What a privacy credit card does
A privacy credit card is a card that generates a unique card number for each purchase you make online. Instead of using your real card number every time, the privacy card creates a temporary number that links to your actual account. If a merchant gets hacked or sells your information, that temporary number is worthless to a thief — it only works for that one transaction or that one merchant.
The real card number stays hidden. You control when the temporary number expires, how much it can spend, and which merchant it's tied to. Some privacy cards let you set a spending limit of $50 for one purchase, or $200 per month at a specific store. If something goes wrong, you shut down that number without canceling your actual card.
Privacy cards are not a separate bank account or a new credit card in the traditional sense. They're a tool that sits between you and the merchant, managed through an app or browser extension. The major credit card networks — Visa, Mastercard, American Express — all support the technology behind them.
Key Takeaways
- A privacy card generates a unique temporary number for each online purchase, so your real card number never reaches the merchant.
- You can set spending limits, expiration dates, and merchant restrictions on each temporary number to control your risk.
- Privacy cards work with your existing credit card, debit card, or bank account — they don't replace it.
- A data breach at a store affects only the temporary number you used there, not your actual card or other purchases.
- Privacy cards do not protect you from your own mistakes, like entering your information on a phishing website or giving it to a scammer.
How privacy cards actually protect you
The protection works in one specific direction: it stops a merchant or a hacker who steals from that merchant from using your real card number. When Target was breached in 2013, millions of real card numbers were stolen and used to make fraudulent purchases. If those customers had used privacy cards, the stolen numbers would have been useless — they would have expired after the original purchase or been locked to Target only.
The second layer of protection is the spending limit. You can tell a privacy card to allow only $100 at a new online retailer you've never used before. If the merchant turns out to be a scam or gets hacked, the damage is capped at $100. You set the ceiling before you hand over any number.
The third layer is merchant-specific restrictions. Some privacy cards let you create a number that works only at one store, or only for recurring charges from one subscription service. If a subscription service gets breached, that number can't be used anywhere else.
What privacy cards do not protect you from: phishing emails that trick you into entering your information, scammers you call yourself and give your number to, or your own password being weak. If you type your real card number into a fake website because it looked real, a privacy card won't help — you'll have already given away the number. The protection only works if the merchant or their system is compromised without your knowledge.
The main privacy card services and how they differ
Privacy.com is the largest privacy card service. It works with most debit cards and bank accounts, generates unlimited virtual card numbers, and lets you set spending limits and merchant restrictions. Privacy.com is free for basic use. The paid tier adds features like recurring payment management and priority support.
Blur (by Abine) offers privacy cards as part of a broader privacy suite that also includes password management and email masking. You can mask your email address when signing up for services, so merchants never get your real email. Blur charges a monthly subscription.
Apple Pay and Google Pay create a tokenized card number when you add your card to their digital wallet. This is not quite the same as a privacy card service — the temporary number is created by your bank or card issuer, not by a third party — but it serves a similar function. Your real card number doesn't go to the merchant; a one-time token does.
Capital One Eno is Capital One's own privacy card tool, available only to Capital One cardholders. It works through a browser extension and creates virtual numbers for online purchases. It's free to Capital One customers.
Citi Virtual Account Numbers work similarly — Citi cardholders can generate temporary numbers through their account. Like Eno, it's limited to that bank's customers and is free.
The main difference between these services is which cards they work with, how many numbers you can create, and whether they charge a fee. Privacy.com and Blur work with most cards and banks. Eno and Citi's tool work only with their own cards. All of them create a barrier between your real number and the merchant.
What happens when you use a privacy card
The process is straightforward. You open the privacy card app or browser extension. You create a new virtual number, set a spending limit (or leave it unlimited), choose an expiration date, and optionally restrict it to one merchant. You copy the number, expiration date, and CVV, then paste them into the checkout form just like you would a real card number. The transaction processes normally from the merchant's perspective.
The merchant sees the temporary number, not your real one. Your bank or card issuer sees the transaction tied to your real account and charges you as usual. The privacy card service logs the transaction and shows it in your app so you can track spending. If you set a limit of $50 and try to spend $75, the transaction declines.
If you need to return something or the merchant needs to charge you again for a subscription, the same temporary number works. You control when it expires. Some privacy cards let you pause a number temporarily instead of closing it, so a subscription can still charge but you can reactivate it later if needed.
