merchants.
- Tokenization means the merchant never sees your “real” card number.
- Virtual cards can help limit damage after data breaches and leaks.
- You still need to follow basic security hygiene: strong device lock, updated OS, careful with phishing.
How virtual card numbers actually work
A virtual card number is usually issued by the same bank or card issuer that gave you your physical card. Instead of embossing the number on plastic, it exists only in your banking app or browser extension.
When you pay online, you type in or auto-fill the virtual number. Behind the scenes, the issuer maps that virtual number back to your real account. If a merchant database is later compromised, the issuer can simply deactivate the specific virtual number instead of cancelling your main card.
- Single-use: virtual numbers that work for one transaction only.
- Merchant-locked: numbers that only work with a specific merchant ID.
- Time-limited: numbers that expire after a set period or spending cap.
Tokenization in wallets and apps
When you add a card to a digital wallet, the wallet provider often creates a payment token — a device-specific, encrypted version of your card details. Terminals and merchants see the token, not the real number printed on your card.
This is a form of virtual card as well: the number that travels through the network is different from the one on your plastic. If somebody skims transaction data, they cannot simply reuse it in a different context or on a different device.
Benefits, limitations and what to look for
Virtual cards can reduce the pain of card replacement after breaches and may limit fraudulent charges. However, they do not remove all risk and they do not replace basic security habits.
- Check whether your issuer supports merchant-locked or single-use numbers.
- Look for clear controls in the app to freeze, delete or regenerate virtual cards.
- Be aware that recurring subscriptions may break if you delete a virtual number.
- Some brick-and-mortar stores require the original physical card for refunds.
For a broader view of wallets, tap-to-pay and crypto-linked cards, visit the Technology & Payments hub on Choose.Creditcard.