Virtual card numbers let you shop online using a disposable stand-in for your real card, so if a retailer's database gets breached, hackers get a dead number instead of your actual account. Most major banks now offer this for free through their app or browser extension, and setting one up takes under two minutes. The trick is knowing when to use a single-use number versus a merchant-locked recurring one.
In this article:
- What a Virtual Card Number Actually Does
- Which Banks Offer Them for Free
- Setting Spending Limits and Merchant Locks
- Virtual Cards vs. Single-Use Numbers vs. Prepaid Cards
- Where Virtual Cards Won't Protect You
- A Setup Routine for Recurring Subscriptions
Photo: Lorem Picsum, free to use.
What a Virtual Card Number Actually Does
A virtual card number is a randomly generated 16-digit number that's linked to your real credit or debit account but never shares its actual digits with a merchant. When the retailer bills it, the charge routes through to your real account exactly like a normal purchase — you still see it on your statement, still earn rewards, and still get standard cardholder protections. The difference is that if that number ever leaks in a breach, it's useless to a thief because it's disconnected from your primary card.
Why This Matters More Than a Strong Password
Passwords get reused; card numbers, once typed into a checkout form, live in a merchant's database indefinitely unless you actively rotate them. A breach at a mid-size retailer you shopped with three years ago can still expose a card number that's technically still active today. Virtual numbers remove that long tail of risk entirely.
Which Banks Offer Them for Free
You likely already have access to this without paying for a third-party app:
- Capital One Eno — free browser extension, works on any Capital One card
- Citi Virtual Card Numbers — built into the Citi mobile app and website
- Bank of America ShopSafe — available for most BofA credit cards
- Discover freeze it / virtual card — offered on newer Discover cards
- Privacy.com — a free third-party option that links to any debit card or bank account if your issuer doesn't offer its own
If your card issuer doesn't support virtual numbers natively, Privacy.com's free tier gives you 12 virtual cards a month, which covers most people's online shopping needs.
Photo: Lorem Picsum, free to use.
Setting Spending Limits and Merchant Locks
The real power of virtual cards isn't just number-masking — it's the controls layered on top. Most apps let you set a hard spending cap per card, so a $15/month streaming subscription can literally never charge you $25 after a stealth price hike, because the card declines anything over your limit. You can also lock a virtual card to a single merchant, which means even if that number were somehow stolen, it couldn't be used anywhere else.
A Practical Cap to Start With
For subscriptions, set the limit at 110% of the current price — enough headroom for tax, not enough to absorb a surprise increase. For one-off purchases from a site you don't fully trust, cap the card at the exact order total plus a few dollars for shipping.
Virtual Cards vs. Single-Use Numbers vs. Prepaid Cards
These three get confused constantly, but they solve different problems:
- Standing virtual card — reusable at one merchant, best for subscriptions and recurring bills
- Single-use number — expires after one transaction, best for a one-time purchase from an unfamiliar or overseas site
- Prepaid card — funded in advance with a fixed balance, best when you want a hard ceiling that's not tied to your bank account at all
For most everyday online shopping, a merchant-locked standing virtual card covers 90% of use cases. Save single-use numbers for sketchy or one-off purchases.
Where Virtual Cards Won't Protect You
Virtual cards stop a merchant-side data breach from exposing your real account, but they don't stop phishing that tricks you into entering your real card or bank login on a fake site, and they don't undo a purchase you were manipulated into making. Pair a virtual card habit with two-factor authentication on your bank's login and a healthy skepticism of "urgent" payment emails.
Photo: Lorem Picsum, free to use.
A Simple Setup Routine for Recurring Subscriptions
Once a month, review every merchant-locked virtual card in your banking app. If a subscription card gets declined because you've hit its spending cap, that's your signal the service raised its price — investigate before manually approving a higher limit. This one habit catches silent price creep that most people never notice until they check their statement months later.
Key Takeaways
- Virtual card numbers mask your real account behind a disposable one, so a retailer data breach can't expose your actual card.
- Most major banks issue them free — Capital One Eno, Citi, Discover, and Bank of America ShopSafe are the most common.
- Lock a virtual card to one merchant and set a spending cap around 110% of the expected charge to auto-block price creep.
- Use single-use numbers for one-off purchases on unfamiliar sites; use standing virtual cards for recurring subscriptions.
- Virtual cards don't stop phishing — pair them with two-factor authentication on your actual bank login.
Frequently Asked Questions
Are virtual card numbers free?
Most major issuers — including Capital One (Eno), Citi, Bank of America, and Discover — offer virtual card numbers at no extra cost through their app or browser extension.
Can a virtual card number be used more than once?
Yes. Most standing virtual cards can be reused indefinitely at the same merchant, which makes them ideal for subscriptions. True single-use numbers expire after one transaction.
Do virtual cards work for in-person or phone purchases?
No. Virtual card numbers only work for online, phone, or mail-order purchases where you manually enter card details — they can't be used at a physical card reader.
What happens if a merchant charges a virtual card after I cancel it?
The transaction is declined instantly, which is why locking a virtual card to one merchant is one of the fastest ways to stop a subscription you forgot to cancel.