Every time you type a card number into a website, you hand a copy of it to a business whose security you cannot inspect. Most shops handle card data responsibly, but breaches happen, and small or fake stores are the riskiest. Virtual card numbers and payment wallets are two ways to avoid giving your real number away. They do not make you invulnerable, but they can reduce what is exposed.
What a virtual card number is
A virtual card number is a card number that stands in for your real one. It usually has its own expiry date and security code, and it is linked to your actual account behind the scenes. Depending on the provider, it may be:
- Single-use. It works for one purchase, then stops working.
- Merchant-locked. It works only at one shop, so a leak elsewhere is useless.
- Limit-controlled. You set a maximum amount or a date range, which suits trials and subscriptions.
- Pausable. You can freeze or delete the number from your app without cancelling your main card.
Whether you can get these depends on your bank, card issuer or a third-party service, and features differ. Some issuers provide them for free as part of an app. Some third-party services charge or require you to share data with another company, so read the terms and consider whether you trust the provider. Be cautious about unknown apps offering “free virtual cards”: fake mobile apps can be used to capture financial details.
What a payment wallet is
A payment wallet is an app or browser feature that stores your card and pays for you. You add a card once, then use your phone, watch or browser to pay in stores or online. Many wallets work with a technique often called tokenization: instead of sending your real card number, the wallet sends a substitute number, or token, that is tied to your device and the specific transaction. The merchant does not receive your actual number.
A wallet payment is usually approved with something that only you should have: a fingerprint, face scan, PIN or phone passcode. That ties the payment to a device that you control, and adds protection if someone has only a copied card number.
Merchant-specific “wallets” also exist, where a shop or service stores your card for you. Those are convenient, but the shop holds your details, so they offer less of the separation described here.
What they help with
- Data breaches at a merchant. If a shop keeps a virtual or tokenized number that gets stolen, it may be useless to the thief, or only usable at that merchant. Your real card is untouched, so you may avoid replacing it.
- Unfamiliar shops. A single-use number is a reasonable choice when you are buying from a store you only partly trust, as one among several store legitimacy checks and online shopping risks to weigh.
- Subscriptions and free trials. A limit or an expiry date helps prevent an unwanted renewal. This also eases the unfamiliar-charge problem described in guides to statement review habits.
- Skimmers and shoulder surfing. Paying by phone avoids showing or handing over a card, a modest benefit in places where screen privacy matters.
- Easier cleanup. You can cancel one virtual number without disrupting every automatic payment attached to your main card.
What they do not do
- They do not make a fake shop honest. A virtual number can stop a thief reusing your details, but it will not deliver the goods you paid for. You can still lose the amount of the purchase.
- They do not stop phishing. If you are tricked into entering a wallet password or a verification code on a fake page, the account can still be taken. Phishing messages remain the main route.
- They do not protect an unlocked phone. If a thief gets your phone and can open it, they might spend through the wallet. A strong screen lock helps, and so does knowing about lost phone tracking.
- They do not remove disputes. Whether a charge can be disputed depends on the card behind the number and the issuer’s rules. Check how disputes work for virtual numbers, since some providers handle them differently.
- They are not always accepted. Some merchants, hotels and car rental firms need the original card for deposits or ID checks, and a single-use number may fail for recurring or delayed charges.
- Returns and refunds can be awkward. A refund to a single-use number that has closed may need the merchant or your issuer to find another route. Keep the order record.
Habits that make them work
- Lock your phone and the wallet. Use a strong passcode or biometric lock and keep the phone updated. Review which devices are registered to your account.
- Secure the account behind it. Use a unique password and two-step sign-in for the bank or wallet account. Using password managers can help.
- Enable alerts. You want to know about every transaction made through a wallet or virtual number, so turn on transaction alerts.
- Match the number type to the purchase. Single-use for one-off orders at unknown shops, a merchant-locked number for regular subscriptions and your standard wallet for in-person purchases.
- Save the details. Record which virtual number you used for which merchant, along with the order confirmation and any support contacts.
- Delete numbers you no longer need. Remove old ones from your app.
- Beware of look-alikes. Install the wallet and issuer apps only from official stores, and reach your bank through your own bookmarks, as lookalike web addresses are used to catch logins.
This article is general information. Availability, fees and protections differ by bank, country and provider, so check the details with yours before relying on any of them.