Virtual Credit Card Numbers: How They Work and When to Use One Online

Your real credit card number gets entered at checkout, can be stored in merchant databases, and is exposed whenever a merchant gets breached. Virtual credit card numbers reduce that exposure without requiring you to change how you shop.

Here's what they are, how they actually work, and the specific situations where using one makes a real difference, along with an honest look at what they can't do.

What is a virtual credit card number?

A virtual credit card number is a temporary, randomly generated number that links to your actual credit card account. When you use it to make a purchase, the charge still flows through your real account, but the merchant never sees your actual card number.

Think of it as a decoy. The decoy gets used. Your real number stays hidden. Even if the merchant's payment database is stolen, your real card number isn't in it. If the virtual number is merchant-specific or single-use, a stolen copy generally can't be used anywhere else.

Capital One says virtual numbers allow you to "shop online without giving stores your actual card number."

There are two main types:

• General-use virtual cards: One virtual number that works across any online merchant. The number can be reused across transactions and shields your physical card number from being exposed. It's useful if you want a single alternative number you can use broadly, but a stolen general-use number can still be misused until you lock or replace it.
• Merchant-specific virtual cards: A unique number tied to a single retailer. If that retailer's payment system gets breached, the stolen number generally can't be used anywhere else. This is the stronger option when you're shopping somewhere new or signing up for a recurring service you may want to cancel later.

Both types show up on your regular monthly statement just like any other purchase, so tracking your spending doesn't require any extra steps. The protection happens in the background, invisible to your normal routine.

How do virtual credit card numbers work?

When you generate a virtual card number, your card issuer creates a proxy number that's mathematically linked to your account. It has its own 16-digit number, expiration date, and CVV. To a checkout form, it looks exactly like a real card, because structurally, it is one. The difference is entirely on the back end, where your issuer maps that proxy number back to your actual account.

The sequence goes like this:

1. You request a virtual number from your issuer's website or app, or through a browser feature like Chrome autofill, if your issuer supports it.
2. The issuer generates a temporary number connected to your account.
3. You enter that number at checkout instead of your physical card's details.
4. The transaction is approved and the charge appears on your statement as usual.
5. Depending on the issuer, the virtual number can be locked to one merchant, set to expire after a set period, limited to a single use, or capped at a spending limit.

The key protection: with a merchant-specific or single-use number, a hacker who steals it from a breached retailer's database generally can't use it elsewhere. A merchant-specific number is meant to be accepted only at the site it was created for, and a one-time-use number won't work a second time. A general-use number can still be misused until you lock or replace it, but your real card number stays hidden either way.

This matters because card data is often stolen in bulk, not from one person at a time. E-commerce skimming, in which attackers inject malicious code into a checkout page, is a documented way card data is taken from many shoppers at once, according to CISA and the FBI and the PCI Security Standards Council. A virtual number limits what a criminal can do with whatever they find, because your real card number was never on that checkout page.

When should you use a virtual credit card number?

Not every purchase calls for one. But there are specific situations where the added layer is worth the extra step.

Unfamiliar websites. If you're buying from a store you've never used before, you don't know how well they protect payment data. A smaller retailer may not have the same security infrastructure as a major platform. A virtual number means that even if their security is weak or their systems are later compromised, your actual card isn't in their hands.

Free trials with auto-renewal. A merchant-specific virtual card is particularly useful here. If you forget to cancel, closing or locking the virtual card can stop future charges. It doesn't cancel the subscription or erase what you owe, though, so cancel with the company too and keep records. If it keeps charging you, dispute the charge with your card issuer, as the FTC advises.

Subscriptions you want to control. If you're signing up for a service but want to keep flexibility over when and whether it charges you, a virtual card tied to a specific merchant gives you an extra off switch for future charges. You should still cancel directly with the company.

High-risk categories. Sites that rely on many third-party services, such as travel booking sites, ticket resellers, and marketplaces, can give attackers more places to get in. Third-party code and vendors are a documented attack path in checkout skimming, according to the PCI Security Standards Council, and third parties were involved in 48% of breaches in Verizon's 2026 report. A virtual number means your real card isn't exposed if one of those services is compromised.

Shopping on public Wi-Fi. Most websites encrypt your information, the FTC notes, but scammers can set up fake sites that look encrypted too. If you end up entering card details on a fake site while on a hotel or airport network, a virtual number means the thief gets a number with limited usefulness rather than your actual card.

The one scenario where virtual cards don't help: in-person purchases. Virtual card numbers are meant for online and in-app transactions. They typically can't be swiped or tapped at a physical register, so your physical card or a digital wallet remains the tool for point-of-sale purchases.

What are the limitations?

