A virtual card is a digital card number that works like a regular credit or debit card but exists only on your phone or computer. It has its own 16-digit number, expiration date and security code. Behind it sits an account you already have. You use it mainly for online and phone purchases, so your main card number stays private.
This guide explains how virtual cards work, the types you will see, when they make sense and where they fall short. It also covers what federal law says if someone misuses one, as of October 2026.
How a virtual card works
When you request a virtual card, the card issuer creates a new number linked to your existing credit line, checking account or prepaid balance. The number runs on the same card networks as plastic cards, such as Visa and Mastercard. So a merchant sees an ordinary card number and processes it the usual way.
The difference is what happens behind the number. The issuer knows the virtual number maps to your real account, and it can attach extra rules to it. For example, it may lock the number to one merchant, set a spending cap or make it expire after one use. If the number leaks, the issuer can cancel it without touching your main card.
The payment itself still travels through the normal chain of merchant, gateway, processor, network and issuer. Our guide to payment gateways and payment processors walks through that chain step by step. A virtual card changes only the number that enters it.
Types of virtual cards
Not every virtual card works the same way. Most fall into one of four groups.
- Single-use numbers. The number works for one transaction and then stops. That suits a one-off purchase from a store you do not know well.
- Merchant-locked numbers. The number works only at the first merchant that charges it. If that merchant suffers a data breach, the stolen number is useless elsewhere.
- Capped or dated numbers. These stay active for subscriptions but carry a monthly limit or an end date that you choose.
- Instant-issue cards. Some issuers give you a virtual copy of a new card right after approval. That way you can shop before the plastic arrives.
Businesses use a fifth kind. Corporate virtual cards let a company create a separate number for each supplier, employee trip or project. Each number can have its own limit, which makes spending easier to track and match to invoices.
Virtual cards vs. tokens in phone wallets
People often confuse virtual cards with the numbers inside phone wallets. They are related but not identical. When you add a card to a mobile wallet, the network replaces your real number with a payment token. The industry standard for this, first published by EMVCo in 2014, swaps the card number for a substitute value that is useless outside its intended device or merchant.
A token works in the background, and you never see it. A virtual card number, by contrast, is something you can view, copy and type into a checkout form. In practice, both aim at the same goal. They keep your real card number out of merchant databases.
When a virtual card makes sense
Virtual cards help most where your card number is most exposed. That means online checkout. Research from the Federal Reserve Bank of Kansas City, published in May 2025, found that U.S. card-not-present fraud rates rose after chip cards made in-store fraud harder. Criminals simply moved online.
Card misuse is also the most common identity theft complaint. In its 2024 Consumer Sentinel Data Book, the FTC logged 449,032 reports of credit card fraud, more than any other identity theft type. A virtual number does not stop phishing. Still, it limits the damage when a merchant’s database is stolen.
Here are the situations where a virtual card earns its keep:
- Free trials. Set a short expiry or a low cap. If you forget to cancel, the renewal charge fails instead of billing you.
- Unfamiliar online stores. A single-use number means a doubtful site never holds a reusable card.
- Subscriptions. Give each service its own number. Then you can cut off one service without updating every other account.
- Shared spending. Families and small teams can hand out a capped number rather than the main card.
- Waiting for a new card. An instant virtual copy lets you pay right after approval.
Where virtual cards fall short
Virtual cards have real limits, and it helps to know them before you rely on one.
- Returns and refunds. If a single-use number has expired, the merchant may struggle to refund it. Most issuers route the refund to the linked account, but timing varies.
- Hotels and car rentals. Many desks ask to see the physical card used to book. A virtual number can cause delays or a fresh authorization hold.
- In-store use. Unless the number is also loaded into a phone wallet, you cannot tap or insert it at a register.
- Uneven availability. Some issuers offer full controls, while others offer only a static copy of your card number. Some offer nothing.
- No cure for scams. If you willingly pay a scammer with a virtual card, the cap limits the loss. Even so, the payment counts as authorized.
Your legal protections with a virtual card
A virtual card inherits the protections of the account behind it. That point matters because the rules differ by account type.
| Linked account | Federal rule | Your maximum liability for unauthorized use |
|---|---|---|
| Credit card | Regulation Z (Truth in Lending) | $50, or $0 if you report before any charge |
| Debit card on a checking account | Regulation E | $0 before use; $50 within 2 business days; up to $500 within 60 days of your statement; possibly all of it after that |
| Registered prepaid account | Regulation E prepaid rule (since April 1, 2019) | Similar to debit, once the provider has verified your identity |
Under Regulation Z, section 1026.12, a cardholder’s liability for unauthorized credit card use cannot exceed $50. The FTC’s guide to lost or stolen cards lays out the stricter debit timeline. So speed matters far more with debit-linked numbers.
Prepaid accounts gained similar protections under the CFPB’s prepaid rule. However, the full protections usually apply only after you register the account.
Business cards follow a slightly different path. When an issuer gives 10 or more cards to one organization’s employees, the company and the issuer may agree on their own liability terms. Even then, an individual employee’s liability stays within the federal limits.
How to get and use a virtual card safely
Start by checking your current card’s app or online account. Many issuers place virtual numbers under a card controls or security menu. If you do not see the option, ask the issuer, because features differ widely between providers.
Once you have one, a few habits make it work better:
- Pick the type that fits the job: single-use for one-off buys, merchant-locked for subscriptions.
- Set a cap close to the expected charge, so surprise renewals fail.
- Label each number with the merchant’s name. Later you will know what to cancel.
- Keep receipts for anything you might return, since the refund goes to the linked account.
- Review statements monthly and report anything odd right away, especially on debit-linked numbers.
Finally, treat the virtual number like any card number. Do not share it by email or text. Also, enter it only on pages you reached yourself rather than through a link in a message.
For more explainers on cards, payments and business finance, see our money and business guides.
This article is general information, not financial advice.
Frequently asked questions
What is a virtual card used for?
Mostly online and phone purchases. It hides your real card number, so a breach at one merchant does not expose your main account. It also helps you control free trials and subscriptions.
Is a virtual card a credit card or a debit card?
It can be either, or prepaid. The virtual number draws on whatever account it is linked to. It also carries that account’s legal protections.
Can I use a virtual card in a store?
Only if you load it into a phone wallet that supports tap-to-pay. Otherwise, it works for online, app and phone orders.
Does a virtual card affect my credit score?
Creating a virtual number on an existing credit card does not open a new account, so it normally adds no credit inquiry. Your spending on it still counts toward that card’s balance.
Are virtual cards safer than physical cards?
For online shopping, usually yes, because you can lock, cap or delete the number. However, they do not protect you from scams where you approve the payment yourself.
Have a question about this topic? Ask in the comments below. Our editors read every comment and answer questions here, and we add useful answers to the guide.
Sources
- consumerfinance.gov/rules-policy/regulations/1026/12
- consumer.ftc.gov/articles/lost-or-stolen-credit-atm-and-debit-cards
- consumerfinance.gov/prepaid-rule
- consumerfinance.gov/ask-cfpb/why-do-i-need-to-register-my-prepaid-card-en-439
- emvco.com/emv-technologies/payment-tokenisation
- kansascityfed.org/research/payments-system-research-briefings/card-not-pre…
- ftc.gov/system/files/ftc_gov/pdf/csn-annual-data-book-2024.pdf