What a virtual credit card number is
A virtual credit card number is a temporary set of card digits generated by your bank or card issuer, linked to your real account but different from your actual card number. When you shop online, you use the virtual number instead of your real one. The charge still goes to your actual account, but the merchant never sees your true card details.
Virtual numbers work through your bank's app or website. You request a new number, set a spending limit and expiration date for it, and use it for that transaction or merchant. Once you're done, the number either expires automatically or you can delete it. If a merchant's system gets hacked or sells your data, the thieves have a number that no longer works and can't be used anywhere else.
Most major banks and card issuers now offer this feature, though the name varies — some call it "temporary card numbers," "masked numbers," or "digital wallet tokens." The underlying idea is the same: you're creating a barrier between your real card number and the places you shop.
Key Takeaways
- Virtual numbers are temporary card numbers tied to your real account, used to hide your actual card details from online merchants.
- You create and control them through your bank's app or website, setting limits and expiration dates for each one.
- They reduce fraud risk because a stolen virtual number can't be used after it expires or if you delete it.
- Virtual numbers work for online shopping, subscriptions, and one-time purchases, but not for in-person card swipes or ATM withdrawals.
- Not all banks offer them yet, and some require you to opt in or meet minimum account requirements.
How virtual numbers reduce fraud and data breach risk
When you use your real card number online, that number travels through multiple systems: the merchant's website, their payment processor, their bank, and sometimes third-party vendors who handle their data. Each step is a place where the number could be intercepted, stored insecurely, or sold if there's a breach.
A virtual number isolates your real card from most of that exposure. The merchant sees and stores only the temporary number. If their database is hacked, the thief gets a number that's either already expired or tied to a spending limit you set — say $50 for a single purchase. Even if they try to use it again, the transaction fails because the number is no longer active.
This doesn't make you completely fraud-proof. Your bank still processes the real transaction, and your account information is still in your bank's system. But it shrinks the number of places where your actual card number exists, which is why security researchers recommend virtual numbers for shopping at merchants you don't fully trust or for one-time purchases from unfamiliar sites.
Where virtual numbers work and where they don't
Virtual numbers work for any online purchase where you enter card details into a website or app — retail shopping, restaurant delivery, travel bookings, digital subscriptions. They also work for recurring charges like monthly software or streaming services, though you'll need to update the virtual number if it expires before your subscription ends.
They do not work for in-person transactions where you swipe or insert a physical card, because the merchant is reading your actual card chip or magnetic stripe. They also don't work at ATMs or for phone orders where the merchant needs to verify your identity using information tied to your real card number.
Some merchants' systems reject virtual numbers outright, though this is becoming less common. If a site won't accept the virtual number, you'll need to use your real card or find a different payment method. A few banks let you set virtual numbers to work with specific merchants only, which adds another layer of control but requires more setup on your end.
How to set up and use a virtual number
The process varies by bank, but the basic steps are similar. Log into your bank's mobile app or website and look for a section labeled "Virtual Cards," "Temporary Numbers," "Card Controls," or "Digital Wallet." Some banks put this under account settings; others have it as a standalone feature.
Once you find it, you'll usually see an option to generate a new number. You'll choose whether to set a spending limit (optional but recommended), an expiration date, and sometimes which merchant or merchant category the number can be used at. Some banks let you name the number so you remember what it's for — "Amazon," "Subscription Services," "Travel." Then you copy the number, expiration date, and CVV and use them like a regular card at checkout.
After the purchase, you can either let the number expire on its own or delete it when ready from your app. If you're using it for a recurring subscription, leave it active until you're ready to cancel or switch cards. Most banks show you a history of which virtual numbers you've created and which merchants used them, so you can track your spending and spot unauthorized charges.
Which banks and card issuers offer virtual numbers
Major issuers including Citi, Bank of America, Capital One, and Discover offer virtual card numbers to most cardholders, though the feature name and availability vary. Citi calls theirs "Virtual Account Numbers." Bank of America offers them through their app. Capital One has "Eno," a browser extension that generates numbers automatically at checkout. American Express offers virtual numbers for some cardholders but not all.
Smaller banks and credit unions are slower to roll out this feature, so check your bank's app or website to see if it's available on your account. Some banks require you to opt in before you can use it. Others limit virtual numbers to certain card types — for example, you might be able to create them on a rewards card but not a basic card.
If your bank doesn't offer virtual numbers natively, third-party services like Privacy.com and Blur generate virtual numbers for you, though they work differently and may have their own fees or limitations. These services act as a middleman between you and the merchant, creating a new number for each transaction and forwarding the charge to your real card.
Limits and trade-offs of virtual numbers
Virtual numbers are useful but not a complete solution to online fraud. They protect your card number from being stolen at the point of sale, but they don't protect you from phishing, malware on your computer, or social engineering. If someone tricks you into sending them money or installs software that captures your keystrokes, a virtual number won't help.
They also add a small amount of friction to shopping. Generating a new number for each purchase takes an extra minute or two, and some people find that annoying for routine shopping. If you use the same virtual number for multiple transactions, you lose some of the security benefit because that number becomes a larger target.
Virtual numbers also don't help with fraud that happens after the purchase — for example, if a merchant overcharges you or a subscription keeps billing you after you cancel. You still have to dispute the charge with your bank the same way you would with a real card number. And if you lose track of which virtual number you used where, it's harder to spot unauthorized charges or contact the right merchant to cancel a subscription.
Virtual numbers versus other fraud protection methods
Virtual numbers are one tool among several. Tokenization — the technology used by Apple Pay, Google Pay, and Samsung Pay — does something similar: it replaces your real card number with a token that works only on that device or service. The difference is that tokenization is built into the payment system itself, while virtual numbers are something you generate and control.
Two-factor authentication (requiring a password plus a code sent to your phone) protects your account from being hacked but doesn't hide your card number from merchants. Fraud monitoring, which your bank does automatically, catches suspicious charges after they happen but doesn't prevent them. Virtual numbers prevent the charge from going through in the first place if the number has expired or hit its limit.
The strongest approach uses multiple methods: a virtual number for the transaction, two-factor authentication on your bank account, and fraud monitoring to catch anything that slips through. Virtual numbers are most useful for shopping at unfamiliar merchants, one-time purchases, or subscriptions you plan to cancel soon.
Frequently Asked Questions
Can I use a virtual number for a subscription that renews every month?
Yes, but you need to plan ahead. Set the virtual number's expiration date to after your subscription's renewal date, or update the subscription with a new virtual number before the old one expires. If the number expires mid-subscription, the renewal charge will fail and you'll need to contact the merchant to update your payment method.
What happens if I delete a virtual number before a charge goes through?
The charge will be rejected because the number no longer exists. This is useful if you change your mind about a purchase, but it can also cause problems if you delete a number and then forget you used it for a subscription. Check your bank's history of virtual numbers before deleting one to see which merchants used it.
Do virtual numbers protect me if my bank account gets hacked?
No. Virtual numbers protect your card number from merchants, not your bank account from hackers. If someone gains access to your bank's website or app, they can see your virtual numbers and your real account. Use a strong, unique password and two-factor authentication on your bank account to prevent that.
Can a merchant refuse a virtual number?
Yes, though it's rare. Some older payment systems or merchants with strict verification requirements may reject virtual numbers because they can't match the number to your identity the way they can with a real card. If this happens, you'll need to use your real card or try a different payment method.
Do virtual numbers cost extra?
No. Banks that offer virtual numbers include them as a free feature for cardholders. Third-party services like Privacy.com may charge a subscription fee for premium features, but basic virtual number generation is usually free.