A virtual card number is a temporary set of payment credentials — a unique 16-digit number, expiration date, and security code — that sits between your real account details and the merchant you’re paying online. It links to your existing credit card or bank account, but the merchant never sees your permanent card number. Most major banks and several standalone services generate these numbers through an app or browser extension, and you enter them at checkout exactly the way you’d type a physical card.
How It Differs From a Digital Wallet
Apple Pay and Google Pay are often lumped in with virtual cards, but they work differently. Digital wallets use tokenization, where a substitute string replaces your card number behind the scenes without you ever seeing or handling it. A virtual card number, by contrast, is a visible set of credentials you copy and paste into a checkout form on any website that accepts card payments.
The two can layer. A virtual card can be added to a digital wallet and tokenized on top. But for typing payment details into a web form, the virtual card number is the tool that fits.
Types of Virtual Card Numbers
Providers generally offer two formats, each built for a different kind of purchase.
- Merchant-locked numbers. After the first purchase, the number locks to that specific retailer. Any attempt to use it elsewhere is declined automatically. If that merchant is later breached, the stolen number is useless anywhere else.
- Single-use numbers. The number expires as soon as one transaction clears. Best for a one-off purchase from a site you don’t plan to buy from again.
Most providers also let you set a spending cap and an expiration date when you generate the number. A virtual card with a $50 ceiling that expires in 30 days puts a hard limit on what any merchant can charge, even if the number leaks.
How to Create and Use One
You need an active account with a bank or financial service that offers the feature. It usually lives inside a mobile app or online banking portal under a menu labeled something like Card Services, Security, or Manage Cards. Some banks also offer a browser extension that generates a number at checkout without switching apps.
When you generate the number, you’ll typically set a maximum spending limit, an expiration timeframe, and whether the card is single-use or ongoing. The system returns a 16-digit number, a security code, and an expiration date. You copy those into the payment fields at checkout the same way you would from a physical card.
The transaction routes through the merchant’s payment gateway and checks against the spending limit you set. Most banks send a push notification the moment the charge posts. On your statement, the purchase appears under the merchant’s name, and some issuers add a notation showing a virtual number was used.
Where Virtual Card Numbers Don’t Work
Virtual cards are built for online checkout forms. A few common situations trip them up, and knowing the boundaries in advance saves you the awkward moment at a counter.
Physical Stores
Brick-and-mortar terminals can’t accept a virtual card number. There is no magnetic stripe, no chip, no contactless antenna. Reading the number aloud or typing it into a point-of-sale terminal usually triggers a fraud alert or a flat refusal. For contactless payment at a physical store, a digital wallet on your phone is the right tool.
Hotels, Car Rentals, and Will-Call Tickets
Hotels routinely ask to see and swipe the card used for the reservation at check-in, both to verify identity and to authorize a hold for incidentals. Car rental counters do the same. Because a virtual number doesn’t match the number embossed on your physical card, the desk has no way to confirm the two match. Event venues that require the purchasing card for will-call pickup create the same friction. Book these with your physical card number.
Pre-Authorization Holds
Gas stations, hotels, and some restaurants place temporary holds that exceed the final purchase amount. A gas station might hold $100 or more before a single gallon is pumped. If your virtual card has a $50 cap and you’re buying $30 of gas, the hold alone can trigger a decline. Anywhere pre-authorization holds are common, set the spending cap well above what you expect to pay, or use a different payment method.
Refunds
Refunds are the most common source of confusion, especially with single-use numbers that have already expired. Most issuers route refunds back to the underlying account even after the virtual number is inactive. Internally, the refund is tied to your account, not the specific 16-digit alias.
The complication shows up at the merchant. If a store’s return policy requires the original card for an in-store return and the virtual number no longer exists, the merchant may need to process the refund as store credit, cash, or to a different card. Card network rules allow refunds via an alternate method when the original card is unavailable, but the merchant needs to document it.1Visa. Processing Refunds to Cardholders in a Merchant Store Location Keep a record of the virtual card number and the transaction confirmation.
What Happens If Someone Uses Your Number Anyway
Because a virtual card number is an extension of an existing account, it carries the same federal protections as the card in your wallet. Those protections differ sharply between credit and debit.
Credit
The Fair Credit Billing Act caps your liability for unauthorized credit card charges at $50, and only if certain conditions are met, including that the issuer gave you notice of potential liability and a way to report the loss.2Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card In practice you’ll rarely pay even that. Visa, Mastercard, and most major issuers maintain zero-liability policies that cover the full amount of unauthorized transactions, provided you report promptly and weren’t grossly negligent.3Visa. Visa Zero Liability Policy
Debit
Debit virtual cards fall under Regulation E, and the stakes climb the longer you wait. Unauthorized charges pull money directly from your bank account rather than adding to a credit balance. Your liability depends on how fast you report:
- Reported within 2 business days: capped at $50, or the amount taken before you reported, whichever is less.
- After 2 business days but within 60 days of your statement: up to $500.
- After 60 days: no cap at all on unauthorized transfers that occurred after the 60-day window closed.
That escalating exposure makes prompt reporting critical.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers If you spot a charge you didn’t make on a debit virtual card, contact your bank the same day.
Securing the Device That Generates Your Cards
Your phone or laptop is now the place where payment credentials get made on demand. If a thief bypasses the lock screen, they can generate new virtual card numbers and use them before you notice the device is missing.
If you lose a device with a virtual card app installed, move quickly. Remotely lock the device through your phone manufacturer’s Find My service. Contact your bank to flag the account. Change your banking and payment app passwords from another device. Your wireless carrier can disable the phone entirely, cutting off any payment app that relies on cellular data or SMS verification. These steps matter more than they would with a stolen physical card, because a compromised device can keep producing fresh credentials.
A Note on Third-Party Providers
Standalone virtual card services that aren’t your bank add a layer of separation between your spending and the merchants you buy from. That separation has limits. These services are subject to Know Your Customer laws and will require your ID at signup, so they aren’t anonymous. Some also share purchase details with your linked bank by default, meaning your bank may still see exactly where you shopped even though the merchant never saw your real card number.
Some providers offer a private-spend mode that hides merchant names from your bank, showing only that a payment was processed through the virtual card service. The virtual card company itself still has a full record of your purchases. The realistic benefit of these services is protection against merchant breaches and everyday marketing tracking, not true anonymity. If a service is free, consider how it earns its money.