Reviewed September 2026.
A virtual card number (also called a virtual account number or tokenized card) is a PAN your issuer generates so you do not paste your real Visa or Mastercard digits into every checkout. Some numbers are temporary or merchant-locked; others stay stable and can support recurring payments when the merchant accepts them. Capital One Eno, Privacy.com-style tools, some Apple Card / bank apps, and several fintech debit products offer variants. This page is a fit guide: when they shrink breach blast radius, and when they do not help.
What a virtual number does
| Feature | Typical behavior | Limit |
|---|---|---|
| Unique PAN per merchant or session | Merchant breach exposes a throwaway number | Does not hide your name/billing ZIP if the merchant stores those |
| Spend cap / single-use | Caps trial charges (e.g. $1 auth then $49.99) | Does not stop you from approving a scam invoice |
| Instant close | You delete the number in the issuer app | Does not stop wire, Zelle, or gift-card sends |
| Ties to real card credit line | Same APR, rewards, dispute rights as the parent card | Debit-linked virtual numbers may have weaker consumer dispute timelines than credit (Reg E vs FCBA) |
Unauthorized charges on a credit virtual number usually follow the same dispute path as the parent card. Physical skimming is a different threat: Skimming and card cloning.
When virtual cards help
- New or low-trust merchants (marketplace sellers, pop-up subscription trials, foreign web shops).
- Free-trial funnels that convert to $14.99–$79.99/month; set a low cap or single-use number.
- One-off digital goods where you will not need the same PAN on file next year.
- Shared household devices where a saved real card is too easy for someone else to tap-pay.
When they are the wrong tool
- Rent, mortgage, or utilities when the merchant needs a stable PAN and your virtual number is the rotating/single-use type (stable virtual numbers can work for some recurring bills; confirm issuer + merchant). Do not use a consumer virtual card for payroll deposits or wage payments.
- Hotels, car rentals, and airlines that often authorize the physical card at the desk or require the embossed number.
- Scams that ask for gift cards, crypto, or P2P (Gift card payment scams, Zelle and P2P scams). A virtual Visa does not make those rails safe.
- Phishing sites that already have your password. Use MFA and bookmarks instead (Phishing and account takeover).
- SSN / new-credit fraud. Virtual cards do not replace credit freezes.
Worked example: Jordan’s free trial with a capped virtual number
Jordan signs up for a photo-editing “7-day free trial” with a Privacy.com-style virtual number set to a $5 spend limit (Privacy documents configurable limits; Capital One consumer virtual-card controls emphasize lock/delete rather than a fixed $5 cap). On day 6 Jordan cancels inside the trial terms in writing, then locks/closes the virtual number. The merchant’s day-8 $59.99 attempt declines at the limit. Declining the charge does not by itself cancel a subscription or prove $0 is owed, cancellation timing does. Ten minutes of cancel+lock beats chasing a renewal on the real card.
Practical setup habits
- Generate a new virtual number per merchant when the issuer allows it.
- Name the number in the app after the merchant (“Acme SaaS”) so you can kill it later.
- Prefer credit-backed virtual numbers when you want stronger dispute rights than debit.
- Keep the real card for travel, chip-at-pump, and trusted recurring bills.
- If a merchant emails “update your card” with a link, open the bookmark you already trust; do not paste a new virtual number into a phishing form.
Email appeared in a dump? Check exposure, then rotate passwords: How to check if your email appeared in a breach.
Checklist
- Use virtual numbers for new online merchants and trials; for rent/utilities, use a stable number only if issuer and merchant support it, otherwise the real card or ACH.
- Set a spend cap or single-use when the issuer offers it.
- Close leaked or unused numbers the same day you see odd authorizations.
- Still enable MFA and card alerts; a token is not a password.
- Never pay a “verify your account” demand with gift cards even if a virtual card is available.
Educational only. Not banking or legal advice. Issuer features, fees, and dispute rules vary; read your card agreement and the virtual-number terms in the official app.