Virtual Cards Explained
A virtual card is a digital card number (PAN, expiry, CVV) issued without a physical plastic card. It can be single-use or reusable.
By Daniel Cross, Senior Payment Systems Analyst · Last updated: 2026-10-20
What a virtual card is
A virtual card is a card number issued without any physical plastic. It exists only as a number, an expiry and a security code, usually held in a wallet, a browser extension or a service's own database. The account behind it is real, the authorisation flow is the same, and the difference is in how the card details are distributed and how they can be limited.
- A number, an expiry date and a security code, with no plastic
- Usually issued by a bank or a fintech onto a funded account
- Used for subscriptions, travel and one-off online payments
- Can usually be frozen, replaced or limited without cancelling the account
Virtual, physical, and the cards in between
The term covers several different products and the distinction matters if you are comparing them. A virtual card lives only in software. A metal or plastic card is physical. Between them sit the hybrid products: a virtual number that is paired with a physical card, and a physical card whose details can be added to a wallet as a separate number.
| Type | Has plastic | Number | Primary use |
|---|---|---|---|
| Virtual only | No | One, stored in software | Subscriptions, online-only spending |
| Virtual plus physical | Yes | Usually two, one per source | A physical card for in-person, a virtual one for online |
| Physical with wallet provisioning | Yes | The card number, tokenised per device | Everyday use, with device-level tokenisation |
| Single-use or throwaway | No | A new number per transaction or per merchant | Controlling exposure on an account that holds money |
How virtual cards are used
The pattern is the same across every issuer. A card is created against an account, either by the customer or by a service on the customer's behalf. The number is then used for an online payment. When the account is compromised or the spend is not wanted, the number is replaced or frozen, and the underlying account is untouched. That is the whole appeal: a disposable credential for a durable account.
- Created against an existing account, usually by the customer or their service
- Used for a single merchant, a category or a time window
- Frozen or replaced when the exposure is unwanted
- The underlying account, and its other credentials, are unaffected
Tokenisation: what actually protects you
The security of a virtual card rests on tokenisation, which is the device-level process that makes storing a card number in a phone or a browser safe. When the number is added to a wallet, the device asks the issuer for a token that stands in for it. The real number stays with the issuer, the token is device-specific, and a breach of the wallet does not expose a usable number. This is why the replacement for a lost card is a token problem rather than a plastic problem.
- A token is device-specific and is generated by the issuer or its processor
- The real account number never leaves the issuer's systems for storage
- Each token can be provisioned, suspended and replaced independently
- Tokens are not card numbers and cannot be used elsewhere
- The 3D Secure challenge is the second layer on top of this
Limits and controls
A virtual card is only useful if it can be constrained, and most issuers let you constrain it in several independent ways. Combining them is what makes the product a control rather than merely a convenience.
| Control | What it limits | Typical values |
|---|---|---|
| Merchant lock | Which merchant may take the payment | A single named merchant |
| Category lock | What may be bought | Fuel, travel, subscriptions, groceries |
| Amount limit | How much may be spent | Per transaction, per period, or both |
| Time window | When it may be used | A start and end date |
| Number of uses | How many times | One, or a fixed count |
Where virtual cards do not help
They are the wrong tool in a few specific situations. Anything that requires a physical card: a car park that reads the magnetic stripe, a hotel that takes a card key on insertion, a cash withdrawal. Anything that needs a long-lived card, such as a recurring insurance policy. And anything where the merchant insists on a physical card being presented, which in many markets it legally can for certain transactions.
- Card-present transactions that read the magnetic stripe or insert the card
- Cash withdrawal
- Long-lived recurring arrangements that need a stable card on file
- Situations where the merchant must physically verify the cardholder
Frequently Asked Questions
What is a virtual card?
A card number issued without a physical card. It has a number, an expiry date and a security code like any other card, but it exists only in software and is used for online payments.
Are virtual cards safer than physical cards?
For online payments, usually yes, because the number can be limited to one merchant, frozen and replaced without cancelling the account, and because device tokenisation means a compromised wallet does not expose a usable number.
Do virtual cards have a CVV?
Yes. A virtual card has a security code just like a physical one, generated by the issuer, and it is used in the same way in a card-not-present authorisation.
Can you use a virtual card for in-person payments?
Often, if it is added to a phone wallet, because the phone then presents a token over contactless. Not where the terminal needs the card physically inserted or the stripe read.
What is tokenisation?
The process by which a device receives a stand-in token for the card number, so the real number is never stored on the device. Tokens are device-specific and can be replaced independently of the card.
Can a virtual card be cancelled without affecting other cards?
Yes, and that is the main operational reason they exist. The virtual number is closed and reissued while the account and any physical card continue to work.
Do virtual cards show up in BIN data?
Yes. A virtual card is issued against a real account by a real issuer, so its prefix appears in the BIN data with that issuer, brand and product type.