You can get a one-time use credit card number in a few minutes through your existing credit card issuer’s app or browser extension, or through a standalone service like Privacy.com. Once your identity is verified, the tool displays a 16-digit number, security code, and expiration date that you type into any online checkout the same way you would with a physical card. The differences between providers come down to whether the number is truly single-use or locked to one merchant, whether you can set a spending cap, and what protections apply if a charge goes wrong.
Where to Get a Virtual Card Number
Two kinds of providers issue these numbers, and the choice affects your legal protections more than most people realize.
From Your Credit Card Issuer
Capital One’s Eno is the most direct option. Install the free Chrome extension, and it pops up at checkout to offer a virtual number tied to that specific merchant. The number keeps working for future purchases at the same store but is useless anywhere else, and you still earn your normal rewards.1Google. Eno from Capital One – Chrome Web Store
Chase uses Paze, which appears as a payment option at participating merchants and substitutes a token for your real card details. You activate it once through the Chase Mobile app, then select Paze at checkout. It only works where merchants support it, so you can’t paste a number into an arbitrary form.2Chase. Paze – Digital Payments
Citi and American Express also offer virtual numbers, with different mechanics. Amex routes them through Google, so you add your card to your Google account and shop using Chrome or an Android device. Not every cardholder qualifies for every issuer’s program. Look for a “virtual card” or “digital wallet” option in your card’s online dashboard before assuming you have access.
From a Third-Party Service
Privacy.com is the most widely used standalone option and works regardless of which bank issued your credit card. You link a bank account, not a credit card, and Privacy generates virtual debit card numbers you can use at any online checkout. The free Personal plan allows up to 12 new cards per month.3Privacy Virtual Cards. How Many Privacy Cards Can I Create Privacy earns money from merchant interchange fees and states it will not sell your personal data.4Privacy Virtual Cards. Virtual Cards To Protect Your Payments
One distinction shapes everything downstream. Numbers from your credit card issuer are credit card numbers and carry credit card protections. Numbers from Privacy.com are debit card numbers pulled from a linked bank account, and different federal rules apply. More on that at the end.
Setting Up Access
Federal regulations require any provider to verify your identity before issuing virtual numbers. Every financial institution must collect your name, date of birth, residential address, and taxpayer identification number (usually your Social Security number) before opening an account.5eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks If you already have a credit card with the issuer, this step is behind you.
For a third-party service, you’ll complete verification when you create the account and link your bank, typically confirming the bank connection through a micro-deposit or instant login. You’ll also click through an electronic disclosure consent screen, which is a federal requirement covering how you receive your records and what hardware you need to access them.6Federal Reserve Bank of Minneapolis. E-SIGN Act Requirements
Generating the Number
Once your account is active, the process takes under a minute. Steps vary by provider, but the pattern is consistent:
- Open the tool from your banking app, the browser extension icon, or the third-party dashboard.
- Choose the card type. Single-use numbers die after one transaction. Merchant-locked numbers stay reusable but only at the first store where you use them. For a subscription you plan to keep, merchant-locked is the better fit.
- Set a spending cap if the provider offers one. For free trials, setting the limit to $1 makes the card decline any later charge automatically.
- Complete multi-factor authentication, usually a code sent to your phone.
The system then displays a 16-digit number, three-digit security code, and expiration date arranged like a physical card. The number is active immediately. Most providers show the full digits only briefly before masking them, but you can retrieve the number later from your dashboard.
Using It at Checkout
Type the 16-digit number, expiration date, and security code into the payment fields exactly as you would with a physical card. Merchants process these details through the normal payment networks. With a checkout-integrated service like Paze, you select it as your payment method and verify your identity instead of copying digits.
The billing address you enter must match the address on file with the issuer of your underlying account. Merchants check what you typed against the bank’s records through an address verification system, and a mismatch will often block the transaction.7Mastercard. Address Verification Service This applies even though the card number itself is temporary.
The charge appears on your primary account’s statement with a specific transaction identifier. You can watch it post in real time through your banking app. If you set a spending cap, any charge above that limit is declined automatically.
Where Virtual Numbers Won’t Work
These numbers are built for online forms. They fail predictably anywhere physical plastic is expected.
Car rental agencies almost universally require a physical credit card at pickup. Agents swipe or insert a card to place the security deposit hold, and virtual numbers can’t be swiped. Airport locations tend to be strictest.
Hotels behave similarly. Many front desks insist on a physical card for incidental holds even when you prepaid online. Some accept Apple Pay or Google Pay at the desk; others require plastic. If you’re checking into a hotel, bring your physical card.
Gas pumps, vending machines, and any point of sale that reads a chip or tap are also out. Virtual numbers only work where you can type the digits into a form.
Refunds and Returns
Refunds to expired or deleted virtual numbers almost always route back to your underlying account, because the card network matches the refund to your primary account using internal records even when the specific virtual number no longer exists.
If automated routing fails, Visa’s rules allow a merchant to issue the refund as cash, check, or store credit instead.8Visa. Processing Refunds to Cardholders in a Merchant Store Location In practice, online merchants push refunds back to the original payment method because network rules point them that way. If you might return something, don’t delete the virtual number until the refund posts.
Killing Subscriptions and Free Trials
Every provider offers a dashboard where you can pause, lock, or permanently delete any virtual number. Deleting a number removes it from the active registry, and future charges from that merchant are declined at the network.
That’s the most practical use of these cards. If you signed up for a service using a virtual number and want out, deleting or pausing the card stops the merchant from billing you again, because the number no longer exists. For free trials, this is more reliable than remembering to cancel by a deadline.
Single-use cards handle their own cleanup and deactivate after the first successful charge. Merchant-locked cards stay active but reject any vendor other than the first one you used them with, so a leaked number is useless to a thief.
Your Protections If Something Goes Wrong
Virtual numbers inherit the protections of the account behind them, and the account type controls which rules apply.
Numbers generated by a credit card issuer sit under the Truth in Lending Act. Your liability for unauthorized charges is capped at $50, and the cap applies only if the issuer gave you notice of that liability and a way to report unauthorized use.9Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Every major issuer offers a $0 liability policy that goes beyond the statute. The Fair Credit Billing Act also gives you a formal right to dispute billing errors and unauthorized charges, with strict timelines the issuer must meet.10Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
Numbers from a service like Privacy.com are debit transactions and fall under the Electronic Fund Transfer Act and Regulation E. Your bank must investigate errors within 10 business days of your report, or up to 45 days if it provisionally credits your account.11eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
The practical difference matters. With a credit card virtual number, the disputed money was never pulled from your bank account, so the issuer is out the funds during the investigation. With a debit-linked virtual number, the charge hits your balance and you wait for provisional credit. If maximum protection matters more than the convenience of a free third-party account, a credit card issuer’s virtual number is the stronger choice.