Virtual credit card numbers are useful but not a complete solution. Understanding where they fall short helps you use them more effectively alongside other protections.

Returns can get complicated. A merchant's system may need to match a return to the virtual number you used, so keep your receipt. Google notes that returns may need the last four digits of the virtual card, and Capital One warns that a return using your actual card number might not work. If a refund doesn't go through, contact the merchant and your card issuer. It's a small extra step, but worth knowing about before you need it.

Not every issuer offers them. Availability varies. Capital One offers virtual cards in its app and website for eligible credit cards, American Express offers one through Google Chrome, Apple Card has a virtual card number, and other issuers may offer temporary numbers on some cards, so check your issuer’s app or website. Chase says it does not offer virtual credit card numbers. Third-party services like Privacy.com also issue virtual cards, funded from a U.S. checking account or debit card, which is a useful workaround if your bank doesn't offer the feature natively. Eligibility depends on your card and account.

They protect the number, not the account. If someone already has access to your account login (through a data breach, credential stuffing, or phishing) a virtual number won't stop them from making changes or accessing your information. Virtual cards protect the card number specifically. For account-level protection, strong passwords, two-factor authentication, and regularly monitoring your statements still matter just as much.

They don't prevent phishing. If you're tricked into entering your virtual number on a fake website made to look like a legitimate retailer, the fraudster can still use it for a transaction before it expires or before you notice. Virtual cards reduce the blast radius of a breach, they limit what a criminal can do with a stolen number, but they don't replace good habits online or tools that help you identify dangerous sites before you reach the checkout page.

How to get a virtual credit card number

The process varies by issuer, but it's straightforward once you know where to look. Issuers that offer the feature usually build it into their app, website, or Chrome autofill, so there's no separate sign-up.

Capital One: Sign in to the app or website and select "Get your virtual card" under your card's balance, or open Virtual Card Manager on desktop. It's available for eligible credit cards only. You can create a general-use or merchant-specific card, and some merchant-specific cards can be set to expire after a single use. Capital One's Eno browser extension was retired on September 30, 2026, though cards made with it keep working until they expire.

Privacy.com: A third-party service with a free plan (12 new cards a month, with paid plans for more) that issues virtual Visa or Mastercard cards funded from a U.S. checking account or debit card. It can't be funded from a credit card. You can create single-use or merchant-locked cards with spending limits and close them at any time. It's useful if your bank doesn't offer virtual cards natively. Check the cardholder agreement for how fraud protections work.

Chrome autofill and Google Wallet: Some issuers, including Capital One and American Express, let eligible cardholders use virtual numbers through Chrome autofill. Your card needs to be saved in Google Wallet, and Chrome offers the virtual number at checkout, so you don't have to generate one each time. You may need to verify your identity, and some merchants don't support it.

Check your bank's mobile app or website under security or payment settings to see if the feature is available on your account. If it isn't listed there, a quick search for your bank's name plus "virtual card number" will usually confirm whether it's offered and how to access it.

Is a virtual credit card number enough to stay safe online?

It's a strong layer. But no single tool covers everything, and online fraud has grown sophisticated enough that layered protection is the more reliable approach.

Credit card fraud is common. In the FTC's 2024 data, credit card fraud was the most-reported type of identity theft, with 449,032 reports. Much of that involves new accounts opened in a victim's name, which virtual numbers don't prevent, and the methods used have expanded well beyond simple data theft from breached retailers.

Virtual card numbers reduce one specific risk: the exposure of your actual card number to merchants and their systems. That's a meaningful protection, especially given how frequently retail databases are compromised. But what virtual cards don't do is monitor your browsing for scam sites, alert you when you're about to enter your details on a phishing page made to mimic a real retailer, or scan whether your personal data has appeared in a breach. They also can't warn you when a site you're visiting is running a skimming script in the background, capturing keystrokes before your payment details even reach the checkout form.

Those gaps are where other layers come in: careful checkout habits, strong account security, and tools that flag dangerous sites before you reach checkout.

Layering also means using the card protections you already have. A virtual number tied to a credit card keeps credit card protections. According to the CFPB, the most you owe for unauthorized charges on a credit card is $50, and you can dispute billing errors with your issuer, as the FTC explains.

Conclusion

Virtual card numbers keep your real card number away from merchants and limit the damage if a retailer is breached. They don't stop phishing, account takeover, or identity theft, so pair them with strong passwords, two-factor authentication, and a habit of checking your statements.

Guardio doesn't issue virtual cards, but it covers a related risk. Browsing protection on your computer and phone blocks phishing and scam sites before they open and explains why, and Email Security flags phishing emails that get past the Gmail spam filter. No tool catches everything.

Get a free security scan with Guardio today and stay protected from phishing.