Virtual Cards Explained: How Single-Use and Locked Card Numbers Protect Your Money

Every time you type a 16-digit card number into an online checkout form, that number sits in a merchant's database, a payment processor's logs, and possibly a third-party marketing tool. If any of those systems is breached, your real card number can end up for sale. Virtual cards were built to reduce that exposure by letting the card number you hand over be different from the number tied to your actual funding source.

What a Virtual Card Actually Is

A virtual card is a card number, expiration date, and security code generated on demand by a bank, card network, fintech app, or corporate expense tool. It is linked behind the scenes to a real funding source—a checking account, a credit line, or a prepaid balance—but the number itself can be constrained in ways a physical card number typically is not. Common constraints include a single allowed transaction, a locked merchant category or specific retailer, a maximum dollar amount, or an automatic expiration date.

This is different from a physical debit or credit card's number, which is fixed and reused for every transaction until the card is reissued. If your physical card number leaks, every future transaction attempt using that number is a potential fraud risk until you cancel and replace it. A virtual card that was only ever valid for one $40 purchase at one retailer has no ongoing value to a criminal even if it is intercepted.

The Tokenization Connection

Virtual cards are part of a broader shift toward tokenization across the payments industry. Visa and Mastercard both operate token services that let a merchant, wallet, or app store a substitute number instead of the real primary account number, and that substitute is what actually travels through the transaction. Mobile wallets on phones use this same infrastructure, so a virtual card is best understood as one more channel—alongside phone-based tap-to-pay—for generating a disposable stand-in for your real card number, rather than a wholly separate payment network.

Because the token is mapped back to the real account only at the issuing bank, a merchant or app that only ever sees the token cannot reconstruct your actual card number even if their systems are compromised.

Where Consumers Encounter Virtual Cards

• Bank and card-issuer apps that let you generate a temporary number for one online purchase, then let it expire automatically.
• Browser extensions or wallet apps that create a merchant-locked number so a subscription cannot be charged by any other business.
• Buy-now-pay-later and some neobank products that issue a single-use virtual card for a specific checkout instead of storing your real card on file with the retailer.
• Digital-first banks that issue a virtual card instantly for online spending while a physical card is still in the mail.

Why Businesses Use Them Even More Heavily

Corporate and small-business use of virtual cards has grown quickly because the same restriction features that protect consumers also solve accounting problems. A finance team can issue a virtual card capped at the exact invoice amount to a single vendor, eliminating the need to share a general-purpose company card number with every supplier. When the invoice is paid, the card can be set to expire, closing off any chance of a duplicate or fraudulent charge later. Expense-management platforms often generate a distinct virtual card per employee, per project, or per subscription, which makes reconciling statements against budgets far simpler than sorting through one shared card's activity.

What Virtual Cards Do Not Change

A virtual card is a wrapper around an existing account, not a new legal category of payment product. Consumer protections still depend on what that underlying account is. If the virtual card draws from a credit card, disputes are still governed by the Fair Credit Billing Act's error-resolution process. If it draws from a checking account or prepaid account, Regulation E and the associated Electronic Fund Transfer Act protections apply. The Consumer Financial Protection Bureau's guidance on electronic transfers and billing errors is the same guidance that applies regardless of whether the number you typed was permanent or single-use.

Questions Worth Asking Before You Use One

• Does my bank or card issuer offer virtual card generation natively, or would I need a third-party app that also sees my transaction data?
• Is the virtual card linked to a credit account or a debit/checking account, since liability and dispute timelines differ between the two?
• Can I set a merchant lock and expiration date, or only a spending cap?
• Will refunds route back to the virtual card number if it has already expired, or to the underlying account directly?