Real costs and limitations
Most privacy card services are free or low-cost, but there are trade-offs. Privacy.com is free but makes money by selling anonymized data about spending patterns to merchants and advertisers — they don't sell your name or address, but they do track what categories you buy in and sell that insight. Blur charges a monthly fee to avoid that data sale. Capital One Eno and Citi's tool are free because they're built into the card issuer's existing relationship with you.
Privacy cards don't work everywhere. Some merchants reject virtual numbers outright, especially subscription services that need to store a "real" card for recurring billing. Some international merchants don't accept them. If a privacy card number is declined, you'll need to use your real card or find a different payment method.
Privacy cards also don't reduce your fraud liability. If someone uses a privacy card number fraudulently, you still have the same legal protections as with a real card — usually $0 liability for unauthorized charges if you report them quickly. The privacy card just makes it less likely a merchant breach will give a thief your real number in the first place.
Finally, privacy cards add a step to checkout. You have to open an app, generate a number, and copy it. For people who check out dozens of times a month, that friction adds up. Some people use privacy cards only for new merchants or high-risk purchases, and use their real card for trusted retailers.
When a privacy card actually makes sense
Privacy cards are most useful if you shop at many different online retailers, especially smaller or newer ones you don't fully trust. Each new merchant is a potential breach risk. A privacy card limits that risk to one transaction or one merchant at a time.
They're also useful for subscriptions you might cancel. If you sign up for a free trial and want to make sure you're not charged after it ends, a privacy card with an expiration date ensures the merchant can't charge you even if they try. When the trial ends, the number is dead.
Privacy cards are less useful if you shop mostly at large, well-known retailers with strong security, or if you rarely shop online. The risk reduction is real but small for most people. Your credit card company already covers fraudulent charges, so the main benefit is convenience — you don't have to dispute charges or deal with a new card number if a breach happens.
They're not useful for in-person purchases, phone orders, or situations where you need to give your card number to someone directly. Privacy cards only work for online transactions where the merchant never sees you.
How privacy cards fit into a broader security picture
A privacy card is one tool among several. It protects against merchant breaches but not against phishing, weak passwords, or social engineering. A strong, unique password for each online account protects against account takeover. Two-factor authentication protects against password theft. A privacy card protects against the merchant's systems being compromised.
Together, these layers reduce your overall risk. Alone, a privacy card is useful but not a complete solution. If you use the same password everywhere and a merchant is breached, a thief can log into your account on other sites even if they can't use the privacy card number. If you fall for a phishing email and enter your information, a privacy card won't help because you gave the information away voluntarily.
Privacy cards work best as part of a routine: use a password manager to create strong, unique passwords; enable two-factor authentication on important accounts; use a privacy card for new or untrusted merchants; and stay alert to phishing attempts. No single tool solves all problems.
Frequently Asked Questions
Can I use a privacy card for subscriptions?
Yes, but with limits. Privacy cards work for the initial subscription charge and ongoing recurring charges. However, some subscription services reject virtual numbers or require a "real" card on file. If a subscription declines your privacy card, you'll need to use your actual card or find a different payment method. Some privacy card services let you set a spending limit for recurring charges so you're protected if the price increases unexpectedly.
What happens if I dispute a charge made with a privacy card?
You have the same dispute rights as with a real card. If a charge is fraudulent or the merchant didn't deliver what you paid for, you can dispute it through your bank or card issuer. The privacy card service doesn't handle disputes — your actual card issuer does. The temporary number is just a routing tool; the real transaction is between you and your bank.
Does using a privacy card hurt my credit score?
No. A privacy card is not a separate credit account. It's a tool that routes charges to your existing card or bank account. Your credit score is based on your real card's payment history, credit utilization, and account age — none of which are affected by using a privacy card number.
Can I use a privacy card at stores or restaurants?
No. Privacy cards only work for online purchases where you enter the card number into a form. They don't work at physical checkout terminals, ATMs, or over the phone. For in-person purchases, you'll need your real card or a digital wallet like Apple Pay or Google Pay.
What if a merchant won't accept my privacy card number?
Some merchants, especially subscription services and international retailers, reject virtual card numbers. If a privacy card is declined, you have two options: use your real card instead, or contact the merchant to ask if they accept virtual numbers. Some merchants allow you to add a virtual number to your account after you've verified your identity with a real card first.