A virtual card is a second card number issued against an account you already have. It carries its own number, expiry and CVC, and depending on the issuer it can be locked to a single merchant, capped at a spending limit, or set to expire after one use.
The value is containment, not concealment. If the merchant is breached, the number that leaks is one that only works for that merchant and only up to the limit you set. If billing goes wrong, you can close that number without replacing the card in your wallet. Neither property makes the purchase private — it still appears on your statement, still carries your billing details, and still creates a record with the merchant.
What does a virtual card actually change?
Four things, all of them about blast radius.
| Property | Effect |
|---|---|
| Merchant lock | A leaked number is declined everywhere except the merchant it was issued for |
| Spending cap | Bounds the maximum loss and stops silent price increases |
| Independent lifecycle | Closing it does not force a replacement of your physical card |
| Per-merchant isolation | A breach at one service tells you exactly which service leaked |
That last one is underrated. Using a distinct number per subscription turns a fraudulent charge into diagnostic information: you know immediately which merchant lost your data, which you cannot determine when one number is shared across thirty services.
What does a virtual card not do?
This is where expectations most often break.
- It is not anonymity. Your issuer knows exactly what you bought, and your statement records it. A virtual card protects the number, not the fact of the transaction.
- It usually does not change the name and address. Address verification compares what the merchant sends against what your issuer holds. Most virtual cards inherit the parent account's billing details for exactly that reason.
- It does not cancel a subscription. Killing the number makes the charge fail; it does not terminate the agreement. Some merchants retry, some suspend service, and some refer the balance to collections.
- It does not stop the merchant storing your email. The account data is separate from the payment data, and it is usually the more sensitive half.
- It may not be accepted. Some merchants decline prepaid or virtual card ranges outright, particularly for recurring billing.
Which type suits a recurring subscription?
The type matters, because a single-use number and a monthly subscription are directly incompatible.
| Type | Best for | Fails at |
|---|---|---|
| Single-use | One-off purchases, free trials you intend to end | Any recurring charge — the second attempt declines |
| Merchant-locked | Ongoing subscriptions | Nothing structurally, if the limit is set correctly |
| Limit-capped | Capping exposure on a known price | Price rises, tax changes, currency movement |
| Prepaid, separately funded | Keeping a purchase off a main statement line | Refunds, disputes, and merchants that reject prepaid ranges |
For a subscription, a merchant-locked number with a limit is the shape that works. Single-use numbers are for the first charge only, and using one for a trial that converts is the most common self-inflicted failure — the trial ends, the renewal declines, and the account lapses without warning.
How should you set the limit?
Above the expected charge, not exactly at it.
A monthly subscription rarely bills the same figure every cycle. Currency conversion moves, sales tax or VAT can be added or recalculated, and the merchant may bill in its own currency rather than yours. A limit set to the exact advertised price will eventually decline a legitimate renewal.
A workable approach:
| Setting | Reasoning |
|---|---|
| Monthly limit ≈ expected charge plus a clear margin | Absorbs conversion and tax variation without permitting a large unexpected charge |
| One card per merchant | Isolates breaches and makes cancellation unambiguous |
| Leave it open through any refund window | Closed aliases complicate or block refunds |
| Set a calendar reminder before renewal | The card cannot tell you a trial is converting |
What are the failure modes worth knowing in advance?
Most trouble comes from a mismatch between the card and something the merchant checks.
Address verification. If the merchant checks billing address and your virtual card reports something different from what you type, the payment declines with no useful error.
Step-up authentication. A 3-D Secure challenge is issued against the parent account, not the alias, so the verification prompt arrives on the phone number or app tied to your real card. If you cannot receive that, the payment fails even though the card number is valid.
Country signals. The card's issuing country is visible to the merchant, and some platforms use it as one of several inputs when deciding pricing or availability. A card issued in one country while you connect from another can produce inconsistent behaviour — this is a mechanism to be aware of, not a workaround, and deliberately mismatching signals to obtain access commonly breaches the terms you agreed to.
Disputes. The dispute process for an alias generally runs through the parent account, but the practical experience varies by issuer, and a closed number can make the paperwork slower. Do not close a card while a charge is contested.
Availability. Whether you can issue virtual cards at all depends on your bank, your card issuer and your country. There is no universal answer, and it is worth checking what your existing accounts already offer before opening anything new.