Every time you type your real card number into a checkout page, you're trusting that merchant's security forever, because breached card databases get sold and re-sold for years. A virtual card number removes that bet. It's a stand-in 16-digit number that routes charges to your real account while keeping the real number private, and at most major issuers it takes about five minutes to set up and costs nothing.
In this article
- How virtual card numbers actually work
- Who offers them free (and what each version does)
- Merchant-locked vs. single-use: which to pick when
- The three limit settings worth using
- Where virtual cards don't work well
Key takeaways
- A virtual card number shields your real card, so a merchant breach exposes only a number you can kill in one click.
- Capital One, Citi, and Amex cardholders already have this feature free; Privacy.com covers debit users with 12 free cards a month.
- Merchant-locked cards are the best default: they keep working for the store you created them for and decline everywhere else.
- Set a per-charge or monthly cap on every virtual card; $1 caps are a clean way to stop free trials from auto-converting.
- Skip virtual cards for anything you may need to verify in person, like hotel check-ins and rental car counters.
Photo: Lorem Picsum, free to use.
How a Virtual Card Number Actually Works
When you generate a virtual number, your issuer creates a new 16-digit card with its own expiration date and CVV, mapped to your account behind the scenes. The merchant charges the virtual number; your issuer translates it and posts the charge to your real card. You still get your rewards, your statement looks the same, and chargeback rights are unchanged.
The security win is simple: if that merchant is breached, criminals get a number that only ever worked at one store, or one that you've already deleted. Your real card doesn't need reissuing, and you don't spend a week updating autopay details everywhere else.
Who Offers Them Free
- Capital One: the Eno browser extension generates a merchant-locked virtual number at checkout on any site.
- Citi: virtual account numbers with custom expiration dates and spend caps, generated from your online account.
- American Express: virtual cards via its app for eligible cards.
- Privacy.com: the main option if you use a debit card or bank account; the free tier includes 12 new cards per month with merchant locking, spend limits, and one-click pause.
- Apple Pay / Google Pay: not virtual cards you manage, but the same principle; the merchant receives a device-specific token instead of your real number, so they're a good fallback where offered.
Merchant-Locked vs. Single-Use: Pick by Situation
Merchant-locked (the best default)
The card works indefinitely, but only at the first merchant that charges it. Use it for stores you buy from monthly and for every subscription. If the number leaks, it's useless anywhere else.
Single-use (for stores you don't trust yet)
The number dies after one transaction. Use it for unfamiliar shops, first orders from ads you clicked, and international sellers. If the site turns out to be sketchy, there's nothing left to steal.
Photo: Lorem Picsum, free to use.
Three Limit Settings Worth Using
1. Per-charge caps sized to the purchase
If you're buying a $60 item, cap the card at $75. An overcharge, a sneaky upsell, or a compromised merchant trying a $400 charge all decline automatically.
2. The $1 free-trial cap
Sign up for trials with a virtual card capped at $1. When the trial tries to convert at $14.99, the charge declines and the decision returns to you instead of your statement.
3. Monthly caps on subscriptions
Cap a streaming service's card at its current price plus a dollar or two. Silent price increases then fail to bill, which is effectively a notification system for price hikes.
Where Virtual Cards Don't Fit
Skip them anywhere you might have to present the physical card: hotel front desks, rental car counters, airline tickets checked against the purchasing card, and buy-online-pickup-in-store orders where staff verify the card. Refunds also deserve a note: money returns to the underlying account even if the virtual number is closed, but keep the card paused rather than deleted until a return window passes, since some merchants' systems handle refunds to deleted numbers slowly.
FAQ
What is a virtual card number?
A virtual card number is a substitute 16-digit number linked to your real card or bank account. Charges route to your real account, but the merchant never sees your actual card number, so a breach at that merchant can't expose it.
Are virtual card numbers free?
Usually yes. Capital One (Eno), Citi, and American Express offer them free to cardholders, and Privacy.com's free tier includes 12 new virtual cards a month linked to a bank account or debit card.
When should I use a single-use card instead of a merchant-locked one?
Use single-use numbers for stores you don't plan to buy from again, especially unfamiliar ones. Use merchant-locked cards for retailers you shop at regularly and for subscriptions.
Do virtual cards work for subscriptions and free trials?
Yes, and they're one of the cleanest ways to keep a free trial from converting: cap the card at $1 or pause it after signup, and the renewal charge simply declines.