Virtual Cards: Shop Online Without Exposing Your Card

Holiday shopping season is almost here, and with it comes the annual question: how many unfamiliar websites are you willing to hand your real card number to? This month, the answer got a lot of attention. On 20 October, Capital One posted a short video showing a shopper creating a single-use virtual card before buying from a website he had never used before, and on 15 October, CardCritics published a full guide framing virtual cards as one of the easiest ways to protect yourself while shopping online. The idea is simple: instead of typing in the number printed on your plastic card, you generate a temporary number that points to the same account — and if that number leaks, your real card stays safe.

What a virtual card actually is

A virtual credit card — sometimes called a virtual card number or digital card — is a temporary card number generated by your bank or card issuer and linked to your real account. It comes with its own expiry date and security code, and to a merchant it looks and works exactly like an ordinary card number. You enter it at checkout, the charge posts to your real account, and you earn the same rewards or cashback you would have earned on the physical card.

The difference is what the merchant stores. If that store is breached months later, the thieves find the disposable number — not the one on your card. You can switch it off in seconds, without cancelling your physical card and waiting for a replacement.

Think of it as a disguise for your credit card online. The transaction still goes through, but your real card number stays hidden.

How it works, step by step

1. Open your card account or app. Look for virtual cards or virtual numbers in your account, app, or your issuer's browser extension.
2. Generate a number. Most issuers create one instantly. Some let you set a spending cap, an expiry date, or a single merchant.
3. Check out as normal with the virtual number, expiry date, and security code.
4. Watch it land on your statement like any other purchase.
5. Switch it off when you are done. Your physical card keeps working untouched.

Virtual vs physical: the honest comparison

	Virtual card	Physical card
Form	Digital only, used online or in-app	Plastic card, used anywhere
Security	High — the merchant never sees your real number	Moderate — the real number is exposed at every checkout
Control	Spending caps, expiry dates, per-merchant numbers	Limited, unless managed through app settings
If compromised	Disable that one number in seconds	Cancel the card and wait for a replacement
In-store use	Only via a mobile wallet, if supported	Works everywhere
Card-present checks	Often not accepted	Always accepted

Which issuers offer them?

Not every bank does: CardCritics notes that Chase, one of the biggest US banks, does not offer virtual card numbers. Among those that do, the details differ:

	American Express	Capital One (Eno)	Citi
How you get numbers	Mainly through Google Chrome integration, for one-time online or in-app purchases	Via the Eno assistant in the app, website, or browser extension	Through your Citi online account
Spending limits	Limited — aimed at one-time purchases	Lock and unlock numbers, with monitoring and alerts	Daily limits in preset amounts ($25, $50, $75, $100, or $300)
Expiry control	No — short-lived, one-time use	Yes — single-use or a date you choose	No — numbers auto-renew every three years
Best for	Quick one-time Chrome checkouts	Overall convenience and flexible expiry	Setting a hard daily cap

Fintech apps such as Revolut and Privacy.com also offer virtual cards, and several UK banks and fintech apps do too — check your banking app under cards or security settings before assuming you need a new account.

Where virtual cards shine

Unfamiliar websites. This is the core case, and the one Capital One's video dramatised: a shop you have never used or a flash sale. If the site turns out to be dodgy or gets breached, the damage is contained to one disposable number.

Free trials and subscriptions. Give each subscription its own virtual card and set it to expire when the trial ends. A card that simply stops working is a much cheaper reminder than a surprise renewal — and cancelling is just switching that card off.

Shared spending. A capped virtual card lets someone else shop on your behalf without handing over your main card details.

Where a virtual card will not help

Virtual cards complement your main card rather than replacing it — and they have real limits:

• In-store checks. A virtual number cannot be swiped; it only works in shops if added to Apple Pay or Google Pay.
• Hotels and car hire. Some providers ask to see the physical card used for the booking at check-in — check the terms first.
• Phishing and account takeover. A virtual card protects your card number, not your login. Strong, unique passwords and two-factor authentication still matter.
• Returns and refunds. Refunds go back to the virtual number — but if you deleted it, a refund can get complicated. Keep numbers active until the return window closes.

US and UK differences

The mechanics are the same on both sides of the Atlantic, but the safety net differs. In the US, fraud is typically covered by your issuer's zero-liability policies. In the UK, because the purchase sits on your real credit card account, the protections attached to that account generally still apply — including Section 75 of the Consumer Credit Act for eligible credit card purchases between £100 and £30,000. A virtual card changes which number the merchant sees, not which account is legally behind the purchase.

How to set one up this week

1. Open your card issuer's app or website and search for virtual cards or virtual numbers.
2. If your issuer does not offer them, check whether a fintech app you already use does.
3. Before the holiday rush, create one number for your first unfamiliar-store purchase. The first one takes a minute; after that it is habit.
4. For subscriptions, create one number per service and label it in your app.
5. Once a month, review your active virtual numbers and delete ones tied to finished orders and trials.

Frequently asked questions

Do virtual cards build credit?

No. They use the same account as your regular card, so there is no separate credit line — but your spending still counts toward your main account's history.

Do I still earn rewards or cashback?

Yes, in most cases. Because the charge posts to your existing card account, you typically earn the same rewards, cashback, or points as you would with the physical card.

Can I use a virtual card for recurring payments?

Yes. Many issuers let you create a separate virtual card per merchant, which makes tracking and cancelling subscriptions much easier — just switch off that merchant's card.

Can I use a virtual card in a physical shop?

Usually only if you add it to a mobile wallet such as Apple Pay or Google Pay. Otherwise, virtual cards are designed for online and in-app purchases.

What happens if a store I used is hacked?

The exposed number is the virtual one. Disable it in your app, and your physical card and account stay untouched — a far smaller clean-up than cancelling your main card.

The bottom line

You cannot stop retailers from being breached, and you cannot vet every website you will buy from between now and Christmas. What you can control is how much damage a single breach can do: a virtual card turns a leaked card number from a weekend of phone calls into a ten-second tap in your banking app. If your issuer offers them, set one up before your next unfamiliar checkout.